Privacy Policy | Victory Waves

Victory Waves Co. ("Victory Waves," "we," "us," or "our") provides campaign technology, voter-data tools, canvassing and phone-banking features, and petition-processing services, including Petition Validator. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through our websites, applications, and services (collectively, the "Services").

This Policy applies to several different groups of people:

Account users and website visitors, including campaign staff, candidates, consultants, volunteers, and representatives of organizations that use or inquire about our Services.
People whose information a Victory Waves customer provides to us, such as petition signers, campaign contacts, supporters, donors, volunteers, or people contacted through canvassing and phone-banking activities.
Registered voters whose information appears in voter-data products we license from third-party providers. In many cases, these individuals have not interacted directly with Victory Waves.
Candidates for public office, whose candidate filing documents we obtain ourselves, directly from state and county election authorities, so that we can tell their campaigns about our Services.

The practices that apply to you depend on your relationship with Victory Waves and the source of your information. When a campaign or organization provides personal information to us and we process it solely on that customer's behalf, the customer generally controls the information and its use. The customer's own privacy notices and practices also apply.

Personal Information We Collect

Account, registration, and billing information

When you create or use a Victory Waves account, contact us, or purchase Services, we may collect:

Name, email address, mobile phone number, organization, role, and account preferences.
Login, authentication, and account-security information.
Subscription, transaction, and billing information. Payment-card information is processed by our payment provider, and we do not store full payment-card numbers on our servers.
Communications with us, including support requests, sales correspondence, survey responses, and feedback.
Records of your consent and communication preferences, including SMS opt-in and opt-out records.

Customer-provided campaign and petition information

Our customers and their authorized users may upload, enter, import, generate, or otherwise provide personal information through the Services. Depending on the features used, this may include:

Campaign contact, supporter, volunteer, donor, and voter records.
Contact details, voter identifiers, district information, tags, lists, notes, survey responses, canvassing results, phone-banking results, and outreach history.
Petition sheet photographs or scans and information appearing on them, including printed or handwritten names, addresses, dates, signatures, circulator or witness information, and other petition-related information.
Petition transcriptions, voter-match results, possible duplicate or invalid-entry indicators, review decisions, and exported reports.
Files, lists, prompts, searches, reports, and other content created or imported by users.

When we process this information on behalf of a customer, the customer is responsible for determining what information is collected and how it may be used, and for providing any notices or obtaining any permissions required by law.

Licensed voter data

We license voter data from commercial data providers, including L2 (Labels & Lists, Inc.) and TargetSmart Communications. These providers obtain voter-registration records from state and county election authorities and may append commercially sourced or modeled information.

Depending on the state, source, and product, licensed voter data may include:

Name, registration address, mailing address, phone number, and email address.
Voter-registration status, party affiliation, voting districts, voter identifiers, and past election participation. Election participation indicates whether someone voted, not how the person voted.
Geographic coordinates or other location information derived from a registration address.
Modeled demographic, political, or issue-related attributes, which are statistical estimates and may be inaccurate.
Mobile advertising identifiers and other audience-related identifiers, where available and permitted.

We do not obtain voter-registration information directly from election authorities; our providers do. We do obtain candidate filing documents directly from those authorities, which is described separately below. Additional detail about the categories of voter data we process, our sources, purposes, retention practices, and disclosures appears in our Notice at Collection.

Candidate filing information

We obtain candidate filing documents directly from state and county election authorities, as public records, and extract information appearing on them, which may include a candidate's name, the office sought, committee or campaign details, filing dates, and contact information.

We use this to identify campaigns that may want our Services and to contact them about it. Unlike licensed voter data, we collect this ourselves rather than obtaining it from a data provider.

A limit we hold ourselves to: we contact campaigns, not government offices. Where a filing lists official or governmental contact details for a person already holding office, we exclude those from outreach and use campaign-side contact information instead.

Device, website, and usage information

When you visit or use the Services, we may automatically collect:

IP address, browser type, device type, operating system, device identifiers, and approximate location derived from an IP address.
Pages and features viewed, links clicked, searches and actions performed, referring pages, dates and times of access, and diagnostic or error information.
Authentication, security, and audit logs.
Cookie and similar-technology information described below.

If you enable a feature that requires device location, such as location-based canvassing or mapping, we may process your device location with your permission. You can control device-location access through your device settings, although disabling it may prevent the relevant feature from working.

Information from connected services

If you connect a third-party account or service to Victory Waves, we receive information authorized by you and permitted by that service. For example, connecting a Google account may allow us to access certain Google account, Calendar, or Contacts information as described in the Google API Services User Data section below.

