Privacy Policy

This policy explains what OurCharter — a service operated by Think Tank LLC, doing business as OurCharter — collects, why, who else touches it, how long we keep it, and what we will never do with it. It applies to the OurCharter apps and to the public websites organizations publish through the Service.

Your organization controls its data

When you are a member of an organization that uses OurCharter, that organization decides what information about you it keeps and how it is used. We process that information on the organization’s instructions to provide the Service (in privacy-law terms, the organization is the controller or business and we are its processor or service provider). If you want to see, correct, or delete information an organization holds about you, start with that organization’s administrators; if they do not respond, contact us and we will help. Information you give us directly to run your own account (your sign-in, your profile) we control ourselves.

What we collect

• Account data — name and email, via our sign-in provider (Clerk), plus any profile details you add, such as a phone number, photo, or bio.
• Organization data — the members, documents, meetings, votes, tasks, and records your organization creates in the Service.
• Communications data — the addresses your organization contacts you at, your channel preferences, and a record of when and how you consented, unsubscribed, or opted out. For text messages this includes your verified mobile number and the confirmation texts exchanged to verify it.
• Payment data — handled by Stripe under your organization’s own Stripe account. We receive confirmations and amounts, never card numbers.
• AI assistant inputs — documents and questions you choose to give the assistant, processed to produce its answers and drafts.
• Operational data — logs, IP addresses, and device information needed to run, secure, and audit the Service.

What we use it for

Solely to operate the Service for you and your organization: to run governance features, to deliver the announcements and notices your organization sends you, to keep the Service secure, to provide support, and to meet legal obligations. We do not sell personal information, we do not run advertising, and we do not use your organization’s content to train AI models.

Text messages

Text-message announcements are optional and separate from email. You opt in either by verifying your own mobile number (entering it, agreeing, and confirming a code we text you) or by replying YES to the single confirmation text we send when an officer adds your number. Consent is not a condition of membership. Message frequency varies. Message and data rates may apply. Reply STOP to any message to cancel or HELP for help. Full details are in our Text Message Terms.

Mobile information will not be shared with third parties or affiliates for marketing/promotional purposes. Mobile numbers and text-message consent records are shared only with our text-messaging provider, and only to deliver the messages you agreed to.

Votes are special

Anonymous ballots are stored so they cannot be linked back to the voter — by design, including from us. Vote receipts record that a member voted, never their choice.

Who else touches your data

Each provider processes data only as needed to provide its service to us:

• Clerk — sign-in and account security.
• Convex — application database and backend hosting.
• Railway — web hosting.
• Cloudflare — DNS, edge delivery, and certificates for organization websites.
• Twilio SendGrid — email delivery.
• Twilio — text-message delivery.
• Amazon Web Services — the AI assistant’s language model (Amazon Bedrock) and encrypted backup storage.
• Stripe — payment processing, under your organization’s own account.

We may also disclose information when the law requires it, or to protect the rights and safety of members, organizations, or the Service. We will tell an affected organization about a legal request unless we are prohibited from doing so.

How long we keep it

• Organization data is kept for as long as the organization uses the Service. When an organization is deleted, its data is retained for 30 days so the deletion can be undone, then permanently purged, including uploaded files.
• Your account and profile are kept while your account exists; you can delete your profile details at any time.
• Consent and opt-out records (including STOP requests and the do-not-contact list) are kept as long as needed to honor them and to demonstrate compliance, which can be after the related account is gone.
• Verification codes expire after 10 minutes and are deleted shortly after. In-app notifications are deleted after 90 days. Security and audit logs are retained for as long as needed to investigate incidents and disputes.
• Backups are encrypted and retained for a limited period, after which they are deleted on a rolling basis.

Security

We describe how the Service is protected on our Security page. No system is perfectly secure; if we learn of a breach affecting your information we will notify affected organizations and, where required, you.

Your choices and rights

• You can update or delete your profile at any time.
• Every email carries a one-click unsubscribe link, every text message honors STOP, and each organization’s Communication Preferences let you choose channels per organization.
• Organization administrators can export their organization’s data or delete the organization, which permanently purges its records after the 30-day recovery window.
• Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. For information an organization holds about you, that organization is the right first contact; we will help either of you fulfil the request. We will not discriminate against you for exercising these rights.
• For any privacy request, contact support@ourcharter.org.

Children

OurCharter accounts are for adults; we do not knowingly collect personal information from anyone under 16 through their own account. Some organizations (youth programs, for example) keep information about minors in their records. They do so as the controller of that information, with whatever parental consent the law requires, and we process it only on their instructions. If you believe we hold a child’s information without proper consent, contact us and we will remove it.

Changes and contact

We may update this policy; we will notify organization administrators of material changes and update the date above. Questions and requests: support@ourcharter.org or by post to Think Tank LLC, 212 N. 2nd St., Ste 100, Richmond, KY 40475.