CivicPool Privacy Policy

Version 1.0, 15 September 2026. Effective date: on publication by CivicPool; the current version is shown in the app and the console.

CivicPool is operated by a partnership of African Wood Inc. (United States and Kenya), African Wood Limited (England and Wales) and Dhamana Technologies Limited (Kenya), together "CivicPool", "we", "us" and "our".

This Privacy Policy explains how personal data is collected, used, and protected across the CivicPool platform. It was adopted under founder decision 38 (15 September 2026). Members and administrators accept the then-current Privacy Policy at sign-in, and acceptances are recorded (see docs/legal/README.md).

1. Roles: who is responsible for your data

Your tenant society as controller. If you are a member, relative, beneficiary, or officer of a Tenant society (for example, The $50 Club of Delaware Inc.), that Society is the data controller for your personal data: it decides why the data is collected and how it is used under its own by-laws and mission. CivicPool processes that data only on the Society's instructions, as its data processor, under a written processor agreement contemplated by by-law 16(iii) and docs/CivicPool-Platform-Plan-v2.md § 3.4.
CivicPool as controller for its own accounts and console. For platform administrator accounts, the console used to operate the platform itself, and CivicPool's own business records (billing, support communications), CivicPool is the controller.
Questions about a specific Tenant's use of your data should go first to that Tenant society; questions about the platform itself should go to CivicPool (§ 10).

2. Categories of data

The platform processes:

Member data: name, contact details (phone, e-mail), date of birth (month and year), address, member number, village assignment, standing, kinship declarations, and beneficiary designations.
Relative data, including deceased relatives: name, relationship to the member, country of residence, and (where applicable) month and year of birth and whether the person is living or deceased. Relatives may be located in Kenya or elsewhere outside the United States; the platform stores only the minimum needed (docs/CivicPool-Platform-Plan-v2.md § 3.4).
Officer data: role assignments (Treasurer, independent second officer, Executive Director, village steward, Club Administrator, and similar roles), and the household/relationship flag used to enforce the two-person disbursement rule.
Evidence documents: death certificates, funeral-home notices, newspaper notices, burial permits, government identification submitted with a claim, and notarized enrollment forms (Beneficiary Form, Reference Form).
Payment metadata: contribution history, disbursement amounts, fee splits, and the last four digits only of a payee's verified U.S. bank account. The platform does not store full bank account numbers or card numbers; those are held by Stripe.
Device tokens for push notifications, and session/device records used for sign-in and session revocation.
Audit logs: a hash-chained record of who did what and when, retained as described in § 6.

3. Purposes and legal bases

Data is processed to: enroll and verify members and their relatives and beneficiaries; validate bereavement claims and kinship; calculate and collect assessments; disburse funds and generate the Society's records (Call Sheets, statements, vouchers, and the documents listed in docs/CivicPool-Platform-Plan-v2.md § 4.5); operate sign-in and account security; send notifications (calls, deadlines, approvals) by e-mail, SMS, WhatsApp, and push; and maintain the audit trail each Tenant needs for its own governance and tax filings.

Legal bases include: performance of the membership relationship between a member and their Tenant society, the Society's legitimate interests in running its mutual aid program accurately and preventing fraud, consent (for example, consent gathered at enrollment for cross-border transfer of a Kenyan relative's data, per docs/CivicPool-Platform-Plan-v2.md § 3.4), and compliance with the Society's own legal and recordkeeping obligations.

4. Delaware Personal Data Privacy Act

The Delaware Personal Data Privacy Act (6 Del. C. ch. 12D, effective 1 January 2025) applies to this platform's processing of Delaware residents' data (docs/CivicPool-Platform-Plan-v2.md § 3.4 builds to this standard regardless of the Act's consumer-count threshold). Delaware residents whose data is processed through the platform have the right to:

Access the personal data held about them;
Correct inaccurate personal data;
Delete personal data, subject to the retention exceptions in § 6 below;
Port their data to another service in a portable format; and
Opt out of the processing of personal data for targeted advertising, sale, or certain profiling — the platform does not sell personal data or use it for advertising, so this right has no practical effect today, but is honored on request.

To exercise these rights, contact your Tenant society or CivicPool as described in § 10.

5. Other U.S. state laws

Members or relatives residing in other U.S. states may have similar rights under their state's privacy law.

6. Kenya Data Protection Act 2019

Relatives of members may be located in Kenya even where the member and any payee are U.S. persons. The Kenya Data Protection Act, 2019, and its 2021 General Regulations apply to processing of personal data relating to people located in Kenya, including by a foreign controller (docs/CivicPool-Platform-Plan-v2.md § 3.4).

