Privacy policy
Last updated October 21, 2026
Campaign Kit helps organizers publish share kits and helps people share them. We collect as little as we can, we never sell personal information, and the people who share a kit don't need an account. Here is exactly what happens to your information.
Who is responsible
Campaign Kit is the controller for organizer accounts. For the share kits they publish, organizers decide what to collect from their sharers and we process that information on their behalf.
Our person in charge of the protection of personal information can be reached at privacy@getcampaignkit.com. Write to this address for any question, request or complaint.
What we collect from organizers
- Account details: name, email address and a scrambled (hashed) password. We never see your password itself.
- What you put in your kits: captions, images, logos, links and the names of partners you add.
- Billing details through Stripe. Card numbers go to Stripe directly; we only keep the plan, status and invoices history.
- Security records: sign-in times and the device type of active sessions, so you can spot unusual activity.
What we collect from people who share a kit
- No account, no cookies, no advertising trackers.
- Anonymous usage counts: which caption, platform or visual was used, the device type (phone, tablet or computer) and the language. We don't store IP addresses or browser fingerprints with these counts.
- A visitor code that changes every day, so a visit can be counted once without following anyone over time.
- Your name, only if you type it in the optional "Your name" field. It is shown to the organizer in their analytics and is deleted with the analytics history.
- Your photo, never. Personal cards are drawn on your own device and the photo is not uploaded.
Why we use it
- To run the service: sign you in, host your kits and deliver images and links.
- To show organizers how their kits perform.
- To keep the service secure and prevent abuse (rate limits, spam and malicious links).
- To bill paid plans and send account email you asked for (sign-in links, invitations, receipts).
AI writing help
When an organizer asks for AI drafts, we send only kit content (titles, descriptions, dates, existing captions and the organizer's brief) to Anthropic's Claude model on Amazon Bedrock. We never send member emails, sharer names or analytics. Drafts are never published without the organizer's review. Amazon does not use this content to train models.
Where your information is stored
Our servers, database and files are hosted by Amazon Web Services in Canada (Montréal region, ca-central-1). Some providers process information outside Québec and Canada: Stripe (payments), Amazon Bedrock (AI drafts, which may run in any AWS commercial region) and Amazon's email service. Before using them we assessed their safeguards, and our contracts require them to protect the information to a standard equivalent to ours.
How long we keep it
- Analytics: 30 days on Free, 12 months on Pro and 24 months on Business and Agency, then deleted automatically.
- Account and kit content: until you delete it or close your account. Backups roll off within 35 days.
- Billing records: as long as tax law requires (6 years in Canada).
Your rights
You can ask to see the personal information we hold about you, correct it, get a copy in a structured, commonly used technological format, or have it deleted. You can withdraw consent at any time. Write to privacy@getcampaignkit.com and we will answer within 30 days. If you're not satisfied, you can file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada.
Cookies
Signed-in organizers get one session cookie that keeps them logged in. Password-protected kits set one cookie for that kit after you unlock it. That's all: no analytics or advertising cookies, on any page.
Security and incidents
Information is encrypted in transit and at rest, access is limited to the people who need it, and passwords are hashed with scrypt. If a confidentiality incident creates a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected as required by law, and record every incident in our incident register.
Children
Campaign Kit is made for organizations. It is not directed at children under 14 and we don't knowingly collect their information.
Changes
If we change this policy in a way that matters, we will tell organizers by email or in the app before the change takes effect.