Privacy Policy

The data controller is Devote Democracy Ltd, registered in England and Wales (14094396), 20-22 Wenlock Road, London N1 7GU, United Kingdom. For anything in this policy, contact [email protected]. We are registered with the UK Information Commissioner's Office (ICO).

We never:

• sell, rent or disclose data that identifies you — your identity, your individual votes and positions, your verification records — to advertisers, data brokers, political campaigns, or anyone else, except the police and other authorities in the circumstances set out in §9;
• use your votes, positions or verification data to target advertising at you;
• accept political advertising on the Service;
• show anyone your individual votes or positions except as your own visibility settings direct.

We do:

• process your political opinions, with your explicit consent, to run the Service you signed up for;
• verify identity and address through a specialist provider, and keep your verified name and date of birth so that everyone on Devote is accountable for what they do here (§4);
• produce and commercially license aggregated, de-identified statistics under the safeguards in §6;
• show advertising (non-political) and use analytics, as described in §7;
• use service providers under contract to run the platform (§9).

The rest of this policy is the detail behind those two lists.

• Account data: email, username, password (hashed), region, settings.
• Participation data: your votes and positions on legislation, poll responses, posts, comments, forums joined, representatives followed.
• Verification data: including the first name, surname and date of birth on your identity document, as described in §4.
• Payment data: your subscription tier and transaction history. Card details are handled by Apple, Google or Stripe — we never see full card numbers.
• Technical data: device type, app version, IP address, logs, crash reports, and usage analytics (which features are used, when).
• Communications: messages you send us, and reports you make about content.

Verification is optional, free, and only starts after you give explicit consent in the app. It is carried out for us by Didit (Didit Identity Spain, S.L., Calle Nápoles 227, 08013 Barcelona, Spain), a specialist identity-verification provider acting as our processor. You complete the checks in Didit's secure flow inside the Devote app, and Didit sends us the result.

Depending on what your region's eligibility rules require, verification can involve:

• Your identity document (passport, national identity card, driving licence or residence permit): Didit checks that it is genuine and reads the details on it.
• A liveness check and face match: you record a short selfie, and Didit compares your face with the photo on your document. This creates a biometric template of your face, used for this check and for the duplicate check below.
• Proof of address: a recent document such as a utility bill or bank statement, which confirms your address and so your constituency.

Your name and date of birth come from your document. When your identity is verified, we copy your first name, surname and date of birth from your identity document into your Devote profile. You cannot type or edit them yourself: the only way to set or change them is to verify again, which you can do at most once every 30 days. If something needs changing sooner — for example, a detail misread from your document — contact [email protected].

Why we keep them: accountability. Devote only works if it is safe to take part, for users and for the representatives they talk to. If someone uses Devote to make threats — for example against an elected representative — we must be able to identify that person to the police. Your verified name and date of birth are how we do that. We keep them in our legitimate interest in keeping the Service safe, and we disclose them to the police where the law requires it (§9).

One person, one account. We keep a one-way fingerprint of your document number — a keyed cryptographic code that cannot be turned back into the number — so that the same document cannot verify more than one account. Didit also compares your face with the faces from earlier Devote verifications, so the same person cannot verify a second account with a different document. If someone tries to verify with your document or your face, we email you, without telling you anything about the other account.

What Devote keeps: your verified first name, surname and date of birth; the outcome of each check and when it happened; the type of document you used, the country that issued it, and its issue and expiry dates; your nationality and country of residence; your postcode; and the document fingerprint.

What Devote does not keep: images of your documents, your document number, your selfie, or your biometric template. These stay with Didit, which holds them for us as described below.

What Didit keeps, and for how long: Didit keeps each verification session — including the images of your document and selfie, and the biometric template used for the duplicate check — on our behalf, because we need them to audit the security of verification and voting. They are kept for as long as your account exists and are deleted as described in §11. Didit does not use your data to train or improve its systems. Didit may keep limited records as a controller in its own right — for security, fraud and abuse prevention, audit, and legal compliance — as described in its verification privacy notice.

How long a verification lasts: most checks do not expire. Proof of address lasts two years, after which we will ask you to confirm your address again; a check based on a residence permit lasts until the permit expires. If you move, constituency features pause until you verify your new address — only the address step, not the whole process.

If you are in a US state with biometric privacy laws (such as Illinois), the consent we request before verification is also your written consent to the biometric processing described here.

Your votes, positions, poll responses and much of what you post on Devote reveal political opinions. Under UK data protection law this is special-category data, and we process it only on the basis of your explicit consent, which we ask for at sign-up, separately from your acceptance of the Terms. You can withdraw that consent at any time by deleting your account (§11); because processing political-opinion data is the substance of the Service, we cannot run your account without it.

Within the Service, your individual positions are visible only as your settings direct — and the defaults are private.

Part of Devote's purpose — and its business — is showing what the public actually thinks about legislation. We produce statistical datasets such as "verified constituents of X, in aggregate, split N/M on Bill Y" and license them to customers such as researchers, journalists and institutions. We hold these datasets to standards we state publicly here:

• Aggregation floor: no statistic is produced from a group of fewer than 100 people, and cross-tabulations that would shrink a cell below that floor are suppressed.
• De-identification: datasets contain no names, contact details, account identifiers or verification data, and are produced so that individuals cannot reasonably be re-identified.
• No re-identification, by contract: every licensee commits contractually not to attempt re-identification and not to combine our datasets with other data to that end; we terminate licences for breach.
• We do not re-identify de-identified data ourselves, and we maintain the technical and organisational measures this requires.

Data of this kind — which does not identify anyone — is not personal data, but we treat the boundary with care because we know how much rests on it.

