Privacy Notice
This notice covers the sign-on form on this site. It is written to be read, not to be gotten past. If anything here is unclear, email privacy@maineredemption.org and ask.
Who this is for, and whose rights we honor
This sign-on is intended for Maine residents, because the ask is about Maine law. The rights and protections described in this notice, including the data-protection rights set out below, are honored for everyone who uses the form, regardless of where they live.
What we collect
When you sign on, the form asks for these things:
- Your full name
- Your email address
- Your Maine town
- Your Maine ZIP code (optional)
- Whether you say you are registered to vote in Maine (optional and self-reported)
The last item is an optional checkbox. It is your own statement, which we do not verify, and we record it only as a self-reported claim. We keep it to help demonstrate constituent support to legislators later on, for example to show that support comes from actual Maine voters in a given district. Leaving it unticked does not affect your sign-on, and we never turn it into a public "registered voters" figure or present the supporter count as a count of registered voters.
That is all the form collects about you. We do not ask for your street address, your phone number, or anything else. We collect only these fields, and we use them only for this effort. That is the whole point of keeping the form this short: the less we hold, the less there is to protect, lose, or misuse.
What signing means
Signing on is a public statement that you support raising Maine's bottle deposit to 25 cents and indexing it to inflation. It is a public sign-on as a supporter. It is not a poll and not a representative measure of Maine opinion. It is a list of people who chose to add their names, and we describe it as exactly that, never as a share of Mainers or a survey result.
The two separate choices you make
The form asks you to make two separate choices, with a checkbox for each. They are deliberately split so you can agree to one without the other.
- The public sign-on (required). This is the sign-on itself. By ticking it you say you support the ask, you understand it is a public sign-on rather than a poll, and you agree that your name and town may be shown as a supporter and shared with Maine legislators to show support by name and town. Your email is used only to confirm your signature. This choice does not agree to any contact from a coalition.
- Coalition contact (optional). This is a separate, optional choice. Only if you tick it do your name, town, and email get shared with a Maine coalition working to pass this, who may then contact you by email about this effort. Leaving it unticked does not affect your sign-on in any way. You can make this choice now and withdraw it later.
The form also has a third, optional checkbox where you can say you are registered to vote in Maine. That one is a self-reported piece of information, described under "What we collect" above, rather than a further choice about sharing or contact. It is optional too, and leaving it unticked does not affect your sign-on.
Your signature counts only after you confirm it
After you submit the form, we email you a confirmation link. Your signature is counted only once you click that link. This is called double opt-in. If you never confirm, your signature is not counted and your name is not displayed. The public count on this site is only the people who confirmed. Unconfirmed signatures are discarded rather than kept (see how long we keep your information, below).
The legal basis for using your information
We process your information on the basis of your consent, which is the legal basis at Article 6(1)(a) of the UK and EU General Data Protection Regulation (GDPR). You give that consent through the two checkboxes, separately and specifically:
- one consent for the public sign-on (name and town shown as a supporter and shared with legislators, email used to confirm your signature), and
- a separate consent for optional coalition contact (name, town, and email shared with a Maine coalition that may email you about this effort).
Because consent is our basis, you can withdraw it at any time, and doing so is as easy as giving it (see your rights, below).
How your information is used and shared
Your name and town may be displayed on this site as a supporter, and may be shared with Maine legislators working to pass this change, so that support can be shown by name and town. That is the point of a public sign-on: to show real people, where they live, backing the ask.
Your email address is used to send you the confirmation link. It is not displayed publicly and is not sold.
If, and only if, you ticked the optional coalition-contact checkbox, your name, town, and email may also be shared with a Maine coalition working to pass this, who may contact you by email about this effort. Signers who did not tick that box are never shared with or contacted by the coalition. The specific coalition will be named in this notice before any details are shared with it.
To be plain about one thing: this website does not run its own email newsletter. The coalition may email opted-in signers about this campaign, and this notice is your advance notice that it can. Any such email will identify who sent it and will include a working way to unsubscribe, as United States anti-spam law (CAN-SPAM) requires. Unsubscribing from those emails, or asking us to remove you (below), stops the contact.
We do not use your information for any purpose other than this effort. We do not use it to build a profile of you, and we do not repurpose it for a different campaign.
Where your information is stored
When you sign on, your information is handled by three services, each doing one job:
- Cloudflare hosts this website and runs the small piece of code that receives the form. In the normal case it passes your sign-on straight to the list software below and keeps no copy. Two narrow exceptions: to guard the form against spam it briefly notes the network address (IP) a submission comes from, only long enough to rate-limit rapid repeat submissions and then discards it, and if the list software is briefly unreachable it holds your sign-on in a temporary, encrypted buffer for up to 48 hours until it can be delivered, after which that buffered copy is deleted. Your email is encrypted while it sits in that buffer.
