Culper ("we", "us") operates the campaign operations platform at theculpernetwork.com. This document explains what we collect, why, and what your rights are as a user or voter.
What we collect
We collect two categories of data:
- Account data — the email address you use to sign up, your name, the campaign you're associated with, your role, and the standard authentication metadata required to maintain a session (IP address, user-agent, timestamps).
- Campaign-uploaded voter data — voter files imported by campaign users from vendors such as L2 or i360, plus any annotations created by your team (walker notes, receptiveness scores, outreach history). This data is owned by the campaign that uploads it. We process it on the campaign's behalf.
How we use it
We use your data to operate the product: authenticate you, show you your campaign's voter records, send the SMS and email messages you schedule, coordinate volunteers, and generate reports. We do not sell your data. We do not use voter data for any purpose other than the service the campaign is running.
Cross-campaign isolation
Voter data uploaded by one campaign is not readable by any other campaign. Isolation is enforced at the database level using Postgres Row-Level Security, and at the application level in every server action. Internal staff access is audit-logged.
Subprocessors
We rely on the following vendors to operate the service. Each has their own privacy posture; we recommend reviewing theirs if you handle sensitive data:
- Supabase — hosted Postgres + authentication + object storage.
- Vercel — web application hosting.
- Stripe (Connect) — payment processing for campaigns that accept donations through Culper.
- Twilio — SMS delivery for political outreach.
- SendGrid — email delivery for political outreach.
- Anthropic — natural-language voter query translation. Prompts are sent to Anthropic's API; voter rows are not sent.
Consent and outreach
For SMS outreach, campaigns must document prior express written consent before sending. We log consent at the source. For both SMS and email, we maintain a campaign-agnostic suppression list: once a contact opts out on any channel, no campaign can reach them on that channel through Culper — ever.
Your rights
If you are a user of the platform, you can request access to, correction of, or deletion of your personal data by contacting privacy@theculpernetwork.com.
If you are a voter whose contact information appears in a campaign's data, requests should be directed to the campaign operating in your jurisdiction. Culper acts as a processor on behalf of campaigns. We will assist campaigns with fulfilling verified requests.
Retention
We retain account data for the duration of your account, and for a limited period afterwards to satisfy legal retention requirements. Campaign-uploaded voter data is retained according to the terms the campaign chooses; campaigns can delete their data at any time.
International transfers
Our infrastructure is hosted in the United States. If you access Culper from outside the U.S., you acknowledge that your data will be transferred to the U.S.
Changes
We'll update the "Last updated" date above whenever this document changes materially. For substantive changes, we'll notify active customers by email.
Contact
Questions about privacy: privacy@theculpernetwork.com