Sources of Personal Information

We collect personal information:

Directly from account users, website visitors, customers, and people who communicate with us.
From our customers and their authorized users when they upload, import, or generate campaign, contact, voter, or petition information.
Automatically from browsers, devices, cookies, analytics technologies, and use of the Services.
From connected services when a user authorizes an integration.
From voter-data licensors and commercial data providers, including L2 (Labels & Lists, Inc.) and TargetSmart Communications.
Directly from state and county election authorities, in the form of candidate filing documents, which are public records.
By generating information through matching, transcription, analytics, modeling, and other product functions.

This list is intended to be complete rather than illustrative. If we begin collecting from a source that is not listed, we will add it here.

How We Use Personal Information

Depending on the type of information and our relationship with the individual, we may use personal information to:

Provide, administer, personalize, and support the Services.
Create and secure accounts, authenticate users, and maintain audit records.
Process payments, subscriptions, and transactions.
Provide voter search, filtering, list-building, mapping, canvassing, phone-banking, outreach, reporting, and campaign-management functions.
Transcribe petition materials, match petition entries against voter records, identify possible duplicate or invalid entries, and produce petition-related reports and exports.
Enable customers to organize and communicate with their contacts, supporters, volunteers, voters, and other audiences in accordance with their own legal obligations.
Respond to questions, provide support, and communicate about accounts, transactions, product changes, security, and the Services.
Send marketing communications where permitted and manage communication preferences.
Monitor performance, troubleshoot problems, understand product usage, and improve the Services.
Develop and test features, including automated document-processing, matching, search, analytics, and artificial-intelligence features.
Detect, investigate, and prevent fraud, misuse, security incidents, and violations of our agreements or policies.
Comply with law, enforce our agreements, exercise or defend legal claims, and protect rights, property, safety, and the integrity of the Services.

Some Victory Waves features use automated processing and artificial intelligence to transcribe petition materials, match records, search or analyze data, and generate campaign-related outputs. We may use service providers to support these functions. We select these providers on terms intended to prevent customer-provided content from being used to train their general-purpose models, and we review those terms as our vendors change.

Modeled attributes, automated transcriptions, match results, and other generated outputs are estimates and may be incomplete or inaccurate. Customers are responsible for reviewing outputs before relying on them for campaign, petition, or other decisions.

How We Disclose Personal Information

We may disclose personal information in the following circumstances:

Customers and authorized users

Information provided through a customer's account may be available to that customer, its authorized users, and other people or organizations the customer directs us to share it with. For example, petition materials and results may be available to the campaign or organization that submitted them.

Voter-data customers and partners

We make licensed voter data available through the Services to political campaigns, political committees, consultants, advocacy organizations, and other authorized customers, as well as to partners that resell or facilitate access to campaigns, subject to contracts and applicable law. This is part of our voter-data product.

Depending on the applicable law and the particular arrangement, making voter data available in this manner may be considered a "sale" of personal information. You may direct us to stop selling or sharing personal information covered by applicable law through Your Privacy Choices.

Service providers

We disclose personal information to vendors that help us operate and secure the Services. These may include providers of:

Cloud hosting, storage, databases, and security.
Authentication and account management, including Clerk.
Payment processing, including Stripe.
Product and traffic analytics, including Google Analytics and PostHog.
Communications, customer support, email, and text messaging.
Mapping, address processing, data processing, document processing, and artificial-intelligence services.
Professional services such as legal, accounting, insurance, and auditing.

We require service providers to process personal information only for authorized purposes and to protect it appropriately, as required by our contracts and applicable law.

Data providers

We may disclose limited information to voter-data and other data providers when necessary to provide matching, fulfill customer requests, maintain data quality, verify permitted use, or comply with our licensing agreements.

Legal, safety, and business purposes

We may disclose information:

When required by law, legal process, or a valid government request.
To enforce our agreements and policies or protect rights, property, safety, security, or the Services.
In connection with an actual or proposed financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate protections.
At your direction or with your consent.

Customer and User Information Versus Licensed Voter Data

We do not sell, rent, or trade account information or customer-provided campaign information to outside parties for their own marketing purposes.

Licensed voter data is different: making that data available to authorized campaigns, committees, advocacy organizations, and partners is part of the product we provide. We offer applicable privacy rights and opt-out mechanisms for this information through Your Privacy Choices.

We do not use an account user's browsing activity to serve behavioral advertisements or build retargeting audiences today. Advertising and measurement of our own services is a declared purpose in Cookies and Similar Technologies below, so if that changes you will find the vendors named there and an opt-out available.

That is a separate question from what our customers do with their own data. Some campaign tools allow customers to select, use, or export audience information based on licensed voter data or their own contacts. That is the customer acting on their data, and it is not the same thing as us tracking account users for advertising — the two should not be read together.

Cookies and Similar Technologies

We use cookies, browser local storage, and similar technologies for the following purposes: authentication, preferences, payments, analytics, security, product improvement, and marketing and measurement of our own services — which may include advertising and retargeting.

