Privacy Policy

1. Introduction

Molitico ("we," "our," or "us") is a political digital consulting firm that provides campaign management, fundraising optimization, digital advertising, and data analytics services for political campaigns and advocacy organizations.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (molitico.com), interact with our advertising, make donations through platforms we manage, or otherwise engage with our services. It applies to all users, including website visitors, donors, campaign supporters, and clients.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our website or services.

2. Data Controller

Molitico is the data controller responsible for your personal data collected through this website and our services. For questions about this policy or your data, contact:

3. Information We Collect

3.1 Personal Information You Provide

We may collect the following when you interact with our website, donate, or use our services:

• Full name, email address, phone number, and mailing address
• Employer name and occupation (required for FEC-regulated donations)
• Donation amounts, frequency, payment method, and transaction history
• Political preferences and party affiliations
• Form submissions, survey responses, and communication preferences

3.2 Information Collected Automatically

When you visit our website, we automatically collect:

• IP address, browser type, and version
• Device type, operating system, and screen resolution
• Pages viewed, time spent, clickstream data, and referring URLs
• Geographic location (derived from IP address)
• Cookie identifiers, including _fbp (Meta browser ID) and _fbc (Meta click ID)

3.3 Information from Third Parties

We may receive information from:

• ActBlue: Donation transaction details, donor contact information, and contribution form data via secure webhooks
• Meta (Facebook/Instagram): Ad performance data, campaign metrics, and audience insights
• SMS platforms: Message delivery status, opt-out requests, and campaign engagement metrics

4. How We Collect Information

4.1 Direct Collection

We collect information directly when you fill out forms on our website, make a donation through ActBlue, subscribe to communications, or contact us.

4.2 Automated Collection

We use cookies, the Meta Pixel, and server-side tracking technologies to automatically collect usage data as described in Sections 5 and 6 of this policy.

4.3 Third-Party Collection

We receive data from third-party platforms such as ActBlue (donation processing), Meta (advertising), and SMS service providers through secure API integrations and webhooks.

5. Meta Business Tools Disclosure

We use several Meta Business Tools to deliver, measure, and optimize advertising campaigns on Facebook and Instagram. This section describes each tool and the data it processes.

5.1 Meta Pixel

We implement the Meta Pixel (formerly Facebook Pixel), a JavaScript snippet that loads on our website when you have consented to advertising cookies. The Pixel:

• Tracks page views, button clicks, form submissions, and donation conversions
• Places and reads first-party cookies on your browser, specifically the _fbp cookie (a unique browser identifier) and the _fbc cookie (which stores your click identifier when you arrive from a Facebook or Instagram ad)
• Sends event data — including page URL, user agent, and cookie values — directly from your browser to Meta's servers
• Enables us to measure the effectiveness of our advertising and show you relevant ads

The Meta Pixel is only activated after you consent to advertising cookies through our cookie consent banner. You can withdraw consent at any time by updating your cookie preferences.

5.2 Conversions API (CAPI)

In addition to the browser-based Pixel, we use Meta's Conversions API (CAPI) to send event data directly from our servers to Meta. This server-side integration provides more reliable conversion tracking and is not affected by browser ad blockers or cookie restrictions. Data transmitted via CAPI includes:

• Event name and event ID (for deduplication with Pixel events)
• Event source URL (the page where the action occurred)
• Hashed email address and hashed phone number (using SHA-256, one-way hashing — we never send plaintext personal data)
• IP address and user agent string
• Cookie identifiers (fbp and fbc values)
• Custom data such as donation amount, currency, and content type

CAPI events are deduplicated against Pixel events using a shared event ID to prevent double-counting.

5.3 Custom Audiences

We may create Custom Audiences on Meta's platform to reach existing supporters and donors with relevant advertising. This process works as follows:

• Contact information (email addresses and/or phone numbers) is hashed using SHA-256 before being uploaded to Meta
• Meta compares these hashes against its own user database to find matches
• The original hashed data is deleted by Meta after matching is complete
• We never share plaintext email addresses or phone numbers with Meta for audience matching

5.4 Lookalike Audiences

We may use Custom Audiences as a source to create Lookalike Audiences — groups of people on Facebook and Instagram who share similar characteristics with our existing supporters. Lookalike Audiences do not contain your personal data; they are statistical models generated by Meta.

5.5 Meta Marketing API

We use Meta's Marketing API to programmatically create, manage, and deploy advertising campaigns on Facebook and Instagram. This includes creating campaigns, ad sets, ad creatives, and uploading video content. The Marketing API does not transmit your personal data; it is used for campaign management purposes only.

5.6 Your Choices Regarding Meta Tools

You can control how Meta uses your data for advertising:

• Opt out of interest-based ads: Visit Facebook Ad Preferences to control ads based on your activity
• Industry opt-out: Visit Digital Advertising Alliance to opt out of interest-based advertising from participating companies
• Cookie consent: Use our cookie consent banner to disable advertising cookies, which will prevent the Meta Pixel from loading
• Browser settings: Configure your browser to block third-party cookies or use private/incognito browsing mode

For more information about Meta's data practices, please review the Meta Privacy Policy.

