Privacy Policy

Welcome to Civic IQ Inc. (“we,” “us,” “our”). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our website, use our platform and related services (the “Service”), or communicate with us, and how we handle business contact information about public-sector personnel that is available through the Service.

When we process personal data on behalf of a customer, such as contacts a customer uploads or syncs from its CRM, we act as that customer’s service provider and our Data Processing Addendum governs that processing. Use of the Service is also subject to our Terms & Conditions.

Information you provide. When you sign up for, request access to, or use the Service, or contact us, we collect:

• Account and Onboarding Data: name, business name, work email address, phone number, job title, website, a description of your business, and the geographic coverage you select.
• Payment Data: billing contact details and payment information, which are processed by our third-party payment processor (Stripe). Civic IQ does not store or have access to your full payment card details.
• Content You Submit: contacts, lists, notes, files, and other data you upload, import, or create in the Service, and the messages you send to our support team.
• Communications Content: if you use our email outreach or calling features, the content of emails you send through the Service and related delivery, open, and reply information, and call details such as numbers dialed, duration, and, where you enable it, call recordings and transcripts.

Information collected automatically. When you visit our website or use the Service, we collect your IP address, device, browser, and operating system information, pages viewed, features used, searches run, referring URLs, and session activity, including through cookies and similar technologies (see Section 7). Blogs we host for our customers work differently; see Section 15.

From connected accounts. If you connect an email, calendar, or CRM account (for example, Google, Microsoft, HubSpot, or Salesforce), we access the data you authorize from that account to provide the related features. See Section 5 for how we handle data from Google services.

From third parties and public sources. We collect information from public agency meeting records, budgets, capital plans, procurement records, and government websites; from licensed business data providers; and from analytics, advertising, and website visitor identification partners that may tell us which businesses or professionals visited our website.

The Service includes business contact information about elected officials, government employees, and other public-sector personnel so that our customers can identify the right people to engage. This information may include name, title, agency, department, business email address, business phone number, and professional profile URLs, as well as references to an individual in public meeting records. We collect it from public sources such as government websites, public meeting agendas and minutes, and public records, and from licensed business data providers.

We make this information available to our customers for business development, outreach, and account management. If you are a public-sector employee and want to access, correct, or delete information about you, or opt out of having it made available through the Service, contact us at [email protected] (see Section 14).

We use the information we collect to:

• Facilitate onboarding and create and manage accounts.
• Provide, operate, and personalize the Service, including signals, agency insights, project recommendations, contact data, and integrations.
• Process payments and manage subscriptions.
• Provide customer support and respond to your requests.
• Send account and service notices, product updates, newsletters, and information about Civic IQ offerings, and contact you by phone about your account and the Service (see Section 8).
• Analyze usage, measure campaigns, and improve and develop the Service.
• Protect the security and integrity of the Service, prevent fraud and misuse, and enforce our Terms & Conditions.
• Comply with legal obligations.

The Service uses artificial intelligence and machine learning to extract, classify, summarize, and generate signals and insights. Customer data, including data from connected email and CRM systems, may be processed by AI features solely to provide the Service.

We do not use customer data to train, fine-tune, or improve artificial intelligence or machine learning models, except: (a) to personalize the Service for that customer, where the resulting model, settings, or outputs are used only for that customer; or (b) where a customer or its user opts in to a specific feature that uses their data for that purpose (for example, call transcription or phone dialer features), as described at the time of opt-in. You may withdraw an opt-in at any time, after which we will not use newly collected data for that purpose.

Third-party AI providers that process customer data on our behalf may not retain it for their own model training or other secondary purposes. Data received from Google services is never used to train generalized AI or machine learning models (see Section 5).

We do not use Third Party data (including emails, calendar events, or files) to develop, improve, or train generalized artificial intelligence (AI) or machine learning (ML) models. The data is strictly used to provide the intended functionality of Civic IQ and to improve user-facing features, such as viewing agency insights and email outreach.

