Govinity Privacy Policy

This policy applies to govinity.com, our public meeting portals, and the Govinity platform, including Agenda, Minutes, Live, Record (streaming and captioning), and Tenure (boards and commissions) (together, the "Services").

We interact with three groups of people:

• Customers and their users: cities, counties, school districts, special districts, and other public agencies that license the Services, plus their staff, elected and appointed officials, and authorized contractors.
• Members of the public: people who view agendas, watch meetings, submit public comment, or apply for board and commission seats through a customer's portal.
• Website visitors and prospects: people who visit our website, attend our events, request a demo, or otherwise contact us.

When a public agency uses the Services, that agency decides what information goes into the platform, who can see it, what is published, and how long it is kept. For that information ("Customer Data"), Govinity acts as a service provider, processor, or contractor on the agency's behalf. We process Customer Data only to provide the Services and as directed by our agreement with the agency.

If you have questions about information a public agency holds about you, including requests under a public records or open meetings law, please contact that agency directly. If we receive such a request, we will refer it to the agency.

Govinity is the controller of information we collect for our own business purposes, such as website analytics, sales inquiries, and account administration.

Information you give us directly

• Account information: name, work email, title, department, agency, phone number, and login credentials for users of the Services.
• Customer Data: agenda items, staff reports, attachments, minutes, votes, motions, meeting recordings, transcripts, board and commission rosters, applications, and other content that customers and their users create or upload.
• Public participation: information members of the public submit through a customer's portal, such as public comment, speaker cards, or board and commission applications. Depending on the agency's settings and applicable law, this information may become part of the public record.
• Business contact information: name, organization, role, and message content when you request a demo, contact sales or support, register for a webinar, or respond to a survey.
• Support communications: the content of support tickets, emails, chats, and call notes.

Information collected automatically

• Usage and device data: IP address, browser and device type, operating system, pages and features used, referring URLs, and timestamps.
• Log and security data: authentication events, audit trails of actions taken in the platform, and error logs. Audit trails help agencies meet records retention and accountability obligations.
• Cookies and similar technologies: see Section 9.

Information from third parties

• Single sign-on and directory services: if your agency connects an identity provider, we receive the profile and group attributes your agency configures.
• Integrated systems: if your agency connects a records management, document storage, or other system, we receive the data your agency authorizes.
• Business sources: publicly available professional information and information from event organizers or partners, used for our own sales and marketing.

We use information to:

• Provide, operate, host, and maintain the Services, including publishing content that customers choose to make public.
• Authenticate users, manage accounts and permissions, and keep audit trails.
• Stream, record, caption, and transcribe meetings when a customer enables those features.
• Provide customer support, training, and implementation services.
• Monitor, secure, and troubleshoot the Services, and detect and prevent fraud, abuse, and security incidents.
• Improve the Services, using aggregated or de-identified usage data wherever practical.
• Send service announcements, security notices, and administrative messages.
• Market our Services to public agency professionals, which you can opt out of at any time.
• Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use Customer Data for targeted advertising.

Some features use artificial intelligence, such as captioning, transcription, draft minutes, summaries, and drafting help for staff reports. When a customer enables these features:

• We process Customer Data only to deliver the requested output to that customer.
• We do not use Customer Data to train generalized AI models, and we contractually require our AI service providers not to either.
• AI output is a draft. The agency remains responsible for reviewing and approving anything that becomes part of the official record.

Much of what flows through the Services is intended to be public: agendas, packets, minutes, votes, and meeting video. When a customer publishes content, it is available to anyone, and it may be indexed by search engines, copied, or archived by third parties. Govinity does not control what an agency chooses to publish. Members of the public who submit comments or applications should assume that information may be disclosed under applicable open meetings and public records laws.

We share information only as described here:

• With the customer agency: Customer Data and related usage data belong to, and are available to, the agency that controls the account.
• Publicly, at the agency's direction: content an agency publishes through its portal.
• With service providers (subprocessors): vendors that host, stream, caption, authenticate, support, or otherwise help us operate the Services. They may use information only to perform services for us and must protect it under written agreements.
• With integrations the agency enables: third-party systems an agency connects, under that agency's instructions.
• For legal reasons: when we believe disclosure is required by law, subpoena, or court order, or is needed to protect the rights, safety, or property of Govinity, our customers, or others. Where permitted, we will notify the affected agency before disclosing its Customer Data.
• In a business transaction: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy and our customer agreements.
• With your consent: for any other purpose you approve.

We will update this list as providers change and will give customers advance notice as required by their agreements.

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, single sign-on support, audit logging, and restricted employee access. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a security incident affecting Customer Data, we will notify the affected agency as required by law and our agreements.

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Services, and understand how our website is used. Essential cookies are required for the Services to work. You can control non-essential cookies through your browser settings. Public meeting portals use only the cookies needed to operate and measure them.

We keep Customer Data for as long as the customer's agreement is in effect, or as the agency directs. Agencies set their own retention schedules to meet public records laws. When an agreement ends, we return or delete Customer Data under the terms of that agreement, except where law requires us to keep it. We keep business contact and account information as long as needed for the purposes in this policy.

• Users of an agency's account: contact your agency administrator to access, correct, or delete your information.
• Members of the public: contact the public agency that runs the portal. Some information, once part of the public record, may not be eligible for deletion under applicable law.
• Marketing: you can unsubscribe from our marketing emails at any time using the link in each message.
• State privacy rights: depending on where you live, including California, you may have rights to know, access, correct, or delete personal information we hold as a controller, and to not be discriminated against for exercising those rights. To make a request, contact us using the details below. We will verify your request before responding.

The Services are designed for public agencies and adults, not for children under 13. School district customers may store records that include student information, for example in board agendas or minutes. In those cases we act as a "school official" under FERPA and applicable state student privacy laws, using that information only to provide the Services to the district.

Govinity is based in the United States, and we store and process data in the United States.

We may update this policy from time to time. We will post the updated version here with a new effective date, and we will notify customers of material changes in advance.

Govinity, Inc. 834 Jones Street, Unit 2B San Francisco, CA 94109 [[email protected]]