What we collect, and what we do with it.

CivicStack is published by Civic Pulse LLC (“we”, “us”). This policy covers the website at civicstack.co, the early-access waitlist, and the emails we send to people on it. It is written to be read, not skimmed. If something here is unclear, ask us at hello@civicstack.co.

The short version

• We collect what you type into the waitlist form and a few technical details about the request. Nothing else.
• We use it to decide who gets early access first, to email you about it, and to decide what to build.
• We do not sell it, rent it, or share it for advertising. Five named companies process it on our instructions.
• The site sets no cookies. Analytics are cookieless and tied to pages, not people.
• You can see, change, or delete your entry at any time by writing to us. Every email has a one-click unsubscribe.

What we collect

When you join the waitlist we store what you give us:

• Your email address (required).
• Your company name: prefilled from a work-email domain and editable by you, typed by you, or left blank.
• Your role, whether you sell to government, and how many public contracts you hold, each picked from a short list, each optional.
• An optional free-text note about a contract term that surprised you.
• Which pricing tier you clicked, if any.

And a few things the request itself carries:

• The page you arrived from and any campaign tags in the address (so we know which channels work).
• Your browser’s user-agent string (so we can tell real browsers from automated traffic).
• A keyed, shortened hash of the network address you signed up from. We use it only to limit how many signups one network can make in an hour. It is not the address and cannot be turned back into it.
• A random token that lets the links in our confirmation email update your own entry. It is not a login and it is never shared.

Separately, a cookieless analytics tool records page views and the steps of the signup form (started, submitted, profile shown, field set, skipped, completed, pricing tier clicked). Those events are not tied to your name, email, or any persistent identifier; each page load is a new anonymous visitor to that tool. We use them only to see where the form loses people.

What we do not collect

No cookies, no local storage, no advertising identifiers, no fingerprinting, no session recording, no tracking across other sites, no precise location. Fonts are served from our own domain, so no font provider sees your visit. If that ever changes, this policy changes first and you will be asked before anything is set.

Why we use it

• To run the waitlist. To record your place, send you a confirmation, and later tell you when your invite is ready.
• To invite by fit. Role, sector, and contract count decide who gets early access first and in what order.
• To decide what to build. The aggregate of answers shapes the product. Individual notes are read by the team; they are not published.
• To keep the form honest. The hashed network address, the user-agent string, and a hidden form field exist to stop bulk and automated signups.
• To measure the page. Cookieless events tell us which steps lose people.

We do not use your data to build advertising profiles, and we make no automated decisions about you that have legal or similar effects.

Our legal basis, where one is required

If you are in the European Economic Area, the United Kingdom, or another place that asks us to name a legal basis: we rely on your consent for joining the waitlist and answering the profile questions (you can withdraw it by unsubscribing or asking for deletion); on our legitimate interest in keeping the form free of abuse and understanding how the page performs, in ways that do not identify you; and on our legal obligations for records we must keep, such as proof that you unsubscribed.

Who processes it for us

No one sees your data except the following companies, which store or move it on our instructions and under their own data-processing terms:

• Vercel, Inc.: hosting and delivery of the website.
• Supabase, Inc.: the database that stores waitlist entries, in a United States data center.
• Resend, Inc.: sending the confirmation and invite emails.
• PostHog, Inc.: cookieless product analytics, United States region.
• Google LLC (Google Workspace): the mailbox that receives your replies and requests.

We will update this list before adding a processor. We may also disclose data if the law requires it, to protect someone’s safety, or to a successor entity as described under “Changes and assignment” below. We never sell or share personal information for money or for advertising, in the sense those words have under California law or any other.

Where it is kept

Our processors run in the United States. If you are outside the United States, your data is transferred there. Our processors rely on standard contractual clauses or an equivalent mechanism for those transfers.

How long we keep it

• Waitlist entries: until early access opens and for twelve months after, then deleted, unless you have become a customer, in which case your account terms apply.
• Unsubscribed addresses: your entry stays, marked unsubscribed, so that we never email you again. Ask and we delete it outright.
• Analytics events: kept by the analytics tool for up to twelve months, and they contain nothing that identifies you.
• The hashed network address: kept with your entry and deleted with it.

How we protect it

Traffic to the site is encrypted. The database that holds entries refuses direct access from the website and accepts writes only through a small set of checked procedures; no API key that can read entries is ever sent to a browser. Signup is limited per network and per hour. Access to the data is limited to the people who run the waitlist. No system is perfectly secure; if we learn of a breach that affects you, we will tell you without undue delay and as the law requires.

Your choices and rights

• Unsubscribe from any email with the link in its footer. It takes effect immediately.
• See, correct, or delete your entry by writing to hello@civicstack.co. We answer within 30 days and we do not charge for it. We may ask you to confirm the request from the email address on the entry.
• Where the law gives you more (California, Virginia, Colorado, Connecticut, Utah, the EEA, the UK, and others): the rights to access, port, restrict, object, and appeal a refusal are handled at the same address. We do not discriminate against anyone for exercising them. You may also complain to your local data-protection authority.
• Do Not Track and Global Privacy Control: because we do not sell or share data or track you across sites, there is nothing to opt out of; we honour those signals by default.

Children

The waitlist is for people who sell to government on behalf of an organisation. It is not directed at anyone under 18, and we do not knowingly collect their data. If you believe a minor has joined, tell us and we will delete the entry.

Changes and assignment

If we change this policy we change the effective date above and, for material changes, email the waitlist before they take effect. If Civic Pulse LLCreorganises or is succeeded by another entity, that entity assumes this policy on the same terms, and we will tell you.

Contact

Civic Pulse LLC, hello@civicstack.co. The Terms of Service, Accessibility statement, and Legal notices cover the rest.