If you provide us with access to data from connected Google services, our use of that data will be subject to the following restrictions:

• Purpose Limitation: We will only use data from APIs to enable Civic IQ to read, process, write, and delete emails, track recipient interactions, access files, and calendar events. This data will be used for enhancing user-facing features that are prominent in the application’s interface.
• Data Transfer: We will not transfer your data to third parties unless it is necessary to provide and improve features visible in the user interface, to comply with applicable law, or as part of a merger, acquisition, or sale of assets.
• Advertising Restrictions: We will never use user data for serving advertisements, including re-targeting, personalized, or interest-based advertising.
• Compliance: Civic IQ’s use and transfer of information received from Google APIs will fully adhere to Google’s API Services User Data Policy, including the Limited Use provisions.

We do not sell your personal information for money. We share information only as described below:

• Service Providers: with vendors that process information on our behalf, such as cloud hosting, email delivery, communications, analytics, AI, payment processing, and customer support providers, under contracts that limit their use of the information. Our current sub-processors are listed in our Data Processing Addendum.
• Our Customers: business contact information about public-sector personnel is made available to Civic IQ customers through the Service (see Section 2). If you visit or contact a blog we host for a customer, we share information with that customer as described in Section 15.
• Analytics and Advertising Partners: with analytics and advertising partners through cookies and similar technologies (see Section 7), and, for users on free plans or trials, usage data as described in our Terms & Conditions.
• Integrations You Authorize: with third-party services you choose to connect, such as your CRM or email provider.
• Legal Obligations: if required by law or in response to a valid legal request, or to protect the rights, safety, and property of Civic IQ, our users, or others.
• Business Transfers: in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this Privacy Policy.
• Aggregated or De-identified Data: information that cannot reasonably identify you or your organization.

Some of these disclosures, such as making public-sector contact information available to customers or using advertising cookies, may be considered a “sale” or “sharing” of personal information, or “targeted advertising,” under certain state laws. See Section 14 for how to opt out.

We and our partners use cookies, pixels, local storage, and similar technologies on our website and in the Service:

• Essential: required to operate the Service, such as keeping you signed in and securing your account.
• Analytics and Performance: to understand how the website and Service are used and to measure campaigns, including Google Analytics and PostHog.
• Session Recording: to record and replay how visitors interact with pages so we can fix issues and improve usability, including PostHog and Microsoft Clarity.
• Advertising: to measure and personalize our advertising, including the LinkedIn Insight Tag.
• Visitor Identification: partners that may identify the businesses and professionals who visit our website so we can follow up with relevant information.

You can block or delete cookies through your browser settings, though some features may not work without them. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on and control LinkedIn advertising in your LinkedIn ad settings. Our website does not currently respond to browser “Do Not Track” signals. The blogs we host for our customers honor Global Privacy Control and Do Not Track, and use only the first-party cookies described in Section 15.

When you sign up for or request access to the Service and provide your email address and phone number, you agree that we may send you account and service notices, product updates, newsletters, and information about Civic IQ offerings by email, and call you about your account and the Service. You can opt out of marketing emails at any time using the unsubscribe link in any such email, and ask us to stop calling you at any time. We will continue to send messages required to operate your account. Text messages are covered in Section 9.

We may send you text messages for the following purposes: (a) to verify your phone number via a one-time passcode (OTP) during account registration or sign-in; (b) if you use our SMS-based query service, to deliver responses to your questions; and (c) if a customer adds your number to its signal alerts, to notify you of new government procurement signals by SMS or WhatsApp. We collect and process the following information in connection with these messages:

• Data Collected: Your phone number, the content of your text message queries (if applicable), verification codes sent to your device, and message metadata such as timestamps and delivery status.
• How It’s Used: Your phone number is used to send one-time verification codes for account security and identity confirmation, and, where a customer has set up alerts for it, to deliver those alerts. If you use our SMS query service, your message data is used solely to process your query and deliver a text message response, and to maintain message logs for customer support and service quality.
• No Third-Party Sharing: Your phone number and message content are not sold, shared with third parties, or used for marketing or advertising purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
• No Marketing Messages: We do not send promotional or marketing messages via SMS or WhatsApp. All outbound messages are verification codes, direct responses to your inbound queries, or signal alerts a customer has set up.
• Carrier Charges: Message and data rates may apply as determined by your mobile carrier. Civic IQ is not responsible for any charges imposed by your carrier.
• Opt-Out: You can stop receiving text messages at any time by replying STOP to any message. Note that opting out of SMS may prevent you from receiving verification codes required for account access. See our Terms & Conditions for full details.

