Your people are not our product.
Your list is the most valuable thing your organization owns. Here is exactly what we do, and refuse to do, with it.
Six promises, written down.
These are not marketing aspirations. They are the operating rules of the product, and the privacy policy and EULA bind us to them.
Not to advertisers, not to data brokers, not to other campaigns or causes. Our revenue is subscriptions, so we work for you, not for whoever would pay for your donors.
People, households, notes, tags, donations and history export to plain CSV whenever you want. No export tax, no “contact sales”, no waiting period.
When you delete a record or close your workspace, it is purged from the live database, not quietly archived for us to keep. Backup copies expire automatically within days.
Your workspace is stored in Canada by default. On the Movement plan you pick the region (Canada, US, EU or UK) when you create your workspace, and your data stays there for processing and backups.
Your workspace is isolated from every other organization on the platform, and every query in the product is scoped to your workspace by design. Nobody else can see your people, and you never see theirs.
Newsletters go out from your own verified domain, so the trust you build with inbox providers belongs to you. If you ever leave, your reputation leaves with you.
What ownership looks like day to day.
Getting data in does not sign it away. Importing a spreadsheet, syncing a mailbox or collecting signups through a public form gives us no rights to that data beyond running the service for you. It stays yours, under your workspace, subject to your instructions.
Volunteers see slices, never the list. A canvasser gets the turf they are walking; a driver gets the route they are driving. Nobody hands a whole voter file to a phone in the field, so a lost phone is an inconvenience, not a breach of your list.
Leaving is a button, not a negotiation. Export everything to CSV from settings, then delete your workspace. Deletion runs after a 30-day grace window that protects you from a bad day, not us; cancel it any time before it runs. We do not do retention calls, exit fees or deliberately awkward export formats.
We compete on the product, not on lock-in. Your newsletters carry your organization’s name, address and sending domain, not ours. Your engagement data is never rented to platforms or pooled across customers. A tool you can leave in an afternoon has to keep earning your business every month, and that is the point.
The technical side of these promises, from workspace isolation to encryption, lives on the security page.