Privacy Policy

1. The short version

Signing a petition reveals what you believe. We treat that as sensitive data. We don't sell your data, we don't share signer lists with advertisers or petition subjects, and public display of your name is your choice.

2. What we collect

Account: email, display name. Payments: handled by our payment processor; we never see or store full card numbers. Activity: petitions you sign, create, or boost, contribution amounts, and comments you choose to post publicly.

Technical: standard logs (IP, device, pages viewed) used for security, fraud prevention, and making the product work.

3. Political opinions are special-category data

Your signatures can reveal political or moral opinions. Where you are in the EU/EEA/UK, this is 'special category' data under GDPR Article 9, and we process it only with your explicit consent, given when you sign. You can withdraw consent and request deletion at any time.

Everywhere else, we apply the same standard anyway: signature data is never sold, rented, or disclosed to third parties for their own purposes.

4. What's public

The petition's signature count and amount raised are always public. Your name and comment appear publicly only if you choose to post them. You can switch any signature to anonymous later from your account, or ask us to.

5. Who we share with

Payment processing (e.g., Stripe) to process contributions and payouts; hosting and infrastructure providers; analytics limited to aggregate product usage. Each under contracts limiting their use of your data. We disclose data to authorities only when legally compelled.

6. Your rights

Access, correct, export, or delete your data; withdraw consent; complain to your privacy regulator (CAI in Quebec, OPC in Canada, your DPA in the EU). Requests: privacy@ (platform domain). We respond within 30 days.

7. Retention & security

Account data is kept while your account is active and deleted within 90 days of a deletion request, except records we must keep by law (payment and tax records). Data is encrypted in transit and at rest.

8. Responsible person (Law 25)

The person in charge of the protection of personal information can be reached at privacy@ (platform domain). This policy is available in French on request. Cette politique est disponible en français sur demande.