Privacy Policy

Account information. When you or your campaign creates an account, we collect your name, email address, phone number (for multi-factor authentication), and password (stored by our authentication provider in hashed form).

Campaign information. Customers provide information about their campaign, candidate, race, strategy, and platform in order to configure and use the Service.

Voter and constituent data. Customers upload, import, or connect voter file, canvassing, survey, and contact history data for the electorate they are targeting. This may include names, addresses, phone numbers, demographic attributes, and publicly available voting history obtained from government or licensed third-party sources. We process this data solely on behalf of, and at the direction of, the Customer who submitted it — we do not sell it, and we do not use it to build profiles outside the context of that Customer’s campaign.

Volunteer and team data. Campaigns may enter information about team members and volunteers (name, email, phone, role, availability, and — where a volunteer opts into canvassing or turf features — approximate location) to support scheduling, canvassing, and outreach.

Information you submit to us directly. If you request a demo or contact us through the marketing site, we collect the information you provide, such as your name, email, phone number, organization, and message.

Usage and device information. We automatically collect limited technical information, such as IP address, browser type, and pages visited, to operate, secure, and improve the Service.

We use the information described above to:

• Provide, maintain, and secure the Service, including authentication and account access;
• Generate the analytics, search results, recommendations, and reports Customers request;
• Communicate with Customers and demo requesters about the Service;
• Monitor, investigate, and prevent fraud, abuse, and security incidents; and
• Comply with legal obligations and enforce our Terms of Use.

The Service includes natural-language search and AI-assisted drafting features that use third-party large language models hosted on Amazon Bedrock (currently models developed by Anthropic). Queries and the underlying campaign and voter data needed to answer them are sent to the model provider solely to generate a response; this data is not used by Amazon or the model provider to train their general-purpose models. AI-generated content is provided as a drafting and analysis aid and may contain errors — Customers are responsible for reviewing outputs before relying on or distributing them.

We do not sell personal information. We share information only as follows:

• Within a campaign account. Data entered by or for a Customer is visible to that Customer’s authorized team members according to the roles and permissions the campaign configures.
• Service providers. We use infrastructure and processing providers, including Amazon Web Services (hosting, authentication, and database services) and Anthropic (via Amazon Bedrock, for AI features), under agreements that restrict their use of data to providing services to us.
• Legal and safety. We may disclose information if required by law, legal process, or to protect the rights, property, or safety of Maestra, our Customers, or others.
• Business transfers. If Maestra is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

We use a single, strictly necessary, HTTP-only session cookie to keep you signed in. We do not currently use advertising or cross-site tracking cookies. If this changes, we will update this Policy.

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, or misuse, including encryption in transit, access controls scoped by campaign, and multi-factor authentication for user accounts. No system is completely secure, and we cannot guarantee absolute security.

We retain account, campaign, and voter data for as long as the Customer’s account is active, or as needed to provide the Service. Customers may request deletion of their campaign’s data, and we will delete or de-identify it except where retention is required by law or for legitimate business purposes such as dispute resolution.

You may update your account information at any time within the Service. Depending on your location, you may have additional rights regarding your personal information, such as the right to request access to, correction of, or deletion of that information. Because voter and constituent data is controlled by the Customer campaign, requests related to that data should generally be directed to the campaign that collected it; we will assist campaigns in responding to such requests. To make a request to us directly, contact us at [email protected].

The Service is intended for use by campaign staff, volunteers, and vendors who are adults. It is not directed to children, and we do not knowingly collect personal information from children under 13.

We operate the Service from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice.

Questions about this Privacy Policy can be sent to [email protected].