Privacy Policy

What we collect

• Account data — name, work email, title, organization, role, and assigned counties.
• Agency content — projects, report sections, citations, uploaded files, survey responses, focus-group notes, and wage roster records the agency chooses to store.
• Operational records — audit logs, connector run history, email delivery events, and sign-in metadata.

How it is protected

• Every business table is scoped by organization and enforced with row-level security.
• Uploaded files live in a private bucket under tenant-scoped paths.
• Reporting geography is enforced in the database, not only in the interface.
• Credentials for data providers and AI models are held server-side and never sent to the browser.
• Records that may contain personal information can be labelled for sensitivity by the agency.

Agencies should avoid uploading direct identifiers in survey and roster files where a reference code will do. We do not claim any certification or regulatory compliance status.

Wage and roster data

Compensation records are among the most sensitive content in the platform. They are visible only to members of the owning organization who hold a role with wage-study access, and they are never included in cross-agency or statewide association views, which show aggregates only.

Email

Invitations, onboarding messages, password resets, and report notifications are sent from notify.mycommunitybuilder.org. Delivery events (queued, sent, failed, bounced, suppressed) are logged per tenant so administrators can troubleshoot. Members can turn off invitation, report-ready, and workflow notifications in Settings; security and password messages are always delivered.

Subprocessors

• Cloud application hosting and edge delivery.
• Managed PostgreSQL, authentication, and object storage.
• Transactional email delivery.
• AI model providers, used only for text the user submits for drafting assistance.

Retention and deletion

Content is retained for the life of the subscription. Deleted projects and files are soft deleted first and purged after 30 days. Audit and email-event logs are retained for two years so approvals can be reconstructed. On termination the tenant is deleted after the 30-day export window.

Your requests

Users may request access to, correction of, or deletion of their personal account data through their agency administrator or by writing to support@mycommunitybuilder.org.