We maintain administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption in transit using TLS 1.2 or higher, and at rest using AES-256 (or equivalent) via Google Cloud KMS.
• Role-based access controls, least-privilege access, multi-factor authentication for production systems, and quarterly access reviews.
• Logging and monitoring, vulnerability scanning, annual penetration testing, and a documented incident response process.
• An independent SOC 2 Type I report (Security) as of October 27, 2025.

No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

We retain information for as long as necessary to provide the Service and for the purposes described in this Privacy Policy, including complying with legal obligations, resolving disputes, and enforcing our agreements. Account data is kept while your account is active. Customer data is deleted or returned within thirty (30) days after a subscription ends, as described in our Terms & Conditions and Data Processing Addendum.

You may request deletion of your data at any time by contacting [email protected]. We will delete the data within thirty (30) days of a verified request, except where we are required by law to retain it. Data held in backup systems is isolated from further processing and deleted on our normal backup schedule. We may retain aggregated or de-identified information that cannot identify you.

Civic IQ is based in the United States, and we host and process data primarily in Google Cloud Platform regions in the United States (us-central1 and us-east1). If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, for transfers of personal data from the European Economic Area, United Kingdom, and Switzerland.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

Depending on where you live, including California, Colorado, Connecticut, Delaware, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states, and in the European Economic Area and United Kingdom, you may have the right to:

• Access: know what personal information we hold about you and receive a copy of it.
• Correction: correct inaccurate personal information.
• Deletion: delete your personal information.
• Portability: receive your personal information in a portable format.
• Opt-Out: opt out of the “sale” or “sharing” of your personal information, targeted advertising, and profiling that produces legal or similarly significant effects.
• Objection and Restriction: where applicable, object to or restrict certain processing.

To exercise these rights, email [email protected] with the subject line “Privacy Request” (or “Do Not Sell or Share” to opt out). These rights apply whether you are a Civic IQ user or a public-sector employee whose business contact information appears in the Service. We will verify your request using information associated with you, and respond within the time required by applicable law, generally within 45 days. You may use an authorized agent to submit a request on your behalf, and we may ask the agent to provide proof of authorization. If we deny your request, you may appeal by replying to our decision, and you may contact your state attorney general if you are not satisfied with the outcome of your appeal. We will not discriminate against you for exercising your privacy rights.

If Civic IQ processes your information on behalf of one of our customers, such as contacts a customer has uploaded, we will refer your request to that customer, as described in our Data Processing Addendum.

Civic IQ hosts blogs for some of its customers at sled.civiciq.com/[company]/blog (“hosted blogs”). Each hosted blog belongs to the company named on it (the “blog owner”), which decides what it publishes and how it uses the messages you send it. This section explains what we collect when you visit or use a hosted blog. The rest of this Privacy Policy also applies.

What we collect.