Those purposes are the substance of this disclosure and they will not expand without notice. The specific technologies we use to achieve them change as our vendors change; the list below is what is in use today and we keep it current. Advertising and retargeting technologies are not in that list at present. Adding one would update the inventory, not this purpose statement.

If we do begin advertising or retargeting, two things follow regardless of what this page says, and we would rather set the expectation now: we will name the vendors involved, and you will get a working opt-out — because using these technologies counts as sharing personal information under several state laws, which gives you the right to refuse. Where the law requires consent rather than an opt-out, we will ask for it.

Two things are not on the purpose list, because they are not ours to reserve. We will not sell or share personal information without offering a working opt-out at the time, and nothing here should be read as advance permission to sell sensitive personal information. Several states prohibit that outright, and a privacy policy cannot consent on your behalf.

Grouped by what they do, rather than by cookie name — the names change, the purposes do not:

Strictly necessary — authentication and session security, provided by Clerk. The Services cannot function without these.
Preferences — a small number of cookies that remember choices you have made, such as your language and whether you left the dashboard sidebar expanded, and whether you have already seen an introductory walkthrough.
Analytics and product improvement — Google Analytics, deployed through Google Tag Manager, and PostHog. PostHog may store its identifier in browser local storage rather than a cookie.
Payments and fraud prevention — Stripe, on billing pages only.

Session replay

PostHog may record clicks, navigation, and page changes so we can reproduce bugs and understand where workflows fail. All form inputs are masked before a recording leaves the browser, and elements designated as sensitive are also masked. Victory Waves staff accounts are excluded from session replay.

Your choices

You can configure your browser to warn you about, block, or delete cookies. Blocking authentication technologies will prevent you from signing in. Blocking preference technologies may cause the site to forget your settings. Browser controls may not affect all forms of local storage or previously collected information.

Where applicable law requires consent before using a nonessential technology, we request that consent. Where applicable law requires us to honor a qualifying opt-out preference signal, we do so as described below.

Opt-Out Preference Signals and Do Not Track

Some browsers and extensions transmit opt-out preference signals, such as Global Privacy Control (GPC). We do not yet detect or act on these signals automatically. We are building that capability. Until it is in place, we will not claim it: you can exercise the same right directly through Your Privacy Choices, and we will honor it.

Most browsers also offer a Do Not Track (DNT) setting. Because no generally accepted standard emerged for interpreting DNT signals, we do not change our practices in response to a DNT header.

SMS Messaging and Mobile Information

If you affirmatively opt in to receive text messages from Victory Waves, we may collect and use your mobile phone number, SMS consent status, and related messaging data to provide customer-support, account-related, and campaign-workflow messages.

Consent to receive SMS messages is not a condition of purchase. Message frequency varies based on your account activity, support interactions, and use of Victory Waves features. Message and data rates may apply, depending on your wireless carrier plan.

You may opt out at any time by replying STOP to a message. For help, reply HELP or contact us at info@victorywaves.com.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent will not be sold or shared with third parties, except with service providers and platform vendors that help us deliver the messaging service and only to the extent necessary to provide that service.

Google API Services User Data

Victory Waves' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google data we access

When you connect a Google account, we may request access to:

Google Calendar information needed to read and display calendar events for campaign scheduling.
Google Contacts information on a read-only basis so you can import contacts for phone-banking or campaign outreach.
Basic Google account information, including your name and email address, to identify the connected account.

How we use Google data

We use Google data only to:

Display upcoming calendar events in the Victory Waves dashboard.
Allow you to import selected Google Contacts into campaign contact or phone-bank lists.
Allow you to export or download contacts for campaign operations at your direction.
Maintain and secure the integration and provide related support.

We do not use Google user data to serve advertisements, and we do not sell it or disclose it to third parties for their own marketing purposes.

Separately, and as a standing commitment: we do not use voter information for commercial advertising or to promote commercial products or services. Access to state voter files is conditioned on that restriction, and we treat it as binding rather than as a preference.

Retention, disconnection, and deletion

We store Google OAuth tokens for as long as needed to maintain the connection. Calendar events and contacts may be fetched on demand and are not permanently stored unless you choose to import contacts into a campaign list or otherwise save information through the Services.

When you disconnect Google through Settings → Integrations, we delete the associated access tokens and stop accessing the connected Google account. Disconnecting does not automatically delete contacts or other information that you previously chose to import and save as customer content.

You may request deletion of Google-related data by:

Disconnecting the integration through Settings → Integrations; or
Emailing info@victorywaves.com with the subject line Delete Google Data.

If imported data is controlled by a Victory Waves customer, we may direct the request to that customer or assist the customer in responding. We process verified deletion requests within the period required by applicable law.

