Civalta Privacy Policy

This Privacy Policy (the “Privacy Policy”) explains how Civalta, Inc., a Delaware corporation ("Civalta," "we," "us," or "our"), collects, uses, discloses, and safeguards information in connection with your access to and use of civalta.com and the associated platform that connects businesses and organizations seeking public affairs representation ("Clients") with lobbyists and lobbying firms ("Lobbyists") (collectively, the "Platform"). By creating an account or otherwise using the Platform, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, you should not use the Platform.

1. Information We Collect

1.1 Information You Provide to Us

• Account and registration information, such as your name, email address, phone number, job title, and organization name.
• Profile information, including, for Lobbyists, firm name, jurisdictions, issue areas, lobbying registration identifiers, years of experience, and biographical information.
• Engagement-related information, including, without limitation, “Opportunities” (as defined in the Civalta Terms of Service), requests for proposals (commonly known as "RFPs" and included within the definition of Opportunities), proposals, scopes of work, contract terms, invoices, and messages exchanged through the Platform.
• Documents you upload to, or execute through, the Platform’s electronic signature functionality or that you upload to, or use on, the Platform, whether related to Opportunities, proposals, tickets, or otherwise.
• Payment and billing information submitted in connection with subscription fees or invoicing.
• Communications you send to our customer support team.

1.2 Information From Third-Party Sign-In

You may create an account or log in using your Google or Microsoft account. When you do, we receive basic profile information from that provider (such as your name and email address) that you authorize the provider to share with us. We do not receive or store your Google or Microsoft password.

1.3 Email and Communication Features

If you choose to connect a Google or Microsoft email account to use the Platform’s communication features, we work with Nylas, Inc. (“Nylas”), a third-party service provider, to enable sending related to your engagements on the Platform. Civalta cannot access or view the contents of your general Google or Microsoft email inbox. Our access through Nylas is limited to what is reasonably necessary to provide the specific in-Platform communication features you choose to use.

1.4 Information Collected Automatically

• Device, browser, and usage data, including IP address, pages viewed, and actions taken on the Platform.
• Diagnostic, performance, and error data, collected using Datadog, Inc. (“Datadog”) to help us monitor, secure, and troubleshoot the Platform.
• Cookies and similar technologies, used to operate, secure, and improve the Platform. You can control cookies through your browser settings.

2. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Platform, including Opportunities, proposals, engagements, messaging, invoicing, and the shared workspace;
• Create and administer accounts and Organizations;
• Facilitate electronic signature of engagement documents;
• Process payments and platform fees;
• Verify Lobbyist registration status with the relevant jurisdiction’s Secretary of State;
• Provide customer support;
• Send administrative, transactional, and service-related communications;
• Monitor, secure, and improve the performance and reliability of the Platform; and
• Comply with legal obligations and enforce our Terms of Service.

3. How We Share Information

3.1 With Other Users

Certain profile, proposal, and engagement information is visible to other Platform users as part of the Platform’s core functionality — for example, a Lobbyist’s public profile, or the contents of an Opportunity, proposal, or engagement shared between a Client and a Lobbyist.

3.2 With Service Providers

We share information with third-party service providers that help us operate the Platform, each acting on our behalf and, where applicable, subject to their own terms and privacy practices:

• Amazon Web Services (AWS) — cloud hosting infrastructure. Platform data is hosted on AWS servers located in Virginia (US East region).
• Dropbox — electronic signature services. Signed contract documents and related files are stored by Dropbox on our behalf.
• Stripe — payment processing (see Section 3.3).
• Nylas — email and communication features (see Section 1.3).
• Help Scout — customer support ticketing and correspondence.
• Datadog — observability, diagnostics, and performance monitoring.
• Postmark — delivery of transactional and account-related emails.
• Sanity — content management for our public blog. Our blog content management system does not process account or engagement data.
• Google and Microsoft — authentication services used for account sign-in.

3.3 Payments

Payments are processed through Stripe, including, without limitation, Lobbyist invoicing as well as Civalta and Platform fees. For engagements formed on the Platform, the Lobbyist is the merchant of record for amounts paid by the Client for lobbying or public affairs services; Civalta acts solely as a facilitator of the transaction and collects its platform fee through the same payment flow. Civalta does not store full payment card numbers, which are handled directly by Stripe.

3.4 Other Disclosures

• To comply with law, regulation, legal process, or governmental request;
• To protect the rights, property, or safety of Civalta, our users, or others;
• In connection with a merger, acquisition, financing, or sale of assets; and
• With your consent or at your direction.

4. Data Storage and Security

Platform data is hosted on AWS infrastructure located in Virginia and is encrypted at rest. We use administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. Data Retention

We retain information for as long as reasonably necessary to provide the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements, including after an Organization’s account is closed, for so long as necessary for recordkeeping, audit, and legal compliance purposes.

6. Your Choices and Rights

• You may review and update certain account and profile information directly within the Platform.
• You may contact us at [email protected] to request access to, correction of, or deletion of your personal information, subject to our legitimate business and legal retention needs.
• Organizations cannot currently be deleted through self-service account controls. To request deletion of an Organization, please contact [email protected].
• You may control cookies through your browser settings, though disabling cookies may affect Platform functionality.

7. Children’s Privacy

The Platform is intended for business and professional use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

8. Location of Processing

The Platform is currently offered to users in the United States, with an initial launch in Colorado. Information we collect is stored and processed in the United States, including on AWS infrastructure in Virginia.

9. Changes to This Privacy Policy

Civalta reserves the right to change, update, or replace this Privacy Policy, and to change, add, or remove the third-party service providers referenced in it, at any time and in our sole discretion, without prior notice to users. Changes are effective upon posting of the revised Privacy Policy on the Platform, and the “Last Updated” date above will be revised accordingly. Your continued use of the Platform after a change becomes effective constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected].