# InvestPolitics U.S. Public Beta — Privacy Notice v1

Effective for the InvestPolitics U.S. Public Beta. This Public Beta is limited to adults age 18 or older.

InvestPolitics is a civic participation simulation. Participants receive virtual Trust Points with no cash value and may allocate them to eligible U.S. public officials. Trust Points are not investments, donations, votes, betting positions, scientific poll responses, election forecasts, or endorsements.

## Information we process

For the current Public Beta, InvestPolitics may process:

- Your email address in Supabase Auth for account access and authentication.
- A random account identifier used in InvestPolitics application tables.
- The timestamp of your 18+ attestation. We do not ask for your date of birth for this attestation.
- The versions of the Privacy Notice, Participation Consent, and Trust Data Disclosure you accept and the timestamps of those acceptances.
- Your Trust Point balances, allocations, reclaims, reallocations, and related timestamps.
- Privacy or participation requests you submit.
- Security, session, delivery, and operational metadata needed to run and protect the service.

Later Public Beta features such as Civic Profile or participant referral links will not be activated for an account until the applicable product disclosure and consent flow is available. When those features are introduced, InvestPolitics will disclose the additional data use before or when it begins.

We do not sell participant data. We do not build or sell individual political-targeting profiles. We do not automatically label individual participants as Democrat, Republican, liberal, conservative, or another ideology based on Trust activity.

## Why we use this information

We use this information to:

- authenticate participants and maintain accounts;
- provide, preserve, and secure each participant's Trust activity;
- calculate product metrics and aggregated or de-identified civic Trust patterns;
- prevent misuse and investigate integrity or security problems;
- respond to privacy and participation requests; and
- evaluate and improve the Public Beta.

We do not use participant Trust activity to determine eligibility for employment, credit, housing, insurance, education, government benefits, or another high-impact service.

## Service providers

The Public Beta currently relies on:

- **Supabase** for authentication, PostgreSQL database, and related application infrastructure;
- **Vercel** for application hosting and delivery; and
- **Resend** for transactional authentication email delivery.

These providers may process information as needed to provide, secure, and support their services under their applicable terms and data-processing arrangements.

## Sharing and public display

Individual participant Trust allocations and referral relationships are not publicly displayed. Candidates, campaigns, political parties, PACs, public officials, and political advertisers do not receive privileged participant-level access.

InvestPolitics may publish or provide aggregated or de-identified findings about Trust patterns, product participation, or public officials when those findings are not presented as a scientific poll and are not reasonably linkable to an individual participant.

## Retention

The current Public Beta follows these operating retention rules unless a documented legal obligation, security incident, dispute, or litigation hold requires a limited exception:

- after a verified deletion request, participant-linked data should be deleted or irreversibly de-identified within 30 days where operationally supported;
- linked Trust records should not be kept indefinitely after participation ends and are subject to the current 90-day post-pilot/closure baseline where applicable;
- minimal age-attestation, consent, and privacy-request resolution evidence may be retained for up to 24 months;
- InvestPolitics-controlled security and audit evidence may be retained for up to 12 months; and
- provider-generated logs follow the applicable provider retention schedule.

The current internal retention schedule is `RETENTION-US-CP-v1.1` and may be revised as the Public Beta and legal review evolve. Material changes will be reflected in a new notice version when appropriate.

## Withdrawal and deletion

Withdrawal and deletion are different.

A withdrawal request stops future participation or Trust mutation eligibility once processed. It does not necessarily erase minimal records needed to complete the request, preserve consent evidence, investigate security issues, or comply with a documented legal obligation.

A verified deletion request starts the deletion workflow for participant-linked data and the Auth account, subject to the retention rules above.

## Your choices and contact

You may request access, correction, withdrawal, or deletion concerning your InvestPolitics account.

Use the authenticated privacy-request control when available. If you cannot access your account, contact **privacy@investpolitics.com**.

InvestPolitics may take reasonable steps to verify that a request concerns the correct account, while limiting verification information to what is necessary.

## Public Beta and legal review

The Public Beta may change as InvestPolitics learns from actual use. U.S. legal review is tracked separately from runtime activation. The current legal-review state is post-launch review pending; this notice is an operator-adopted Public Beta policy, not a representation that outside counsel has approved it or that a particular state privacy law applies.