Privacy Policy

Scope and contact

This policy applies to Georgia Legislative Monitor. Our Meta developer application may appear under the name What Georgia Thinks. It covers the website, authenticated workspace, scheduled collection, notifications, and evidence-linked briefings. It does not replace the privacy policies of social platforms or other sites linked from collected evidence. Privacy inquiries and requests may be directed to the contact below.

Information we handle

Account and workspace information

When someone creates or uses a workspace, the service handles their display name, email address, authentication session, organization membership and role, organization settings, and information they enter into the workspace. Authentication credentials and session management are provided by Supabase; the application does not store readable passwords.

Roster and public-source information

Administrators choose the people and organizations to monitor. The service may store names, public roles, official websites, profile images, notes, public social-account identifiers, profile metadata, and canonical profile links. It may collect public post text, timestamps, source links, public media and link metadata, platform identifiers, and normalized or raw provider evidence needed to verify and deduplicate collection. The service is not designed to collect private messages or content from private accounts.

Operations, alerts, and device information

The service records collection schedules and cursors, synchronization results, operational error details, import and audit history, alert preferences, and notification delivery status. If a member enables Web Push, it also stores the browser push endpoint and subscription keys, an optional device label, browser user-agent information, and recent-use timestamps required to deliver and troubleshoot notifications.

AI-assisted briefings

Selected collected evidence is sent to OpenAI from the server to generate evidence-linked briefings. Requests use a one-way hashed safety identifier rather than a member's email address and set Responses API object storage to disabled. OpenAI may retain other API data as described in its applicable data-usage and retention terms. Passwords and social-platform access tokens are not included in briefing evidence.

Cookies and analytics

The service uses necessary Supabase authentication cookies to keep members signed in and protect private workspace routes. The current service does not use advertising pixels or third-party behavioral analytics.

How information is used

• Authenticate members and enforce organization-scoped access.
• Maintain rosters, resolve approved public accounts, and collect public evidence.
• Generate feeds, alerts, operational health information, and cited briefings.
• Prevent duplicate collection, investigate errors, secure the service, and preserve audit integrity.
• Respond to support, correction, access, and deletion requests.

When information is shared

Workspace information is visible only to authorized members of the applicable organization, subject to their role. Information is processed by service providers needed to operate the product, including Supabase for authentication, database and storage services; Vercel for hosting; OpenAI for requested briefings; the approved public APIs used to retrieve source material; and the browser push service selected by a member's device. We may also disclose information when reasonably necessary to comply with law, protect the service or another person, investigate abuse, or establish and defend legal claims.

We do not sell personal information or use monitored information for interest-based advertising.

Security

The application uses authenticated sessions, organization-scoped database policies, role checks, server-only provider credentials, bounded provider requests, and audit records. No system can guarantee absolute security. Members should use a unique password, protect their account, and promptly report suspected unauthorized access.

Retention and deletion

Information is retained for as long as reasonably needed to operate the applicable workspace, provide requested evidence and audit history, secure the service, resolve disputes, and meet legal obligations. Retention varies by the type of record and the workspace's use. Pausing or unlinking a social account stops or changes future collection but may preserve evidence that was already collected.

After a verified deletion request, information covered by the request is deleted or de-identified where applicable. Limited security, audit, backup, or legal records may remain until they are no longer reasonably necessary or age out through provider-controlled backup cycles. See the data deletion instructions for the request process.

Your choices

• Workspace members may ask to access, correct, or delete their account information.
• Members may disable Web Push in the Alerts workspace or in browser settings.
• Administrators may pause collection or unlink a public account from a roster.
• A person represented in monitored public material may request a correction or removal review after we verify their identity or authority.
• Removing material from this service does not remove the original material from a social platform; requests concerning the source must be directed to that platform or account owner.

Children

The service is intended for authorized professional and organizational use, not for use by children or the knowing collection of children's private information.

Policy changes

We may update this policy when the service or its data practices change. The date at the top identifies the current version. Material changes will be presented through the service or another appropriate notice.

Contact

For privacy questions or requests, email braden.bowen@buridansoftware.com. Do not send passwords, social-platform access tokens, or other secrets by email.