Privacy Policy

Version 1.4.1 · Effective 20 November 2026

This Privacy Policy explains how Monosphere Ltd (trading as Comnly), a company incorporated in England and Wales ("Monosphere", "we", "us" or "our"), processes personal data in connection with the Comnly platform (the "Service").

We process personal data in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (as amended).

The Service is offered exclusively to organisations and individuals in the United Kingdom.

At a glance

This is a plain-English summary. The full Policy below is what legally applies.

• Your club controls how your membership data is used. When you are a member of an organisation, the things that flow through the Service (your membership record, posts, replies, RSVPs, polls, document downloads, notifications) are managed on behalf of your organisation. This does not remove your data protection rights or ownership of your own content. Your organisation is the controller (it decides how that data is used) and Comnly is only the processor (we hold and handle it on the organisation's instructions). We do not use it for our own purposes.
• For your direct relationship with Comnly, we are the controller. Account creation, login security, fraud prevention and our app-store presence are run by us, so for those we are the controller. The same is true for the people who register and pay for an organisation (administrators), where we are the controller for the billing and account relationship.
• We never sell your data, we do not run cross-site advertising tracking, and we do not use your data to train AI models.
• If you leave your club, your account does not stay forever. Once all of your memberships have ended, we delete or anonymise your account 30 days after the last one ended (see section 8.1(d)).
• Want your data changed or deleted? If it is club membership data, ask your organisation first (we will help them respond). For your direct account with Comnly, email support@comnly.com.

1. Who is the controller of your data

1.1 For administrators and other authorised users of paying organisations ("Organisation Admin Users"): when you register an organisation, pay for a subscription, contact our support team or otherwise interact with us about your direct account, subscription or support relationship: Monosphere is the controller. For operational records you create or use on your organisation's behalf, including committee communications and member administration, the organisation is the controller and Monosphere is its processor.

1.2 For members of organisations ("Members"): most personal data about Members that flows through the Service (membership records, posts, replies, RSVPs, polls, document downloads, push notifications etc.) is processed by Monosphere as a processor on behalf of the Member's organisation, which is the controller. The Data Processing Agreement between us and the organisation governs that processing. The organisation's own privacy notice should explain how it uses your data.

1.3 For some Member-facing matters, for example account creation, security, fraud prevention, the operation of our app-store presence, and where Monosphere directly relates to you as a service provider, Monosphere is the controller. This Privacy Policy describes that role.

1.4 For prospective customers: where you ask us for a personalised demo, open or are invited to a free demo workspace, use a marketing tool on our website (for example the club communication health check) or otherwise give us your contact details as a prospective customer, Monosphere is the controller of that data.

1.5 If you are unsure who is the controller for a particular interaction, please contact us at support@comnly.com.

2. The personal data we process

We process the categories of personal data below. Not all categories apply to every user.

Account and identity data: name, email address, password (stored hashed), date of birth, profile photo (optional), membership-card photo and verification status where used, organisation role/title for administrators and other permissioned users (optional).

Organisation context data: organisation name, address and contact phone number (admins), club role/title, membership status, joined-at and last-active timestamps.

Communications data: posts, replies, reactions, polls and votes, RSVPs, acknowledgements of critical notices, document uploads/downloads, committee-room discussions, meeting sessions and minutes, member-to-committee messages and attachments, and message read/reply status. Access depends on the audience and permissions for the feature; committee conversations and member-to-committee threads are not a public member feed. Polls labelled anonymous hide voter identities in the normal results display, but votes remain linked to user accounts in the underlying database; they are not an untraceable secret ballot.

Member recognition and referrals: birthday visibility preferences, membership anniversaries, optional spotlight introductions, referral attribution and engagement information used for club recognition features. Depending on the feature and your settings, your name, photo or recognition post may be shown to other members of your organisation. If you use your member referral code to recommend Comnly to another club, we record your name and membership against that club's signup so the referred club can receive its referral credit; for that record we are the controller and rely on legitimate interests.

Legal acceptance records: document type, version and content hash, acceptance time, IP address, user agent and context. For a parental attestation, the context also includes the child's identifier and name.

Notification data: Expo push tokens, device platform (iOS/Android), notification preferences, notification logs (delivery, failure, retries) for push and email.