Google data security and disclosure

Google data is encrypted in transit. Google OAuth tokens are additionally encrypted at rest using AES-256-GCM before they are stored, each with its own random initialization vector; they are encrypted rather than hashed because we must be able to present the token back to Google to act on your behalf. Access is restricted to personnel and service providers that need it to provide or secure the integration. We disclose Google data only as necessary to provide or secure the Services, comply with law, or act at your direction.

You can also revoke Victory Waves' access through your Google Account Permissions page.

Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, follow customer instructions, maintain security and business records, comply with contracts and legal obligations, resolve disputes, and enforce our agreements.

The retention period depends on factors such as:

The nature, amount, and sensitivity of the information.
The purposes for which we process it and whether those purposes can be achieved by other means.
Customer instructions and the term of the applicable customer agreement.
Legal, contractual, accounting, security, and dispute-resolution requirements.
The risk of harm from unauthorized use or disclosure.

OAuth tokens are retained while the relevant integration remains connected. Customer-provided information is generally retained for the term of the customer's use of the Services and for a limited period afterward, subject to customer instructions, contractual commitments, backups, and legal requirements. Licensed voter data is retained in accordance with our data licenses, operational needs, applicable privacy requests, and legal obligations. More detailed category-specific information appears in our Notice at Collection.

When information is no longer required, we delete, de-identify, aggregate, or securely isolate it, as appropriate. Where required by law, we also take reasonable steps to prevent information covered by an ongoing deletion or opt-out request from being reintroduced through later data updates.

Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include access controls, authentication measures, encryption in transit, encryption at rest for credentials such as integration access tokens, logging and monitoring, vendor controls, and measures intended to protect the systems on which personal information is processed.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach occurs, we will notify affected individuals and regulators as required by applicable law.

Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right to:

Confirm whether we process your personal information and access the information we maintain about you.
Learn the categories and specific pieces of personal information we collect, use, disclose, sell, or share.
Learn the categories or identities of third parties to which we sold or disclosed personal information, where required.
Correct inaccurate personal information, including modeled attributes that may be incorrect.
Delete personal information.
Obtain a portable copy of certain personal information.
Opt out of the sale of personal information, its sharing for cross-context behavioral advertising, or its processing for targeted advertising.
Opt out of certain profiling that produces legal or similarly significant effects, where applicable.
Limit certain uses and disclosures of sensitive personal information.
Appeal a decision we make about a privacy request.
Exercise your rights without unlawful discrimination or retaliation.

To exercise these rights, visit Your Privacy Choices or email info@victorywaves.com. The Privacy Choices page explains the information to include, how we verify requests, how authorized agents may submit requests, and how to appeal a decision.

We may ask for information necessary to verify your identity and locate relevant records. We use verification information only for verification, security, fraud prevention, and compliance. We respond within the periods required by applicable law.

If your request concerns information that a Victory Waves customer controls, such as a campaign's contact list, canvassing responses, or petition materials, you may need to submit the request directly to that campaign or organization. We will support our customer in responding where required.

California and other state privacy rights

The rights described above include rights available under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, the Connecticut Data Privacy Act, and other applicable U.S. state privacy laws. Whether a particular right applies may depend on your state, our relationship with you, the type and source of the information, and exemptions in the applicable law.

Children's Privacy

The Services are designed for campaigns, organizations, and their authorized adult users and are not directed to children. We do not knowingly permit anyone under 16 to create a Victory Waves account.

Licensed voter-registration data may include 16- and 17-year-olds in jurisdictions that allow voter preregistration. We do not treat inclusion in a voter file as consent to sell personal information, use it for targeted advertising, or engage in any other activity for which the law requires consent. We do not knowingly sell or share the personal information of a person under 16 without the affirmative authorization required by applicable law.

If you believe a child has provided personal information directly to Victory Waves inappropriately, contact us at info@victorywaves.com.

Marketing Email

We may send account users and business contacts information about Victory Waves products and services where permitted by law. Marketing emails include a way to unsubscribe. You may also request to stop receiving marketing email by contacting info@victorywaves.com.

An opt-out from marketing email does not prevent us from sending necessary transactional, billing, security, support, or account-related communications.

Third-Party Services and Links

The Services may contain links to third-party websites or allow integrations with services that Victory Waves does not control. Those third parties have their own privacy practices, and this Policy does not apply to information they process independently. We encourage you to review their privacy notices.

Changes to This Policy

We may update this Privacy Policy as our Services, practices, vendors, or legal obligations change. We will post the updated Policy and revise the "Last updated" date. If a change materially affects how we use personal information, we will provide any additional notice or obtain any consent required by law before the change takes effect.

Contact Us

For questions or requests concerning this Privacy Policy or our privacy practices, contact:

Victory Waves Co.

Email: info@victorywaves.com