Privacy Policy

Communa is run by Moward, Inc. ("Moward", "we", "us", "our"), incorporated in the State of Delaware, United States, with its office at 8401 Mayland Dr #6463, Richmond, Virginia 23294, United States.

We take privacy seriously, and this policy sets out plainly what we do with your information.

What Communa is

Communa is software for associations. One instance runs membership, events and congresses, courses and continuing professional development, committees and chapters, directories and discussion - for professional societies, trade bodies, industry councils and chambers of commerce.

However a person arrives - joining as a member, registering for a congress, enrolling on a course, being nominated by an employer - they hold one record in that association's instance for as long as the relationship lasts. That matters here: one profile, one set of consents, and one place to exercise your rights, rather than three.

What this policy covers

This policy applies to information we handle for our own purposes: the communa.app website, demo and sales enquiries, billing, support, and the administrator accounts we hold directly.

It does not apply to information an association handles for its own purposes. When an association uses Communa to run its membership, its events or its courses, the association decides what is collected and why. We process that information on its instructions, and the association's own privacy notice governs it. Requests about a membership record are for the association to answer; where someone cannot identify the right contact we will point them to it, and anything that reaches us we pass on.

What information do we collect?

• Account details - name, work email, job title, association name, password or single sign-on identifier, profile photo.
• Billing - subscription plan, invoices, payment status, billing contact. Card payments are handled by Stripe, Inc.; we never see or store full card numbers.
• Sales and support - demo requests, event registrations, tickets, emails, and whatever you choose to send us.
• Automatically - IP address and the approximate city it indicates, browser and device type, operating system, pages viewed, session and crash diagnostics.
• Cookies and similar technologies on the website. See the Cookie Policy.

We do not ask for government identification numbers, bank account numbers or precise location, and we do not ask for health, religious, political or similar information about you.

How do we use it?

• To run the service - signing you in, delivering the features your association has enabled, sending service email and notifications, taking subscription payments.
• To support you - answering tickets and investigating faults.
• To keep it secure - detecting abuse, unauthorised access and fraud, and maintaining our audit log.
• To improve the product - understanding which features get used.
• To tell associations about Communa. You can unsubscribe from marketing at any time; that never stops service email.
• To meet legal obligations - tax and accounting records, and responding to lawful requests.

What we do not do

• We do not sell personal information.
• We do not advertise to association members, and we do not treat member records as a marketing audience.
• We do not combine data across different associations. Each instance is separate, and the same person in two instances is two records.

Who do we share it with?

With the vendors that run the service for us. Amazon Web Services hosts the platform and MongoDB runs the database. Stripe processes payments. AutoSend delivers transactional email - the notifications and confirmations the service sends - and Trigger.dev runs the background jobs behind them. Resend delivers marketing email. DevRev handles support tickets. Google provides single sign-on and crash reporting, Apple distributes the mobile app and delivers push notifications, and Microsoft provides usability analytics on the marketing website. Each is bound by obligations no less protective than the ones we owe you.

With your association, which is the point of the product; with our professional advisers, under confidentiality; where we are legally compelled; and in a merger, acquisition or sale of the business, in which case the same commitments carry over.

Where is your data held?

Communa runs on Amazon Web Services. We operate three regions - the United States, India and Asia Pacific - and an association's data is held in the region that matches where its community is. Moward, Inc. is a United States company, so our own staff may access data in any of those regions in order to run and support the service, under the safeguards in our Data Processing Agreement.

Where an association requires its data to sit in a particular region, that is agreed in its subscription documents. It is a contractual commitment rather than a setting inside the product.

How long do we keep it?

Association data stays for as long as the subscription runs. On termination the association can export it, and after the export window we delete it from live systems and let it age out of encrypted backups. Our own records follow their own clocks: account and billing records for as long as tax and accounting law requires, support correspondence for a limited period after an issue closes, and security logs for the period our retention schedule sets.

How do we protect it?

Encryption in transit and at rest, named staff accounts with multi-factor authentication, least-privilege access with a record of every staff access to a customer instance, an append-only audit log, and encrypted backups. An annual penetration test and a SOC 2 report are on our roadmap. We will not describe ourselves as certified before a report exists.

What are your rights?

Depending on where you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. You can opt out of marketing at any time. We do not sell or share personal information for advertising, so those particular opt-outs return nothing.

Requests go to dpo@communa.app. We answer within 45 days, and may extend once by a further 45 days where a request is complex, in which case we say so. Nobody is treated differently for making a request. Where we refuse one, a reply to that decision is treated as an appeal, and we answer it in writing with our reasons.

How old do you have to be?

Communa accounts are for adults. Nobody under 18 may hold one, and we do not knowingly collect personal information from anyone under 18. Where we are told that an account holder is under 18, at dpo@communa.app, we delete the account.

Will this policy change?

Yes, from time to time. We post every change on this page with a new effective date, and where a change materially affects how we handle your information we email the administrator at each customer association before it takes effect.

How to reach us

Moward, Inc., Attn: Data Protection, 8401 Mayland Dr #6463, Richmond, Virginia 23294, United States. Email dpo@communa.app.