Privacy Policy

Consiliumprovides field intelligence and campaign operations software for political campaigns and committees (the “Services”). This Privacy Policy explains how we handle personal information when you visit our website, create an account, or use the Services.

We handle personal information in two distinct roles, and your rights differ depending on which applies:

• As a business (controller). For our own website visitors, account holders, campaign staff, and prospects, we decide how and why personal information is used. This policy governs that information.
• As a service provider (processor).When a campaign uploads or generates records about its contacts, supporters, donors, volunteers, or constituents (“Customer Data”), we process that data only on that campaign’s documented instructions. The campaign is responsible for its own privacy notice and for the legal basis and consent behind the data it gives us. See Customer Data and campaign responsibilities.

Information you give us

• Account information — name, email address, password credentials, and, if you sign in with Google or Apple, the basic profile information that provider returns. Apple users may choose to share a private relay email address.
• Campaign and team information — campaign or committee name, office sought, jurisdiction, team member roles, and invitations you send.
• Contact information you provide to us — including a mobile phone number, if you give one to receive service or program messages from us.
• Billing information — subscription plan, billing contact, and payment history. Card numbers are collected and stored by Stripe, our payment processor. We never receive or store full payment card numbers.
• Support and sales correspondence — the content of messages you send us and the contact details you use.

Information we collect automatically

• Usage and device data — pages viewed, features used, approximate location derived from IP address, browser and device type, referring page, and timestamps.
• Log and security data — IP address, request metadata, error traces, and authentication events used to operate and secure the Services.
• Cookies and similar technologies — see Cookies and analytics.

Mobile app permissions and activity

The mobile app requests location access while you use the field map to show your position and order nearby doors. It does not track your location in the background. You can decline location access and still browse campaign contacts and mapped addresses. Address searches are processed by the device mapping service. The app requests microphone access when you place an in-app campaign call; call audio is transmitted through Twilio to connect the call. We do not enable call recording in the mobile calling flow. Call connection and quality diagnostics may be processed by Twilio. Saved call outcomes, notes, and field session times are associated with your account and campaign.

You can change permissions in your device settings. If you start a field session, its campaign name, elapsed time, and door count may appear in a Live Activity on your lock screen. You can disable Live Activities in your device settings.

Customer Data processed on a campaign’s behalf

Campaigns use the Services to manage outreach, and the records they load or generate may include names, postal addresses, email addresses, mobile and landline phone numbers, voter file attributes, donation and compliance records, survey responses, canvassing notes, call logs and dispositions, message delivery events, and opt-out status. We process these records as described in Customer Data and campaign responsibilities.

We use personal information to:

• provide, operate, maintain, and improve the Services;
• create and authenticate accounts, and enforce roles and permissions;
• deliver messages, calls, email, and mail that a campaign sends through the Services, and record delivery and opt-out results;
• process subscriptions, usage-based charges, and invoices;
• send service and transactional communications, including account, security, billing, and support notices;
• provide customer support and respond to your questions and requests;
• monitor for, investigate, and prevent fraud, abuse, and security incidents;
• produce aggregated or de-identified statistics that do not identify any individual; and
• comply with legal obligations and enforce our Terms of Service.

We do not use Customer Data to train general-purpose machine learning models for our own or any third party’s benefit, and we do not use Customer Data for our own marketing.

This section applies to text messages you receive from Consilium after you provide your mobile phone number and agree to receive them.

No sharing of mobile information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third parties. All of the sharing categories described in How we share information exclude text messaging originator opt-in data and consent. We disclose mobile phone numbers only to the messaging service providers who transmit messages on our behalf (currently Twilio), strictly for that purpose, and we do not sell, rent, or trade mobile numbers or SMS consent to anyone.

Message frequency

Message frequency varies, and is no more than 10 messages per month per recipient. Frequency depends on the program you joined and on account activity such as security alerts and billing notices.

Message and data rates

Message and data rates may apply. Consilium does not charge for text messages, but your mobile carrier’s standard message and data rates apply to every message you send or receive. Check your plan with your carrier if you are unsure of your rates.

How to opt out or get help

• Opt out: reply STOP to any message at any time. We will send one confirmation message and then stop sending messages to that number.
• Opt back in: reply START to resume messages.
• Help: reply HELP or email austin@consilium-usa.com.

Consent to receive text messages is not a condition of any purchase. Carriers are not liable for delayed or undelivered messages. Message delivery is not guaranteed and depends on your carrier and device.

Messages sent by campaigns

When a campaign sends text messages to its own contacts through the Services, that campaign — not Consilium— is the sender and is responsible for obtaining and documenting prior express consent, honoring opt-outs, and publishing its own messaging disclosures. We record opt-out requests received for a campaign and suppress further messages to that number for that campaign. To stop messages from a specific campaign, reply STOP to that campaign’s message.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We disclose personal information only in the circumstances below, and these categories exclude text messaging originator opt-in data and consent, which are never shared.

