Privacy & data
Plain-English privacy practices for administrators, voters, and visitors. Last updated 2026.
This page explains our practices in general terms and is not legal advice. Your union or association remains the controller of its own members' data and is responsible for its own notices and consents. Consult counsel for your specific obligations.
EasySecretBallot.com ("we," "us") is an online secret-ballot election platform operated by Modern Cartographers. For general questions and privacy requests, contact team@easysecretballot.com; for support, help@easysecretballot.com.
| Category | What it is | Why |
|---|---|---|
| Administrator account | Name, email, organization, phone, password (hashed), two-factor secret | To create and secure your account and run your elections |
| Voter list (member PII) | First name, last name, membership number (stored only as a one-way hash), optional email | To confirm eligibility and send voting invitations, on behalf of your organization |
| Ballots | Encrypted vote selections | To conduct the election. Stored with no link to any voter. |
| Payment | Handled entirely by Stripe; we store only an order record and result | To sell election credits |
| Technical | Coarse rate-limit signals, error logs | Security and reliability. We do not run third-party advertising or analytics trackers. |
This is the heart of the service. Once a ballot is cast it is sealed with encryption and stored with no record of any kind - not encrypted, not hashed, not logged - connecting it to the voter. The voter list records only that a member voted and on what date, never how. No administrator, no union officer, and no employee of ours can determine how any individual voted. This is by design and by architecture, not merely by policy.
We send transactional email only: purchase receipts and password resets to administrators, and election invitations to voters whose address an administrator uploaded. These are not marketing messages. We do not sell email addresses, and we do not send bulk marketing. Voter invitations are sent at the direction of your organization, which is responsible for having a lawful basis to contact its members.
We do not send SMS/text messages and do not use auto-dialers, so the Telephone Consumer Protection Act (TCPA) restrictions on automated calls and texts do not apply to messages from this platform. Any phone number you provide is used only to reach you about your account, never for automated marketing.
We use only strictly necessary cookies: a signed session cookie to keep you logged in and a security (CSRF) token. We set no advertising, analytics, or cross-site tracking cookies, and we honor Global Privacy Control / "Do Not Track" signals by default because we do not track you in the first place. Because we use only essential cookies, no consent banner is legally required, but we show a brief notice for transparency.
Depending on where you live (for example California's CCPA/CPRA, plus Virginia, Colorado, Connecticut, Utah, and a growing list of states), you may have the right to access, correct, delete, or port your personal information, and to opt out of sale or targeted advertising. We do not sell or share personal information for advertising, and we do not use it for targeted advertising - so there is nothing to opt out of. To exercise access, correction, or deletion, email team@easysecretballot.com. Note that for member (voter) data, your organization is the controller; we will route your request to them or act on their instruction. We will not discriminate against you for exercising a privacy right.
Federal law (the LMRDA, for union officer elections) requires election records to be preserved for one year. We retain election data to support that obligation, in a form that still protects ballot secrecy - stored ballots never reveal who cast them. Administrators can export and back up their records. After the retention period, or on verified request where the law permits, data can be deleted. Deleting records before the required period would violate the law and is discouraged by the platform.
We rely on a small number of vendors strictly to operate the service: Stripe (payment processing; card data goes to Stripe, never to us), Resend (transactional email delivery), and Render (hosting). Each processes data only to provide its service to us.
The service is for labor organizations and associations and is not directed to children under 13; we do not knowingly collect their data.
We will update this page as practices change and revise the "last updated" year. Material changes affecting administrators will be emailed.
Questions about this policy: team@easysecretballot.com. See also our Terms of Service and LMRDA compliance pages.