6. Cookies & Tracking Technologies

6.1 Types of Cookies We Use

6.2 Cookie Consent

When you first visit our website, you are presented with a cookie consent banner that allows you to accept or decline non-essential cookies (analytics and advertising). Essential cookies are always active as they are necessary for the website to function. You can change your preferences at any time.

6.3 Managing Cookies

In addition to our cookie consent tool, you can manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that disabling cookies may affect your experience on our website.

7. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: Providing political consulting, campaign management, and fundraising services to our clients
• Donation processing: Processing, tracking, and acknowledging political contributions through ActBlue
• Campaign optimization: Analyzing ad performance, optimizing media spend, and improving return on investment for advertising campaigns
• Audience targeting: Creating and managing Custom Audiences and Lookalike Audiences for digital advertising on Meta platforms
• Communications: Sending fundraising appeals, campaign updates, advocacy messages, and SMS communications
• Analytics and reporting: Generating performance dashboards, attribution reports, and ROI analysis
• Compliance: Meeting FEC reporting requirements, maintaining legally mandated donor records, and fulfilling other regulatory obligations
• Security: Detecting and preventing fraud, unauthorized access, and other security threats

8. Legal Bases for Processing

We process personal data under the following legal bases:

• Consent: When you opt in to advertising cookies, subscribe to communications, or provide information voluntarily through forms
• Contractual necessity: When processing is required to fulfill our consulting services or manage a campaign on your behalf
• Legitimate interest: For campaign performance analysis, fraud prevention, security monitoring, and improving our services — balanced against your privacy rights
• Legal obligation: To comply with FEC reporting requirements, tax regulations, campaign finance laws, and respond to lawful legal requests

9. Information Sharing & Disclosure

We may share your information with the following categories of recipients:

• Political campaigns and committees: Candidates, campaigns, and political organizations we represent, for the purpose of voter outreach, fundraising, and supporter engagement
• Service providers: ActBlue (donation processing), email service providers, SMS platforms, cloud hosting providers, and analytics tools that process data on our behalf under contractual obligations
• Advertising platforms: Meta (Facebook/Instagram) and Google for ad targeting, measurement, and optimization — including hashed contact data for Custom Audiences as described in Section 5
• Legal and regulatory authorities: When required by law, subpoena, or court order, or to comply with FEC and state campaign finance reporting requirements
• Partner organizations: Allied political organizations and advocacy groups, with your consent where required

We do not sell your personal information to third parties for their own marketing purposes.

10. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Specific retention periods:

After retention periods expire, personal data is either securely deleted or anonymized so that it can no longer be associated with you.

11. Data Security

We implement industry-standard technical and organizational measures to protect your personal data, including:

• SSL/TLS encryption for all data in transit
• Encrypted databases with row-level security (RLS) policies to ensure data isolation
• Role-based access controls and multi-factor authentication for administrative access
• Comprehensive audit logging of all data access and modifications
• SHA-256 hashing of sensitive identifiers (email, phone) before transmission to third parties
• Regular security assessments and vulnerability monitoring

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining the highest practical standard.

12. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to deletion: Request deletion of your personal data, subject to legal retention requirements (e.g., FEC mandated records)
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to opt out of marketing: Unsubscribe from emails and SMS at any time via the unsubscribe link or by replying STOP
• Right to opt out of interest-based advertising: Disable advertising cookies via our consent banner, or visit Facebook Ad Preferences
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email us at privacy@molitico.com with "Privacy Request" in the subject line. We will respond within 30 days.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to know: What personal information we collect, use, disclose, and sell
• Right to delete: Request deletion of your personal information
• Right to opt out: Opt out of the sale or sharing of your personal information — we do not sell personal information
• Right to non-discrimination: You will not receive different treatment for exercising your privacy rights
• Right to correct: Request correction of inaccurate personal information
• Right to limit use of sensitive personal information: Where applicable

Political committee exemption: Certain activities related to political campaigns and committees may be exempt from specific CCPA provisions under California law. However, we apply these privacy protections broadly to all California residents regardless of exemptions.

To submit a CCPA request, email privacy@molitico.com with "CCPA Request" in the subject line.

14. GDPR (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) provides you with additional rights and protections.

14.1 Legal Bases

We process your data under the legal bases described in Section 8 of this policy.

14.2 Your GDPR Rights

In addition to the rights listed in Section 12, you have the right to:

• Restrict processing: Request that we limit how we use your data in certain circumstances
• Object to processing: Object to processing based on legitimate interests or for direct marketing purposes
• Lodge a complaint: File a complaint with your local data protection authority

14.3 International Data Transfers

Your data may be transferred to and processed in the United States. We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Appropriate technical and organizational security measures

14.4 Automated Decision-Making

We may use automated tools for audience segmentation and campaign optimization. These do not produce legal or similarly significant effects on individuals. You have the right to request human review of any automated decision that significantly affects you.

14.5 Contact for GDPR Requests

Email privacy@molitico.com with "GDPR Request" in the subject line. We will respond within 30 days. You may also contact your local data protection authority.

15. Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

If you believe we have inadvertently collected information from a child under 13, please contact us immediately at privacy@molitico.com and we will promptly delete the information.

16. Changes to This Policy & Contact Information

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email or a prominent notice on our website.

We encourage you to review this policy periodically.