Billing data (billing administrators only): organisation billing email, subscription plan, subscription status, Stripe customer and subscription identifiers, invoice records (we do not see card numbers; those go directly to Stripe).

Member payment data: where your organisation uses the Service to request or collect payments from you (joining fees, membership dues, payment links), we hold the payment request and its status (for example requested, paid, refunded), the amount, and the Stripe identifiers needed to reconcile it. Card details are collected by Stripe directly on your organisation's own Stripe account; we never see or store them. We process member payment data as a processor on behalf of your organisation.

Passes and attendance data: digital membership cards and event passes issued to you (including their QR credentials and status), RSVP and check-in records, and door-scan results. Authorised door operators can download limited admission data to their device for offline checks and store scans for later synchronisation. Unsynchronised scan records can remain on that device after sign-out so admissions are not lost. Where you add a pass to Apple Wallet or Google Wallet, the pass content (the same details shown on your in-app card or pass) is delivered through Apple's or Google's wallet services. When your membership ends, we update a saved membership card so that it is shown as no longer valid and can no longer be used.

Club visits: where your organisation uses front-desk check-in, each time you arrive we record when you checked in, how (by scanning your card at a kiosk or with staff, or by a member of staff checking you in by name), which member of staff did it, and whether the check was accepted or refused and why. Several check-ins on the same night count as one visit. Your organisation's authorised officers who have access to member records can see attendance reports built from these records, including a register of everyone who checked in on a particular night with their name, membership category, who invited them (for guests), email address and membership number, alongside that night's events, their RSVPs and the interests they chose. Organisations use these for safety (for example, knowing who was on the premises), running events and understanding attendance. Front-desk staff who only check people in can search for members by name but cannot see contact details, history or reports. Each time a printable report or export naming members is opened or downloaded, we record who did so and when.

Emergency contact and club notes: where your organisation uses member records, you or the people your organisation authorises can record an emergency contact for you: their name, their relationship to you and a phone number. It is used only to contact that person in an emergency, and only you and the people your organisation has authorised to see member notes (for example committee officers or front-desk staff) can see it; you can change or remove it in your member settings at any time. If you give us someone else's details, please make sure they are happy for you to do so. If you have been named as someone's emergency contact, the organisation is responsible for your details and you can contact it, or us at support@comnly.com, to have them changed or removed. The same people can also keep short notes about your membership, for example how you came to join or a preference you have told them, and each note records who wrote it and when. You cannot see these notes in the Service, but they are part of your organisation's records about you and you can ask your organisation for a copy (section 9.3). Organisations must not record health, medical or other sensitive information in notes, and the Service refuses notes that appear to contain it. We hold emergency contacts and notes as a processor on behalf of your organisation.

Prospective customer data: where you request a personalised demo, open a free demo workspace or use a marketing tool on our website (for example the club communication health check), the contact details you choose to give us (name, email, phone, club name) and your consent record, used to respond to you and follow up on your interest. If someone invites you to their demo workspace, we hold the name and email address they give us so we can send you the invitation and let you in.

Technical data: IP address, user agent, app version, device type, log records of interactions with the Service, anti-abuse signals, and aggregate website measurement for our public website (page path, referrer, country, device, browser and operating system) collected without cookies and without building a profile of you, as described in section 6.

Support data: any information you give us when contacting support.

Marketing preferences: whether you have opted in to Comnly product communications by email, and separately whether you have opted in to sponsor / third-party promotional communications from your Organisation by push notification or email. Each preference is captured by its own specifically-worded tickbox at signup and can be changed at any time in your member settings. Separately, where your organisation offers it, we record whether you have agreed to receive news and offers from that organisation by email, with the date, the wording you agreed to and any later withdrawal. That choice is per organisation, is never required to join, is recorded by us on the organisation's behalf as its processor, and can be withdrawn at any time in your member settings.

We do not deliberately collect special-category personal data (such as health data) or criminal-offence data. If you choose to include such data in a post, reply or document upload, you do so at your own risk. Notes that an organisation keeps about its members must not contain such data.

3. Where we get the data from

We collect data: (a) directly from you when you sign up or use the Service; (b) from your organisation (e.g. when an admin invites you); (c) automatically through your use of the Service (e.g. logs, device signals); and (d) from our service providers (e.g. Stripe sends us subscription status updates); and (e) from other people, for example a member who refers you, or a prospective customer who invites you to a demo workspace.