What is collected about a relative in Kenya: name, relationship to the member, country, and month/year of birth or death status only — the platform deliberately minimizes beyond this.
Lawful basis: consent gathered from the member at enrollment, together with the processor/controller agreement between CivicPool and the Tenant society as a contractual safeguard for the cross-border transfer to U.S.-hosted infrastructure.
Rights: a data subject in Kenya has the right to be informed of the use of their personal data, to access it, to object to its processing, to correction and deletion, and to complain to Kenya's Office of the Data Protection Commissioner (ODPC).
Registration:.
Retention: evidence documents concerning a relative (death certificates, newspaper notices, burial permits) are encrypted and retained under a seven-year retention clock, consistent with § 7 below.

7. Sub-processors

CivicPool uses the following sub-processors to operate the platform. Each is bound by its own data processing terms with CivicPool.

Sub-processor	Purpose	Data involved
Google Cloud Platform (hosting, `us-east1`)	Application hosting, database, storage, key management, logging	All categories, encrypted at rest with tenant-specific keys
Stripe	Payment processing, bank account verification	Payment metadata, verified bank account (last four digits stored by the platform; full account details held by Stripe)
Amazon Web Services (Amazon SES, U.S. region)	Transactional e-mail (sign-in codes, notifications, statements)	Contact e-mail address, message content
Twilio	SMS sign-in codes and notifications	Phone number, message content
Meta (WhatsApp Business Cloud API)	WhatsApp call summaries to a Society's group, per its by-laws	Summary content posted to the Society's own WhatsApp group; not individual member data beyond what the Society chooses to summarize
Remote online notarization provider (Proof)	Notarization of by-law attestations, Beneficiary Forms, and Reference Forms	Identity verification data, form content, notarized document
Expo	Push notifications to the companion app	Device push token
Anthropic, via Google Cloud Vertex AI	AI-assisted drafting of evidence checklists (a human approves every result)	Redacted evidence only: masked document images and relationship descriptors. Never bank data, and never clear-text names. Anthropic's Vertex AI serving requires 30-day provider-side retention of inputs and outputs for abuse monitoring; no other retention or training use is authorized (`docs/CivicPool-Platform-Plan-v2.md` § 5.3).

8. Retention

Member records: retained for seven years after a member's standing ceases (removal, withdrawal, expulsion, or death), consistent with the Tenant society's own regulatory and recordkeeping needs; a member record is closed, not deleted, so historical Call Sheets and audits remain reconcilable (docs/CivicPool-Platform-Plan-v2.md § 5.1). A deletion request is honored by redacting contact details rather than deleting the underlying record where retention is required to meet a legal obligation, which the Delaware Personal Data Privacy Act permits.
Evidence documents: retained under the same seven-year clock, stored in retention-locked (Bucket Lock) storage so they cannot be altered or deleted early, even by an administrator (docs/legal/Data-Security.md).
Audit logs: retained seven years, append-only and hash-chained.

9. Security, cross-border transfers, and children

Security: see docs/legal/Data-Security.md for the full statement — encryption at rest and in transit, column-level encryption of personal fields, per-tenant isolation, sign-in and session controls, and audit logging.
Cross-border transfers: the platform's infrastructure is U.S.-hosted (Google Cloud, region us-east1); personal data about relatives located in Kenya is therefore transferred to and processed in the United States. This transfer relies on the consent described in § 6 and on contractual safeguards between CivicPool and each Tenant society.
Children: the platform is not directed at and does not knowingly collect accounts from children under 18; members must be between 18 and 70 at registration. A member's relatives recorded for kinship and benefit purposes may include minors (for example, a member's minor child as a beneficiary's dependent context), but minors do not hold their own platform accounts, and only the minimum relative data described in § 2 is recorded for them.

10. Cookies and local storage

The CivicPool web app uses session storage for the duration of a sign-in session and does not use advertising or tracking cookies. The companion mobile app stores session and device-security data locally on the device using standard secure storage, for sign-in and session-revocation purposes only. Neither the web app nor the companion app sells personal data or shares it with advertisers.

11. Contact and complaints

For your Tenant society's handling of your data, contact that Society's officers directly.
For the platform itself: support@proton.com (the partnership of African Wood Inc., African Wood Limited and Dhamana Technologies Limited).
Delaware residents may also contact the Delaware Attorney General's office regarding rights under the Delaware Personal Data Privacy Act.
Individuals in Kenya may contact the Office of the Data Protection Commissioner (ODPC), https://www.odpc.go.ke/.

---

*Adopted under founder decision 38 (15 September 2026); grounded in `docs/CivicPool-Platform-Plan-v2. Counsel may revise it; a revision is a new version.*