CAN-SPAM
Every record we deliver was captured after the person said yes on your site. Your sends still need a working unsubscribe, your postal address, and honest subject lines — we make the consent part provable.
Trust
Compliance, in plain language.
How ReachTheVote.com fits the rules. This is information, not legal advice.
Four exhibits, one gift shop, no lawyers. · 30s explainer
Selling to campaigns (FEC)
We're a commercial vendor. We sell to political committees at our usual and normal charge, the same rate we charge everyone. Selling at that charge is not a contribution.
Website tracking (wiretap claims)
California's wiretap statute has become the main tool against sites that run tracking before consent. Trackers count more than 800 claims filed in 2025 and several thousand cases on file by mid-2026, with statutory damages of $5,000 per violation. We identify visitors only after consent, and we log it.
Email (CAN-SPAM)
Most political email sits outside CAN-SPAM. We still support clear identification and easy opt-out as good practice.
Advertising platforms
Google does not allow political-affiliation or voter-record targeting, including through Customer Match. Meta requires advertiser verification and a “Paid for by” disclaimer. First-party lists are built to work within these rules.
Security
We encrypt records in transit and at rest, silo client data, and honor opt-outs across our network.
Not legal advice
This page is general information, not legal advice. Check your program with your own counsel.
How records are protected.
- SOC 2
- Our security controls are documented and mapped to SOC 2 criteria. A formal SOC 2 Type II audit is on our roadmap; the controls document is available on request.
- Encryption
- TLS 1.2+ in transit; AES-256 at rest for stored records and consent receipts.
- Retention
- Consent receipts retained 7 years. Captured supporter records are retained for the life of the customer account plus 90 days, then deleted. Customers can request deletion of any record at any time.
- Access
- Role-based access, per-client isolation (Client Walls), audit log of every export.
- Sub-processors
- Cloudflare (hosting, storage, edge delivery) — always.The customer's chosen delivery destinations (NGP VAN, NationBuilder, ActBlue, WinRed, Action Network, i360, Anedot, Campaign Nucleus, Mobilize, Salesforce NPSP, Zapier, Make, Meta) — only when the customer connects them.Resend (transactional email: report follow-ups and notifications) — always.
Take these to your counsel.
- Data Processing AddendumDraft for review — executed version provided at contracting.
- Security overviewOne page. The same facts as the posture above.
Where we fit.
State privacy laws (CCPA and others)
We act as your service provider. We don't sell or share captured records across customers, we honor deletion requests, and the consent receipt shows exactly what the person was told and when.
TCPA
We deliver email records only — no phone numbers — so nothing we provide triggers call or text consent rules. If you text supporters from other sources, those rules are yours to manage.
FEC
We are a paid vendor to your committee like any data or digital firm; nothing we deliver is a contribution. You disburse to us and report it as you would any vendor.
Descriptive summary, not legal advice. Your counsel should confirm how these apply to your committee.
Late bulletin
Every day you wait, visitors leave as strangers. Scan your site today.
Ten seconds. Your Supporter Reach Score, what fires before anyone says yes, and what your privacy policy leaves out. Nothing installed, nobody contacted.
- A real browser load of your homepage, screenshot included
- Every tag that fires before a visitor can answer
- Your privacy policy, lined up against what the site does
- Modeled traffic and what an ask-first step would return