Privacy Policy

1.1 Information You Provide

We collect information you voluntarily provide when you:

• Register for an account or subscribe to our Service
• Interact with our AI chatbot or submit service requests
• Fill out forms, surveys, or contact us directly
• Provide payment information for transactions

This may include your name, email address, mailing address, phone number, and payment information.

1.2 Information Collected Automatically

When you use the Service, we automatically collect certain technical and usage information, including:

• IP address, browser type, and operating system
• Device information and unique device identifiers
• Pages visited, features used, and interaction patterns
• Date, time, and duration of your sessions
• Referring URLs and search terms

We use cookies and similar technologies (such as Google Analytics) to collect this information. See Section 8 for more details.

1.3 Information from AI Interactions

When you interact with our AI-powered chatbot, we collect:

• The content of your queries and conversations
• Classification data used to route your request (e.g., general inquiry, service request)
• Response data generated by the AI system

3.1 How AI Processes Your Data

When you submit a query through our chatbot, your input is processed by our AI system to:

• Classify the type of request (e.g., general inquiry, service request, venue inquiry)
• Generate a relevant response based on municipality-provided data sources
• Route requests to the appropriate municipal department or workflow

3.2 Third-Party AI Providers

We use third-party AI service providers (currently OpenAI) to process natural language queries. When your query is sent to these providers:

• Only the data required to answer your query is transmitted to the provider’s API for processing
• Personally identifiable information such as payment card data is captured through separate, dedicated modules and is never sent to third-party AI providers
• The provider processes the data solely to generate a response
• We maintain data processing agreements with all AI providers that restrict how your data may be used

3.3 AI Training and Improvement

To improve the quality and accuracy of our Service, we may use interaction data — including resident queries and chatbot responses — to train and fine-tune AI models that power the Service. This training is conducted to improve the relevance and accuracy of responses for the subscribing municipality’s specific context and service areas.

Municipality-provided data sources (such as FAQs, service descriptions, and public information) are also used to train the AI model for each subscribing municipality.

3.4 AI Limitations

AI-generated responses are provided for informational purposes and should not be treated as official municipal decisions, legal advice, or binding commitments. Residents should verify critical information directly with their municipality.

3.5 Retention of AI Interaction Data

AI interaction data (including queries and responses) is retained for the duration of the subscribing municipality’s contract term. Upon termination of the contract, interaction data is handled in accordance with Section 5.6 (Data Retention and Deletion).

5.1 Roles and Responsibilities

• The subscribing municipality is the Data Controller — it determines the purposes and means of processing personal data collected through its instance of the Service.
• MUNI (August Digital Inc.) is the Data Processor — it processes personal data on behalf of and under the instructions of the municipality.

5.2 Processing Scope

MUNI processes personal data solely for the purposes of providing the Service as described in this Privacy Policy and the applicable SaaS Agreement. MUNI will not process personal data for any purpose other than as instructed by the municipality or as required by applicable law.

5.3 Sub-Processors

MUNI uses the following categories of sub-processors to deliver the Service:

MUNI will notify subscribing municipalities before engaging any new categories of sub-processors that handle personal data, providing reasonable opportunity to object.

5.4 Data Security

MUNI implements appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls based on the principle of least privilege
• Regular security assessments and monitoring
• Secure development practices

5.5 Data Breach Notification

In the event of a confirmed personal data breach that affects data processed on behalf of a municipality, MUNI will:

• Notify the affected municipality without undue delay, and in any event within seventy-two (72) hours of becoming aware of the breach
• Provide details of the nature of the breach, categories of data affected, and measures taken or proposed to address the breach
• Cooperate with the municipality in meeting any regulatory notification obligations

5.6 Data Retention and Deletion

Upon termination or expiration of a municipality’s SaaS Agreement:

• MUNI will, at the municipality’s election, either (a) return all Customer Data in a commonly used electronic format or (b) securely delete it, or both
• The municipality’s choice will be communicated in writing prior to or at the time of termination
• Return or deletion will be completed within thirty (30) days of the request, except where retention is required by applicable law
• MUNI will provide written confirmation of data return and/or deletion upon request

5.7 Audit Rights

Subscribing municipalities may request, no more than once per year and with reasonable advance notice, information regarding MUNI’s compliance with this DPA. MUNI will make available relevant documentation, certifications, or audit reports to demonstrate compliance.

5.8 Data Residency

All Customer Data is stored on servers located in the subscribing municipality’s residing country. Canadian client data is stored in Canada. U.S. client data is stored in the United States. Data is not transferred across borders except as required to deliver the Service (e.g., AI processing), and any such transfers are subject to appropriate safeguards.

6.1 Rights Under Canadian Privacy Law (PIPEDA / Provincial Legislation)

If you are located in Canada, you have the right to:

• Access and receive a copy of your personal data
• Request correction of inaccurate or incomplete data
• Withdraw consent to processing (subject to legal or contractual obligations)
• File a complaint with the Office of the Privacy Commissioner of Canada

For municipalities in Ontario, we comply with the Freedom of Information and Protection of Privacy Act (FIPPA). For municipalities in other provinces, we comply with applicable provincial privacy legislation.

6.2 Rights Under GDPR (European Union)

If you are located in the European Economic Area, you have additional rights including:

• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right not to be subject to automated decision-making

6.3 Rights Under U.S. State Privacy Laws

California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information, subject to certain exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising
• Non-discrimination — we will not discriminate against you for exercising your privacy rights

In the preceding 12 months, we have collected the categories of personal information described in Section 1. We do not sell personal information. We share personal information with service providers as described in Section 4 solely for business purposes.

Other U.S. States

We respect the privacy rights granted under state privacy laws including but not limited to:

• Virginia (Consumer Data Protection Act)
• Colorado (Colorado Privacy Act)
• Connecticut (Connecticut Data Privacy Act)
• Utah (Utah Consumer Privacy Act)
• Texas (Texas Data Privacy and Security Act)
• Oregon (Oregon Consumer Privacy Act)
• Montana (Montana Consumer Data Privacy Act)

Residents of these states may exercise their rights to access, correct, delete, or opt out of certain processing by contacting us as described below.

6.4 How to Exercise Your Rights

To exercise any of the above rights, contact us at: [email protected]

We may verify your identity before responding to your request. We will respond within the timeframes required by applicable law (generally 30–45 days, with extensions where permitted).