Your name, email address, date of birth (to confirm you are 18 or over) and acceptance of the terms are needed to create an account; without them we cannot provide an account to you. Your organisation may also require information such as a membership number in order to join it. Everything else, including marketing choices, is optional.

4. Lawful bases (UK GDPR Article 6)

We process personal data on one or more of the following lawful bases.

Performance of a contract: to provide the Service to you under the Master Subscription Agreement (admins) or the End User Terms (members), and to provide notifications, billing, support and account management.

Legitimate interests: for the security and integrity of the Service, fraud prevention, anti-abuse, service analytics, product improvement, internal record-keeping and aggregated reporting, and, for personal data we control (see section 1), for establishing, exercising or defending legal claims, including notifying our insurers. We do not use personal data we process as a processor for an organisation for our own claims or insurance. We have assessed that our interests are not overridden by your rights and freedoms; you have the right to object (see section 9).

Consent: for non-essential cookies, marketing emails, and where we collect optional information you choose to provide. You can withdraw consent at any time. Our website analytics is cookieless and aggregate, so it does not store or access information on your device and does not run on consent; it relies on legitimate interests and you may object (see section 9).

Legal obligation: to comply with our legal obligations, including tax, accounting, anti-money-laundering and responses to lawful requests by authorities.

For the avoidance of doubt: in respect of personal data we process as a processor for an organisation, the lawful basis is identified by that organisation as controller, and our processing is on its documented instructions.

5. Why we process your data (purposes)

Account management, authentication, providing the Service's communication and engagement features, sending push notifications and emails (including critical-notice deliveries on behalf of organisations), processing subscription payments via Stripe, operating payment, event-pass and membership-card features on behalf of organisations (including delivering passes to Apple Wallet or Google Wallet where you choose to add them), providing customer support, debugging, security and abuse prevention, complying with our legal obligations, responding to demo requests and marketing-tool submissions from prospective customers, and producing aggregated and anonymised analytics.

Sponsor content in the feed. Where your Organisation chooses to display sponsor content in your member feed, we render that content to you as part of providing the Service. We do not share your personal data with sponsors as part of this display. If you click a sponsor link and leave the Service, the sponsor's site or app will set its own terms and privacy notice, and we have no control over what they collect from you.

Sponsor push and email marketing. Where you have specifically opted in to receive sponsor / third-party promotional content from your Organisation by push notification or email, we use your Expo push token or email address to deliver that content on behalf of your Organisation. You can withdraw this consent at any time in member settings, and we will respect it on the next dispatch. This is separate from your operational notification preferences and from any consent you may have given to receive Comnly product updates.

We do not sell personal data, we do not engage in cross-context behavioural advertising, and we do not use personal data to train generative AI models.

6. Recipients

We share personal data with the following categories of recipient.

Hosting and infrastructure: Supabase Inc. (PostgreSQL hosting, authentication, storage) and Vercel Inc. (web application hosting and edge runtime). Our database and storage are hosted in the European Union (Ireland), and our web application's server functions also run in Ireland; Vercel delivers pages through its global edge network. Both providers are US companies; section 7 explains international transfers.

Email: Resend, used for account, billing, notification and support-enquiry emails. Resend stores customer data in the United States; section 7 explains international transfers. Our own mailboxes (support@comnly.com and hello@comnly.com) are hosted by Add Rabbit, LLC (Purelymail), a US company whose servers are hosted on Amazon Web Services, so emails you send us, including support requests that may contain personal data, are stored with it; section 7 explains international transfers.

Payments: Stripe Payments Europe, Ltd. (and its affiliates) for subscription billing, and for payments you make to your organisation through its own Stripe Connect account (joining fees, dues and payment links). Card data is collected by Stripe directly under its own privacy notice.

Push notifications: Expo (Expo Push Service), Apple Push Notification service and Google Firebase Cloud Messaging. Push payloads are sent through these third parties.

Wallet passes: where you choose to add a membership card or event pass to your device wallet, Apple Inc. (Apple Wallet and the Apple Push Notification service used for pass updates) or Google LLC (Google Wallet) receive the pass content, which contains no more personal data than the in-app card or pass already shows.