- Listmonk is the list-management software that actually stores your sign-on (name, email, town, and ZIP if you gave one), keeps the confirmed-supporter list, and sends the confirmation email. It is self-hosted, meaning it runs on the project operator's own infrastructure rather than on a third-party marketing company's servers. It is the system of record for your sign-on.
- Amazon SES is the email relay Listmonk uses to actually send mail (the confirmation email, the removal-link email). To send you an email it necessarily handles your email address and the message content. It is a United States service.
Sending your information to the United States
Amazon SES, the email relay, is operated from the United States. Sending the confirmation email or a removal link therefore transfers your email address to a service in the United States. If you are in the European Union, the European Economic Area, or the United Kingdom, that is a transfer of your personal data outside your region.
For that transfer to be lawful under GDPR, it relies on the Standard Contractual Clauses, the transfer safeguard approved for this purpose, which Amazon Web Services incorporates into its customer terms for SES. Cloudflare, which hosts the site and runs the transient encrypted buffer, likewise relies on the Standard Contractual Clauses for any personal data that reaches its United States infrastructure. The Listmonk software itself is self-hosted, so where it stores your sign-on depends on where that infrastructure sits, and it is run under this project's control rather than handed to a separate company.
How long we keep your information
We keep your information only while this campaign is active, or until you ask to be removed, whichever comes first. When the campaign ends, or when you ask to be removed, your details are deleted. Unconfirmed signatures, the ones where the confirmation link was never clicked, are discarded and not kept. We do not hold your information indefinitely or for a purpose it was not given for.
Your rights over your information
Under GDPR and similar laws you have the following rights, and we honor them for everyone who uses the form, wherever you live:
- Access. You can ask what information we hold about you and get a copy of it.
- Rectification. You can ask us to correct information that is wrong or incomplete, for example a misspelled name or the wrong town.
- Erasure (the right to be forgotten). You can ask us to delete your information. See how to be removed, below.
- Restriction of processing. You can ask us to pause using your information while a question about it is being sorted out.
- Data portability. You can ask for the information you gave us in a common, machine-readable format so you can take it elsewhere.
- Objection. You can object to our use of your information.
- Withdrawing consent. Because we rely on your consent, you can withdraw it at any time, either for the coalition contact alone or for the whole sign-on. Withdrawing consent is as easy as giving it, and it does not affect anything we lawfully did with your information before you withdrew.
To use any of these rights, email privacy@maineredemption.org, or use the unsubscribe link in any email you receive about this effort. We do not charge for this and we do not make you jump through hoops.
How to be removed
You can be removed at any time, and it is a real path, not a runaround. There are three ways:
- Remove yourself automatically. Go to the removal page, enter the email you signed with, and we send that address a one-time confirmation link. Click the link, then press "Confirm removal" on the page that opens, and your information is deleted, along with any copy still waiting in the temporary buffer. We ask you to confirm by email, and then with that button, so that no one can remove someone else's sign-on by typing their address and so an automated link scan cannot delete you by accident.
- Use the unsubscribe link in any email you receive about this effort, or
- Email privacy@maineredemption.org and ask to be removed. Say the name and email you signed with so we can find you.
Removal deletes your information from the list software, takes your name off the displayed supporter list and out of the count, and clears any copy in the temporary buffer. If you had opted in to coalition contact, it also asks the coalition to delete your details. If you had already confirmed, removal reverses it.
Your right to complain
If you think we have handled your information wrongly, we would rather you tell us first so we can fix it, at privacy@maineredemption.org. You also have the right to complain to a data-protection supervisory authority. If you are in the European Union or the European Economic Area, that is the authority in your country. If you are in the United Kingdom, that is the Information Commissioner's Office (ICO).
Who is responsible for this
The Maine Redemption is an independent advocacy project run by Nate Calvert, who is the data controller for this sign-on. That means the project decides what is collected and why, and it is who you contact about your rights.
Three services act as data processors, handling your information on the project's behalf and under its instructions, and not for their own purposes:
- Cloudflare, which hosts the site, receives the form, and runs the transient encrypted buffer.
- Listmonk, the self-hosted list-management software that stores the sign-on and sends the emails, run on the project operator's own infrastructure rather than by an outside company.
- Amazon SES, the United States email relay Listmonk uses to deliver the confirmation and removal-link emails.
A Maine coalition, if you opted in to coalition contact, receives your details as a further recipient and, once named, becomes responsible for its own use of them.
Changes to this notice
If this notice changes in a way that affects how your information is used, the change will be posted here. Questions about any of it go to privacy@maineredemption.org.