Privacy Policy

1. Two kinds of data

This distinction runs through the whole policy, so it comes first.

• Account data — information about the person and organization subscribing to Gather Commons: administrator name and email, community name, billing details, and how the Service is used. We control this data and this policy governs it directly.
• Community Data — the member records, directories, documents, events, photographs, and payment records a community stores on the platform. The community controls this data. We process it on that community’s instructions to provide the Service. If you are a member of a community rather than its administrator, the community’s own privacy practices govern what it collects about you — contact your community’s administrators with questions or requests about your record.

2. Information we collect

Information you give us

• Account and contact details — name, email address, community name, role.
• Billing information — processed by Stripe. We receive a customer reference, the last four digits, card brand, and billing status. We never receive or store full card numbers.
• Anything you send us in a support request.

Information collected automatically

• Log data — IP address, browser and device type, pages requested, timestamps, and referring page.
• Authentication data — session and refresh tokens, and records of sign-in events including the IP address and time, kept for security.
• Passkey credentials — a public key and an identifier. Passkeys never transmit your biometrics or device PIN to us; those stay on your device.

Information communities upload

Community administrators upload member information — which may include names, addresses, email addresses, phone numbers, household composition, membership status, and payment history. Communities decide what to collect. We store and process it on their behalf.

3. How we use information

• To provide, operate, and support the Service.
• To process subscription payments and send billing notices.
• To send transactional email — sign-in links, invitations, receipts, and service notices. These are not marketing and cannot be unsubscribed from while your account is active.
• To secure the Service — detecting abuse, debugging, and investigating suspicious activity.
• To improve the Service by understanding which features are used.
• To comply with law and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Community Data to train machine-learning models.

4. Who we share information with

We share information only with service providers who help us run the Service, and only as needed:

• Stripe — subscription billing and payment processing.
• Square — where a community connects it to collect member payments.
• Brevo — transactional email delivery.
• Cloud hosting and database providers — to run the application and store data.

We may also disclose information if required by law, to protect our rights or someone’s safety, or in connection with a merger or acquisition — in which case we will give notice before your information becomes subject to a different policy.

5. Children’s information

Gather Commons is not directed to children, and we do not knowingly collect information directly from children under 13.

Communities using the platform often do store information about minors— swim team rosters, junior tennis programs, youth event sign-ups, household members. That information is Community Data, collected by the community and under its control. Communities are responsible for obtaining any parental consent required by law and for restricting who can view records about minors. If you believe a child’s information has been provided to us improperly, contact support@gathercommons.com and we will work with the relevant community to remove it.

6. Cookies and tracking

We use cookies that are necessary for the Service to function — keeping you signed in, maintaining your session, and protecting against cross-site request forgery. We do not use advertising cookies and we do not run third-party ad trackers on the platform.

7. Data retention

• Account data is retained while your subscription is active and for a reasonable period afterward for legal, tax, and accounting purposes.
• Community Data is retained while the community’s subscription is active. After cancellation, it remains available for a limited window so you can export it, then is deleted from active systems. Backups age out on their own schedule.
• Logs and security records are kept for a limited period, then discarded.

A community administrator can request earlier deletion by contacting support@gathercommons.com from the administrator address on file.

8. Security

We protect information with encryption in transit, hashed and tokenized credentials, scoped access controls between communities, and support for passkeys as a phishing-resistant sign-in method. Payment card data is handled by Stripe and does not touch our servers.

No system is perfectly secure. If a breach affects your information, we will notify affected administrators and comply with applicable breach-notification law.

9. Your rights and choices

Depending on where you live — including under the California Consumer Privacy Act as amended — you may have the right to know what personal information we hold, to request a copy, to request correction or deletion, and not to be discriminated against for exercising those rights.

• If you are a community administrator, contact support@gathercommons.com and we will verify your identity and respond.
• If you are a community member, your record belongs to your community. Contact your community’s administrators. If you contact us directly, we will refer your request to them and support them in fulfilling it.

Since we do not sell personal information or share it for targeted advertising, there is nothing to opt out of in that respect.

10. Where data is processed

The Service is operated from the United States, and information is processed and stored there. If you access it from elsewhere, you understand your information is transferred to the United States, which may have different data-protection rules than your own country.

11. Changes to this policy

We may update this policy. If a change is material, we will give notice by email to the administrator address on file or by notice in the Service before it takes effect. The effective date at the top of this page always reflects the current version.

12. Contact

Questions, requests, or complaints about privacy:

Gather Commons LLC
6825 Womack Ct, Atlanta, GA 30360
support@gathercommons.com

Gather Commons LLC is formed in Georgia.