Free and lower tiers of Devote are supported by advertising. Our commitments: ads on Devote are non-political — we do not accept advertising for parties, candidates, campaigns or ballot measures — and your votes, positions and verification data are never used to select ads for you. Ads are selected contextually and, where you consent, using profile data such as region and interests inferred from non-political activity. You can limit personalised advertising in settings, and where our apps use device advertising identifiers, the platform consent prompts (such as Apple's App Tracking Transparency) also apply. Higher subscription tiers reduce ad volume; the Voting Visionary tier additionally disconnects your profile data from ad personalisation entirely.

We use analytics to understand how features are used and to improve the Service; analytics are configured to minimise identifiability and are never joined to your political-opinion data for advertising purposes.

If your tier includes them: AI contextual explanations process the content you ask about; the AI Voting Collective, if and only if you opt in, analyses your own past positions and stated preferences to generate provisional positions — profiling based on your political-opinion data, performed with your explicit consent. Safeguards: provisional positions are clearly marked, nothing becomes your settled position without your ability to review and change it, you can see and correct the stated preferences the feature uses, and you can switch the feature off at any time, which stops the profiling. We do not use these features to make decisions about you with legal or similarly significant effects.

• Processors who run the platform under contract with us: hosting and infrastructure, identity verification (Didit; see §4), payment processors (Stripe; Apple and Google for their billing), analytics and crash reporting, email delivery, and customer support tooling. Processors act on our instructions and cannot use your data for their own purposes.
• Merchandise fulfilment: if you buy merch, your name and shipping address go to our fulfilment partner (Printful) to deliver it.
• Representatives and other users see what your visibility settings and the feature's stated behaviour allow — for example, a post you make on a constituency board is visible to that representative and constituency, and representatives see aggregated constituent statistics, never your individual votes unless you have made them public.
• Legal requests: we disclose personal data to authorities only where legally required by valid process. We assess every request, resist overbroad ones, and notify you unless the law prohibits it or there is urgent risk to life. Given the nature of our data, we treat requests touching political opinions with particular scrutiny. Because verification gives us your real name and date of birth (§4), a valid police request can identify you — for example, where someone has used Devote to threaten an elected representative.
• Corporate events: if Devote is acquired or merges, data transfers with the business; this policy continues to apply to it and we will give you notice.

We have no other sharing. There are no data brokers in this list because we do not deal with them.

We are a UK company; some processors run infrastructure in the EU and the US. Where personal data leaves the UK, we use recognised safeguards — UK adequacy where it exists, and the UK International Data Transfer Agreement or Addendum with standard contractual clauses where it does not. Our verification provider, Didit, is established in Spain, which UK law recognises as providing adequate protection; where Didit uses sub-processors outside the UK and EU, it relies on standard contractual clauses.

• Account and participation data: for the life of your account. When you delete your account, personal data is deleted or de-identified within 30 days, except as below.
• Verification data (§4), including your verified name and date of birth and the verification sessions Didit holds for us: while your account exists. When you delete your account we keep them for one more year, so that we can still help the police with anything that happened while it was open — longer only where the police have asked us to preserve them or a report about the account is under review — and then delete them, including the sessions at Didit.
• Document fingerprint (§4): kept indefinitely. It cannot be turned back into your document number and does not identify you on its own; keeping it is what stops one identity document verifying several accounts, including a new account opened after an old one is deleted.
• Payment and transaction records: 6 years, as UK tax and accounting law requires.
• Logs and technical data: up to 12 months.
• Legal holds: data subject to a legal obligation or active dispute is kept as long as that requires, then deleted.

Aggregated statistics (§6) contain no personal data and are retained indefinitely.

Data is encrypted in transit and at rest. Access within Devote is restricted, logged and least-privilege; verification data and political-opinion data carry our tightest internal controls. We test our defences, and if a breach ever creates risk to you, we will notify you and the ICO as the law requires — promptly and plainly.

Everyone can access their data, correct it, delete their account, and download their participation history from settings. The exception is your verified name and date of birth: they change only when you verify again (at most once every 30 days), or through [email protected] — which is also how to ask for a correction if a detail was misread from your document.

If you are in the UK you have the full set of UK GDPR rights: access, rectification, erasure, restriction, portability, objection (including to any legitimate-interests processing), and the right to withdraw consent at any time without affecting prior processing. You also have the right to complain to the Information Commissioner's Office (ico.org.uk; 0303 123 1113) — though we would welcome the chance to resolve any concern first.

If you are in the US, we honour the rights in state privacy laws — access, correction, deletion, portability, and opt-out of "sale" and "sharing" — for all US users, regardless of which state you live in or whether a statute technically covers us yet. Because we do not sell personal data or share it for cross-context behavioural advertising beyond the in-app personalisation you control in settings, the opt-outs are largely satisfied by design; the ad-personalisation toggle in settings is the control the laws contemplate. We will never discriminate against you for exercising a right.

To exercise any right: settings, or [email protected]. We verify requests against your account and respond within one month (UK) or 45 days (US).

Devote is for users aged 16+ in the UK and 18+ in the US. We do not knowingly collect data from anyone younger, and we delete it if we learn we have. Where 16- and 17-year-olds use Devote in the UK, we apply the same protections as for everyone, with the design standards for young people's data that UK law expects.

Our website uses strictly necessary cookies, and analytics and advertising cookies only with your consent, managed through the banner and revisitable in its settings. The apps use equivalent SDK technologies governed by the consents in §7.

We version this policy and keep the full publish history. Material changes create a new major version with at least 30 days' notice in the Service, and where a change involves a new use of your political-opinion data, we will ask for your consent again rather than assume it.

Devote Democracy Ltd, 20-22 Wenlock Road, London N1 7GU, United Kingdom — [email protected].