• Messages You Send: if you use a hosted blog’s contact form: your name, email address and message, any optional details the blog owner asks for (organization, phone number, role), the page you sent it from, and your browser and device details (user agent). To prevent spam and abuse we store a salted one-way hash of your IP address with the message, not the address itself.
• How You Found the Blog: on your first page of a hosted blog, a first-party cookie named blog_first_touch records the site that referred you (for example, a search engine or an AI assistant), the page you landed on, and any campaign (utm) tags in the link. It is sent with a contact-form message so the blog owner knows how you found it, and it expires after 30 days.
• Page Visits: when you read a hosted blog, we record the page, the site that referred you, any campaign tags, the time, and your IP address, and set a first-party cookie named blog_session that groups the pages of one visit. It expires after 30 minutes and is never tied to you as a person.
• Organization Identification: we use your IP address to find which organization owns the network it belongs to (for example, a city government’s network), so we can tell the blog owner which organizations read its blog. To do this we ask public internet registries about your network range, not your address; we look up the name registered for your address in public DNS (a reverse-DNS lookup, which sends your address to DNS servers); and we check IP address databases from MaxMind and IPinfo that we keep on our own systems, so your address is not sent to MaxMind or IPinfo. We identify organizations, not individuals: we do not use this to identify you, and we do not combine it with other information to identify you. If you send a contact-form message from an email address on a public agency’s domain, we may also record the network range the message came from, never your full address, as possibly belonging to that agency.
• Server Logs: our hosting provider logs your IP address, browser type and the page requested when you load a page, for security and to keep the service running.

Hosted blogs use no advertising cookies, no third-party trackers and no cross-site tracking. As with any web page, your browser also requests the blog’s theme font from Google Fonts when the blog uses one, and images from where the blog owner keeps them, such as its own website; those hosts receive your IP address with each request.

Your privacy signals. If your browser sends Global Privacy Control or Do Not Track, hosted blogs set neither cookie (and delete one set earlier), record no page visits, and do not use your network to identify your organization. You can still read the blog and send messages.

How we use it. We use this information to:

• deliver your message by email to the people the blog owner chose, and show it to the blog owner in Civic IQ;
• protect hosted blogs against spam and abuse;
• show the blog owner public information Civic IQ holds about the organization your email address or network belongs to, such as a government agency’s published solicitations;
• show the blog owner how visitors found its blog and which organizations read it, including alerts when an organization reads certain pages or returns.

We do not sell this information or use it for targeted advertising. We do not send contact-form messages to AI models, and we do not use contact-form messages or page visits to train AI models.

Who we share it with.

• The Blog Owner: your message and contact details, the page you sent it from, how you found the blog, and the organization your email address or network matches. Page visits are shared with the blog owner only as organization-level information, such as which organizations read which pages, never as information about you.
• Service Providers: Google Cloud (hosting and storage), Twilio SendGrid (email delivery), and Slack, only when the blog owner connects it to receive alerts about organizations reading its blog.
• Legal Obligations: authorities, when required by law.

How long we keep it.

• Contact-Form Messages: while the blog owner’s company has a Civic IQ account, and erased thirty (30) days after that account is deleted from Civic IQ (cancelling a subscription alone does not delete it), or sooner if the blog owner deletes them or you ask us to. Copies the blog owner makes on purpose, such as adding you as a contact in Civic IQ or sending your details to its CRM, belong to the blog owner and follow its own policy.
• Messages Blocked as Spam: thirty (30) days.
• Page Visit Records: thirty (30) days. Your full IP address is deleted once it has been looked up, and otherwise cut to its network range about 48 hours after your visit; for a visit matched to an organization we keep only the network range (for example, 203.0.113.0/24).
• Network Ranges Learned From Messages: up to thirteen (13) months after the range was last seen.
• Organization-Level Visit Summaries: up to thirteen (13) months.
• Server Logs: up to thirty (30) days.
• Cookies: blog_first_touch for 30 days and blog_session for 30 minutes, in your browser.

Your choices and rights. To see, correct or delete a message you sent, contact the blog owner, or email [email protected]; we will pass your request to the blog owner and help it act on your request within thirty (30) days. You can also block or delete cookies in your browser settings, and the rights in Section 14 apply.

The blog owner’s policy. Once the blog owner receives your message, its own privacy policy governs how it uses it, for example if it adds you to its CRM or contacts you. Where the blog owner provides a link to its privacy policy, the hosted blog’s contact page shows it.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date, and we will notify you through email or other communication channels if the changes are significant.

If you have any questions about this Privacy Policy or our privacy practices, please contact us at [email protected] or [email protected], or by mail at:

Civic IQ, Inc.
169 Madison Ave, STE 89557
New York, NY 10016