Service providers and subprocessors

We use vendors that process personal information only to perform services for us under contract:

• Supabase — application database, authentication, and file storage.
• Vercel — application hosting and content delivery.
• Stripe — subscription billing and payment processing.
• Twilio — SMS/MMS messaging and voice calling.
• Twilio SendGrid and Resend — email delivery.
• Lob — printed direct mail production and delivery.
• OpenAI— AI-assisted drafting and research features. Content submitted through our OpenAI integration is not used to train OpenAI’s models.
• PostHog and Google Analytics — product and website analytics.
• OpenStreetMap Nominatim and Overpass — geocoding and map data for turf planning.

Other disclosures

• At your direction — to recipients and integrations you choose, and to other members of your campaign workspace.
• Legal and safety — to comply with law, valid legal process, or a governmental request; to enforce our agreements; or to protect the rights, property, or safety of Consilium, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy or a successor policy with equivalent protections.
• Aggregated or de-identified data — information that cannot reasonably be used to identify you.

We use cookies and similar technologies for two purposes:

• Strictly necessary — session and authentication cookies that keep you signed in and protect against request forgery. The Services will not work without these.
• Analytics — PostHog and Google Analytics help us understand how the site and product are used. Analytics events are configured to exclude email addresses, payment details, and direct contact information.

You can block or delete cookies through your browser settings, and you can opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on. We honor Global Privacy Control signals as an opt-out of any sale or sharing of personal information, although we do not sell or share personal information.

A campaign that uses the Services controls the Customer Data in its workspace. We process that data solely to provide the Services, and we do not sell it, retain it outside the scope of our agreement, or use it for any purpose other than the campaign’s instructions.

Each campaign is responsible for:

• having a lawful basis and, where required, prior express written consent to contact each individual by text, call, email, or mail;
• maintaining records of consent and honoring opt-out, do-not-call, and do-not-mail requests;
• complying with the Telephone Consumer Protection Act, CAN-SPAM, state calling and texting laws, carrier and A2P 10DLC requirements, and applicable campaign finance and disclaimer rules; and
• publishing its own privacy notice to its contacts.

If you are a member of the public and want your information corrected or removed from a campaign’s records, contact that campaign directly. If you contact us instead, we will refer your request to the campaign and assist it in responding. You can email austin@consilium-usa.com for help identifying the right campaign.

In the mobile app, open Profile and choose Delete account to permanently remove your sign-in account, personal profile, memberships, and personal field-session history. Subscriptions billed to that account are canceled. Shared campaign records remain under the campaign’s control with account attribution removed; deletion of an individual team account does not delete the campaign’s contact database. Records we must retain for legal, financial, or security purposes and routine backup copies are subject to the retention periods below. If Apple access cannot be revoked automatically, the app explains how to revoke it in your Apple settings.

We keep personal information only as long as needed for the purposes described in this policy:

• Account information — for the life of the account and for a reasonable period afterward to resolve disputes and enforce our agreements.
• Customer Data— for the term of the campaign’s subscription. After termination we delete or return it on request, and otherwise delete it within 90 days, excluding routine encrypted backups that expire on their own schedule.
• Opt-out and suppression records — retained indefinitely, because we need them to keep honoring the opt-out.
• Billing and tax records — retained as long as required by law.
• Security and audit logs — retained for a limited period appropriate to the risk.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, row-level access controls that scope data to the owning campaign, role-based permissions, signed webhooks for third-party integrations, least-privilege access for staff, and logging of administrative actions.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, or if you discover a vulnerability, contact austin@consilium-usa.com right away.

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to opt out of the sale or sharing of personal information and of targeted advertising; to limit the use of sensitive personal information; and to appeal a denied request. We do not sell or share personal information, and we do not use it for targeted advertising or profiling that produces legal or similarly significant effects.

Residents of California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia, among others, have these rights under state privacy law. If you are in the European Economic Area or the United Kingdom, you also have the right to object to or restrict processing and to lodge a complaint with your supervisory authority.

To exercise a right, email austin@consilium-usa.com from the address associated with your record, or write to us at Consilium, Boise, Idaho, United States. We will verify your identity before acting and will respond within the time required by applicable law, generally 45 days. An authorized agent may submit a request with proof of authorization. We will not discriminate against you for exercising a privacy right.

You can also opt out of marketing email by using the unsubscribe link in any message, and out of text messages by replying STOP. We will still send service and transactional messages about your account.

The Services are operated from the United States and personal information is processed and stored there. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law of your jurisdiction. Where required, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses for these transfers.

The Services are built for campaign professionals and are not directed to children. We do not knowingly collect personal information from anyone under 16 for our own purposes. If you believe a child has provided us personal information, contact austin@consilium-usa.com and we will delete it.

We may update this Privacy Policy as the Services and the law evolve. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will give account holders advance notice by email or in the product. Continuing to use the Services after an update means you accept the revised policy.

Questions, requests, or complaints about privacy can go to Consilium at:

• Email: austin@consilium-usa.com
• Mail: Consilium, Boise, Idaho, United States

For the rules that govern your use of the Services, including the full messaging program terms, see our Terms of Service.