Privacy Policy

What We Collect

We collect information that you and your organization provide directly, as well as data generated through your use of the platform. This includes:

• Account information such as your name, email address, and profile details provided through your authentication provider.
• Organization membership data including your role, membership status, committee assignments, and leadership positions within your organization.
• Financial records such as dues invoices, payment history, budget allocations, expense reports, and fundraising campaign contributions. We do not store credit card numbers directly (see Third Party Services below).
• Communications including messages sent through the portal, channel conversations, direct messages, and email campaign content.
• Documents and files uploaded to the platform, including meeting minutes, bylaws, resolutions, and other organizational records.
• Event data such as event details you create, registration information, and attendance records.
• Usage data including login timestamps, feature usage patterns, and device information transmitted by your browser.

How We Use It

We use the information we collect for the following purposes:

• Providing the service: managing your organization's members, finances, events, governance, documents, and communications as you and your administrators configure them.
• AI powered features: our platform includes AI capabilities that analyze organizational data to surface insights, generate meeting summaries, identify delinquent dues, flag compliance deadlines, and provide other proactive intelligence. These features operate on data within your organization only and never share your data with other organizations. Organization administrators can disable AI features entirely through the AI settings page.
• Email notifications: sending transactional emails such as invitation links, dues reminders, event confirmations, and system alerts. We do not send marketing emails to members unless their organization's administrator initiates an email campaign through the platform.
• Platform improvement: understanding how features are used so we can improve performance, fix issues, and develop new capabilities.

Data Storage and Security

We take the security of your data seriously and employ multiple layers of protection:

• All data is stored in PostgreSQL databases with encryption at rest.
• All data in transit is encrypted using TLS (HTTPS) between your browser and our servers.
• Our infrastructure is protected by Cloudflare's Web Application Firewall (WAF) to guard against common web attacks.
• Access to organizational data is enforced through role based access controls. Every database record is scoped to a specific organization, ensuring strict data isolation between organizations.
• API keys used for programmatic access support granular scope permissions, rate limiting, and expiration dates.
• Organization administrators who choose to bring their own AI API keys (BYOK) have those keys encrypted with AES 256 GCM before storage.

Third Party Services

We rely on trusted third party providers to deliver specific parts of the platform. Each provider receives only the minimum data necessary to perform its function:

• Clerk handles authentication and user identity management. Clerk processes your email address, name, and login credentials. See Clerk's Privacy Policy.
• Stripe processes all payments and is PCI DSS Level 1 compliant. We never store, process, or have access to your full credit card numbers. Payment card data goes directly to Stripe. See Stripe's Privacy Policy.
• Resend delivers transactional and campaign emails on our behalf. Resend processes recipient email addresses and email content.
• Pusher provides real time messaging infrastructure for the communication portal. Pusher transmits message data between connected clients but does not permanently store message content.
• MinIO (self hosted, S3 compatible) stores uploaded files and documents. Files remain within our infrastructure and are not shared externally.
• AI providers (Anthropic, OpenAI, Google) process organizational data when AI features are enabled. Data sent to AI providers is used solely to generate responses and is not used to train their models. Organizations can choose their preferred provider or disable AI entirely.

Data Retention

We retain your data for as long as it is needed to provide the service and comply with legal obligations:

• Financial records (invoices, payments, expenses, budgets) are retained for a minimum of 7 years to comply with accounting and tax regulations.
• Member records are retained for the lifetime of the organization on the platform, or until the organization requests deletion.
• Messages and communications are retained for the lifetime of the organization on the platform, or until the organization requests deletion.
• Documents and files are retained until deleted by an organization administrator or until the organization is removed from the platform.
• Organization administrators may configure retention preferences through the platform settings. When an organization is deleted, all associated data is permanently removed within 30 days.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: you can request a copy of all personal data we hold about you.
• Correction: you can update or correct inaccurate information through your profile settings or by contacting us.
• Export: you can export your data in a machine readable format through the platform or by contacting your organization administrator.
• Deletion: you can request that we delete your personal data, subject to legal retention requirements (such as financial record keeping).
• Objection: you can object to the processing of your data for specific purposes, including AI analysis.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information to third parties.

EU/EEA residents have rights under the General Data Protection Regulation (GDPR), including the rights listed above and the right to data portability. Our legal basis for processing your data is the performance of a contract (providing the service) and legitimate interest (improving the platform).

Data Export and Deletion

Organization administrators can export all organizational data or request a full account deletion through the organization Settings page or via the Admin API. Individual members can request export or deletion of their personal data by contacting their organization administrator or by emailing us directly. We will respond to all data requests within 30 days.

Cookies

ChapterHQ uses only essential cookies required for the platform to function. Specifically, we use session cookies set by Clerk for authentication. We do not use advertising cookies, tracking pixels, or any third party analytics trackers. No cookie consent banner is required because we only use strictly necessary cookies.

Children's Privacy

ChapterHQ is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will promptly delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal and regulatory reasons. If we make material changes, we will notify you by email or through a prominent notice on the platform before the changes take effect. We encourage you to review this page periodically. Your continued use of ChapterHQ after changes are posted constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

[email protected]