Privacy Policy

Effective date: July 26, 2026

Blocade is a campaign relationship management and treasury platform operated by Cohorted, Inc., doing business as Blocade ("Blocade," "we," "us"). This Privacy Policy explains what information we collect through the Blocade application and websites (together, the "Service"), how we use and share it, and the choices and rights available to you.

Two roles. Blocade serves political campaigns and committees ("Campaigns"). For information that Campaigns load into or collect through their Blocade workspace — such as supporter, donor, and bank account information — the Campaign decides why and how that information is processed, and we process it on the Campaign’s behalf as a service provider. For information about visitors to our own websites and the account holders who administer the Service, we act as the business responsible for the processing. If you are a donor or supporter of a Campaign that uses Blocade, that Campaign is your primary point of contact for privacy questions and requests, and we support Campaigns in honoring those requests.

1. Information We Collect

Information you or your Campaign provide

• Account information. Name, email address, password (stored only in hashed form), role, and optional phone number for notifications (stored encrypted).
• Contact and donor records. Campaigns may enter or import supporter information such as names, contact details, employer and occupation (where required by campaign finance law), interaction notes, and event participation.
• Contribution and payment information. When you donate through a Campaign’s Blocade-hosted page, payment card details are collected and processed directly by Stripe, our payment processor. Blocade does not receive or store full card numbers. We receive confirmation details such as amount, date, and the information required for campaign finance reporting.

Bank account information connected through Plaid

Campaigns can connect a campaign bank account to Blocade to reconcile transactions and prepare compliance reports. We use Plaid Inc. ("Plaid") to establish this connection. When a Campaign links an account through Plaid Link:

• Bank login credentials are provided directly to Plaid and/or the financial institution. Blocade never receives, sees, or stores online banking usernames or passwords.
• We receive from Plaid, and store: the financial institution identifier; account name, type, and subtype; the last four digits of the account number (the "mask"); account balances; and transaction records (including date, amount, description, merchant, and category).
• We do not request or receive full account numbers, routing numbers, or Plaid’s identity products.

By using the Service and connecting an account, you grant Blocade and Plaid the right to access, transmit, store, and use this information as described in this policy and in Plaid’s End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy. We encourage you to review it.

Information collected automatically

• Usage and device data such as IP address, browser type, pages viewed, and actions taken in the Service, collected for security (for example, rate limiting and login protection), troubleshooting, and product improvement.
• Cookies: the application uses strictly necessary cookies for authentication sessions and security (CSRF protection). Our public marketing pages may additionally use analytics and advertising cookies (for example, Google Tag Manager, Google Ads, and HubSpot); these are not used inside the application workspace.

2. How We Use Information

• Provide and operate the Service, including bank transaction syncing, reconciliation, contribution processing, and campaign finance reporting for the Campaign that controls the data.
• Secure the Service: authentication (including multi-factor authentication), fraud and abuse prevention, audit logging, and incident investigation.
• Comply with law, including campaign finance record-keeping and disclosure obligations that apply to Campaigns.
• Communicate with account holders about the Service (transactional notices, security alerts, support).
• Improve the Service, using aggregated or de-identified information where practical. Some product features use third-party AI service providers to process Campaign-directed content under agreements that limit their use of that content to providing the service to us.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Consumer financial data received through Plaid is used only to provide the treasury features the Campaign has enabled — never for advertising, and never sold.

3. How We Share Information

• Service providers. We share information with vendors that host and support the Service: Render (cloud hosting; data encrypted at rest with AES-256), Plaid (bank connectivity), Stripe (payments), object storage for exports, Sentry (error monitoring, with personal information scrubbed before transmission), and email delivery providers. Each processes information only on our instructions.
• The controlling Campaign. Information in a Campaign’s workspace is available to that Campaign’s authorized users according to the roles the Campaign assigns.
• Legal disclosures. Campaign finance law requires Campaigns to report certain contribution information (such as donor name, address, employer, occupation, and amount) to election authorities, where it may become public. We also disclose information when required by law, subpoena, or to protect the rights, safety, and security of Blocade, our customers, or others.
• Business transfers. If Blocade is involved in a merger, acquisition, or asset sale, information may be transferred subject to this policy’s commitments.

4. Data Security

We maintain an information security program with administrative, technical, and physical safeguards designed to protect your information, including: encryption in transit (TLS 1.2+) and at rest (AES-256); additional field-level encryption for high-sensitivity values such as bank connection tokens; role-based access controls and database-level tenant isolation; multi-factor authentication; audit logging; and automated security testing of every code change. No method of transmission or storage is completely secure, but we work continuously to protect your information and will notify affected parties of a breach as required by law.

5. Data Retention

We retain information only as long as needed for the purposes above, and our retention schedules are enforced by an automated process. In summary: bank connection tokens are deleted when an account is disconnected or a Campaign offboards; financial records are retained for the period required by campaign finance law (by default seven years); export files are deleted after two years; inactive prospect records are anonymized after two years; and operational logs are deleted after 90 days. Details are set out in our Data Retention and Disposal Policy. When retention ends, we delete information or irreversibly anonymize it.

6. Your Rights and Choices

• Access, correction, deletion, and portability. Depending on where you live (including under the EU/UK GDPR and U.S. state privacy laws such as the California Consumer Privacy Act), you may have the right to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising these rights.
• How to exercise rights. If your information is held in a Campaign’s workspace, contact that Campaign; Blocade provides Campaigns with built-in tools to export, correct, and erase supporter records, and we support Campaigns in fulfilling verified requests. For information Blocade controls (such as website and account data), contact us at privacy@blocade.co. We will respond within the time required by applicable law.
• Limits. Campaign finance law requires certain contribution records to be retained and reported even after a deletion request; in that case we scrub all information not legally required and restrict the remainder to a sealed compliance record.
• Communications. You may opt out of non-essential emails using the unsubscribe link in any such message. Transactional and security notices are sent as needed to operate the Service.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact privacy@blocade.co and we will delete it.

8. International Users

The Service is operated from the United States and information is stored in the United States. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S., where laws may differ from those of your jurisdiction. Where GDPR applies to a Campaign’s use of the Service, we process supporter data under our data processing terms with that Campaign.

9. Changes to This Policy

We may update this policy from time to time. We will post the updated version at https://blocade.co/privacy with a new effective date, and for material changes we will provide additional notice to account holders (such as email or in-app notice) before the changes take effect.

10. Contact Us

Cohorted, Inc. d/b/a Blocade
221 N. Broad St, Suite 2A
Middletown, DE 19709

Email: privacy@blocade.co