Effective date
This notice is effective October 11, 2026. When we change it, we post the new version here with a new effective date.
California privacy rights (CCPA / CPRA)
When the California Consumer Privacy Act or California Privacy Rights Act applies, California residents may have rights to know, delete, or correct personal information, opt out of sale or sharing, limit certain uses of sensitive personal information, and avoid discrimination for exercising applicable rights.
VoterFile also uses the request channel below for privacy questions even when a statutory right does not apply.
VoterFile does not share personal information for cross-context behavioral advertising and does not resell or pool a shared voter file. California Nonbusiness and Unknown customer workspaces default to authorized official-field processing without VoterFile-created voter-level models.
If a future accepted order activates California's data-broker/DROP lane for a customer-specific modeled field, California may treat the paid output as a sale or license. Before processing, VoterFile must activate required DROP access, payment, deletion/suppression, risk-assessment, disclosure, and opt-out controls; complete required annual registration; and update this notice.
To submit a privacy rights request, email hello@voterfile.io with the subject line "Privacy rights request."
Include the right you are exercising and enough detail to verify the request, typically the email address or identifier you used with the service.
We aim to respond within 45 days or the period required by applicable law and will explain a permitted extension, inability to verify, exception, or denial.
If a request concerns voter-registration data in a campaign workspace, identify the customer, state, and source if known. Election-law, agency, protected-person, and campaign-processor rules may require a different response or routing through the customer that controls the workspace.
- When applicable: know what personal information we collect, use, disclose, sell, or share
- When applicable: delete personal information we collected from you
- When applicable: correct inaccurate personal information
- When applicable: opt out of sale or sharing, including any activated broker-lane processing
- When applicable: exercise privacy rights without discrimination
- An authorized agent may submit an applicable request with proof of authorization
Access-request information
When someone requests access, we collect the name, email, role, and campaign or race information they submit. We use that information to verify the request, follow up, and decide whether the beta is a fit.
We do not sell access-request submissions. We use them to operate the beta and communicate about VoterFile.
We keep access-request and onboarding information only as long as needed for beta qualification, follow-up, product operations, and necessary operational records. Campaign contacts can request removal through VoterFile contact channels.
Campaign and voter data
In a BYO workspace, a qualified customer supplies voter data it is authorized to use. In an approved data-included workspace, VoterFile may obtain an approved official-source file solely for one named customer after access review, quotation, customer authorization, and source approval.
Handling may include acquisition support, secure transfer, file loading, validation, normalization, deduplication, deterministic address cleanup and mapping, source-field filtering, campaign CRM activity, exports, support, security logging, and offboarding. Voter-level scoring or another modeled inference is included only when the accepted order's customer classification and activation record permit it.
VoterFile does not sell or license a shared voter file, make voter records publicly searchable, pool files across customers, reuse one customer's voter data for another customer, or use workspace voter data for unrelated commercial marketing or shared model training.
The customer controls its campaign purpose, authorized users, universes, outreach, and exports. The signed order, data-processing terms, source restrictions, and state-specific care clause can impose additional limits.
Campaign email sign-up pages
A campaign that uses VoterFile can put an email sign-up page on its own website address. The campaign collects the sign-ups and owns the list. VoterFile hosts the page and sends the confirmation email for the campaign, as its vendor.
The page asks only for your email address and a checkbox that says you want email from that campaign. Nothing is filled in or checked for you.
When you sign up, we record your email address, that you checked the box, the exact wording and version of the form you saw, the time, which kind of link you used (the web page, a QR code, or an event), and the browser and device description that your browser sends. Vercel, our host, also runs an invisible check on the form to tell people from bots. There is no puzzle to solve.
We use your IP address to stop abuse, such as one network adding many addresses to a list. Our rate limiter keeps the IP address for about five minutes. The sign-up record keeps only a scrambled code made from it with a secret key, not the address itself.
You are not signed up until you confirm. We send one email from the campaign's own address. Its link opens a page on the campaign's website with a Confirm button, and you are added only after you click it. We record when that email went out and when you confirmed. The page sends at most one confirmation email to an address in any 7 days. If you did not sign up, ignore the email and you will not be added. A second link in it stops the campaign from emailing your address again, including more confirmation emails.
Every email the campaign sends to its list has an unsubscribe link that needs no login, and mail apps that offer one-click unsubscribe can use that instead. When you unsubscribe, the campaign's email to you stops right away and your address goes on that campaign's do-not-email list.
Each campaign's list and do-not-email list are its own. We never share them with another campaign, combine them across campaigns, sell them, or use them to market VoterFile.
The campaign can download its list, with each person's sign-up record, and can delete our copy at any time. When it deletes the list, we keep its do-not-email list, so people who unsubscribed do not hear from that campaign through us again. To have your sign-up removed, ask the campaign, or email hello@voterfile.io and we will pass your request to the campaign that controls the list.
Sign-up pages do not load Google Analytics or our other analytics tools.
Email we send for campaigns
A campaign can send email to people on its own lists, either from its VoterFile workspace or through our done-for-you email service. The campaign picks the list and writes or approves the message, and we send it for the campaign as its vendor.
To send each email, the sending service receives the recipient's email address, the first name if the message uses it, and the message. Email sent from a workspace goes out through Resend today. Done-for-you sends may go through a sending partner in the US instead. We may later send a campaign's email to its confirmed sign-ups through Amazon SES in a US region. That is built but not switched on.
Every campaign email carries the campaign's "Paid for by" line and an unsubscribe link. In email sent from a workspace, that line is built from the committee details the campaign saves, and the unsubscribe link needs no login.
For email sent from a workspace, we record whether each email was delivered, bounced, or reported as spam, and whether the recipient unsubscribed. An unsubscribe, a bounce, or a spam report puts the address on that campaign's do-not-email list. It stops that campaign's email to the address and is never used for any other campaign.
We also keep an exact copy of each version of a workspace email, with the dates it was sent and how many went out, for at least 5 years after its last send, because campaigns must keep these records. The copy holds no recipient addresses.
We do not sell recipient addresses, share them with other campaigns, or use them to market VoterFile.
Retention, return, and deletion
We retain voter-level source and workspace data for the service term and documented offboarding period, subject to the signed order, source rules, legal holds, suppression duties, and technical backup cycles.
On an authorized request or termination, we stop ordinary processing and return or delete the source file and voter-level workspace data as the agreement and applicable law require. We may retain limited billing, contract, security, access, suppression, and compliance records, but not a reusable voter file for another purpose.
Campaign contacts can request workspace offboarding through the order's support channel. Individual voter or protected-person requests may be routed through the customer or a state-specific process so the legally responsible party can verify and complete them.
Analytics
We use Vercel Web Analytics, Vercel Speed Insights, and Google Analytics 4 on public, non-protected pages to understand page traffic, access-request conversion, site interactions, and Core Web Vitals performance.
These tools may collect page URL, referrer, browser and device information, approximate location derived from IP address, event data, conversion events, performance metrics, and may set or read cookies or similar identifiers.
Google Analytics loads only after you click Accept in the cookie banner. Until then, and if you click Decline, nothing loads from Google. We turn off Google's advertising storage and ad personalization settings.
Vercel Web Analytics and Speed Insights do not wait for that choice. They run on public pages to count visits and measure page speed. Before a page address goes to Google Analytics or to Vercel's tools, we remove the part after the # sign and every query parameter except source and the utm_ campaign tags.
None of these tools run on logged-in workspace pages, campaign sign-up and unsubscribe pages, or invitation pages, and we do not use analytics data to sell personal information or share it for cross-context behavioral advertising.
We also collect Core Web Vitals performance metrics ourselves, sent directly to VoterFile. That beacon carries only the page route, the metric name and value, and a coarse device type. It sets no cookies and includes no identifiers.
Do Not Track and Global Privacy Control
Some browsers send a Do Not Track signal. There is no common standard for how sites should respond to it, and our site does not look for it.
We do honor Global Privacy Control, a newer browser signal. If your browser sends it, Google Analytics stays off, even if you clicked Accept. We do not turn off our other tools for it.
Error and performance monitoring
We use Sentry for error monitoring, crash reporting, and performance diagnostics in deployed service environments. When an error or monitored performance event occurs, Sentry may receive technical diagnostic information such as page route or URL, browser and device details, stack traces, error messages, timestamps, and non-PII workspace or account identifiers used for debugging.
We configure Sentry not to attach default request personal information and use a scrubber to reduce sensitive fields before events are sent. We use Sentry data for security, reliability, debugging, and product operations, and we do not use it to sell personal information or share it for cross-context behavioral advertising.
We do not record visitor sessions. Sentry's session replay feature is turned off.
Payments
If you buy a workspace or accept a quoted service order, payments are processed by Stripe. VoterFile sends Stripe the information needed to create and reconcile checkout, such as customer email, order identifiers, payment amount, package or race description, return URL, and transaction metadata.
A data-included order may separately record an approved official-source cost or deposit, source agency, maximum approved amount, agency receipt, unspent balance, and refund status. VoterFile does not silently treat an unknown or material agency charge as included in a flat software price.
Card details are entered in Stripe Checkout and handled by Stripe; VoterFile does not receive or store full card numbers.
AI features
Two optional features use AI: turning a typed request into voter filters (in the filter builder and the assistant chat), and drafting outreach messages. They use OpenAI models first, with Anthropic models, directly or through Vercel AI Gateway, as a backup.
For filters, the AI provider receives the request you typed, after we check it for pasted personal details, and a fixed description of the filter fields. It does not receive voter records, counts, query results, or workspace identifiers. We run the filter and show the results on our side.
For message drafts, the AI provider receives the channel, goal, language and tone you pick, the race and candidate or measure name, and the key points and audience description you type. It does not receive voter records or your contact lists. Anything you type into these boxes is sent as you wrote it.
SMS and text messaging
Campaigns that use VoterFile can send text messages to their own contacts. We keep the phone numbers a campaign sends to, and a record of each STOP, START, and HELP reply with the time it came in. Each campaign is responsible for having consent to the texts it sends.
We do not share or sell SMS opt-in data, mobile phone numbers, or consent records to third parties for marketing purposes. Phone numbers and consent records are used only to send the messages the user opted in to receive, to honor STOP and HELP requests, and to keep records required by carrier and platform rules.
Message frequency varies by campaign. Message and data rates may apply per the recipient's mobile carrier plan.
Recipients can opt out at any time by replying STOP to any message, which immediately removes the number from the sending list and stops future sends. Replying HELP returns instructions for getting in touch and confirms the messaging program the number is subscribed to.
Need California voter-file software for a real campaign?
Start campaign setup for eligibility review, pricing, and onboarding for qualified California campaigns that bring an authorized voter file.
Questions
Do you sell access-request data?
No. Access-request data is used for beta qualification, follow-up, and product operations.
Can campaigns request deletion?
Yes. Campaign contacts can ask for access-request or onboarding information to be removed through VoterFile contact channels.
Do you share SMS opt-in data with third parties?
No. SMS opt-in data, phone numbers, and consent records are never shared or sold to third parties for marketing. They are used only to send the messages the user opted in to, honor STOP and HELP requests, and meet carrier recordkeeping rules.