Website analytics: Vercel Inc. (Vercel Web Analytics) receives aggregate website measurement for comnly.com, enabled from 15 September 2026. It is cookieless: it sets no cookie, writes nothing to your browser storage, and does not build a profile of you or follow you across other websites. For each page view it receives the page path, referrer, and coarse signals derived from your request (country, device type, browser and operating system), together with your IP address and user agent, which Vercel uses transiently to produce a daily one-way hash for counting unique visitors and then discards rather than storing. We also record a small set of named events on our free tools pages, carrying only a tool identifier, a coarse band (such as a revenue range rather than a figure) and which call to action was used. Free-tool analytics excludes your inputs: club names, member numbers, contact details and report contents are never transmitted to Vercel analytics. Tools calculate and preview locally. When you request an emailed PDF, we verify your email address and process the PDF through our email provider, Resend, to deliver your copy. The PDF may include your edited text, contact details or crest. Your verified email address and the tool used are also emailed to our team at hello@comnly.com as a prospective customer enquiry. This request does not subscribe you to marketing emails. We rely on legitimate interests for this measurement (understanding which pages and tools are useful) and you have the right to object under section 9.

Error monitoring: the Service records the operational engagement and security information described above. Functional Software, Inc. (Sentry) receives diagnostic and error data from the website and mobile apps to help us diagnose crashes and operational issues. It is configured not to send names, email addresses or other user identifiers, although diagnostic data may occasionally contain personal data incidentally. Sentry stores this data in its EU data region (Germany).

Other members and public visitors: your display name, profile image and contributions may be visible to the members authorised to view that content. Where an organisation deliberately publishes a public event, its event details and selected imagery are visible without an account. Private guest-pass links can be used by anyone who holds the link and should be kept private.

Customer's organisation: where we process Member data on behalf of an organisation, the organisation's administrators and other authorised Organisation users can access data via the Service only according to the role permissions assigned by that organisation. Some permissioned roles may be able to create operational content, such as posts or events, without having member-directory access.

Professional advisers, insurers and authorities: lawyers, accountants, auditors, our business insurers and insurance brokers, regulators or law enforcement, where lawful and necessary, for example to take advice or to notify or defend a legal claim. For personal data we control (such as an administrator's account, billing and support contact details), we share only the personal data needed for that purpose, and insurers and advisers are bound by a duty of confidentiality. Personal data we process as a processor for an organisation (for example member records and club content) is not shared with our insurers, insurance brokers or advisers except in anonymised form that does not identify anyone, on that organisation's specific instruction, or where the law requires it, as set out in the Data Processing Agreement. Regulators and law enforcement receive personal data only where the law requires or permits it.

Successors: in the context of a corporate reorganisation or sale of business, subject to continuing protection of your data.

A current list of sub-processors is available on request from support@comnly.com, and is incorporated into the Data Processing Agreement.

7. International transfers

7.1 Where any of our service providers process personal data outside the UK, we rely on adequacy regulations made by the UK Government, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another transfer mechanism permitted under UK Data Protection Law.

7.2 We will provide details of any specific transfer mechanism on request.

8. Retention

8.1 We retain account data for as long as your account is active and for a reasonable period afterwards to handle queries, comply with legal obligations and protect our legal interests. Specifically:

(a) active account data: retained while your account or your organisation's subscription is active;

(b) member content (posts, replies, polls, etc.): retained while the organisation chooses to keep it active in the Service, subject to the organisation's instructions;

(c) on account deletion: account data is deleted or anonymised within 30 days of the deletion request, except where retention is required for legal, accounting or fraud-prevention reasons (in which case the data is locked down and retained for the minimum necessary period). Where you have contributed content that your organisation retains in the Service (for example posts or replies), that content is controlled by your organisation: on deletion of your account we remove or anonymise the account identity attached to it, and any request for erasure of the content itself should be directed to your organisation as controller;

(d) accounts whose memberships have all ended: where every membership on your account has ended because you left or your organisation removed you, we delete or anonymise your account data (in the same way as under (c)) 30 days after the most recent membership ended. We do not do this while you have a membership that has been suspended rather than ended, while you have a pending request to join an organisation, or while an organisation you belonged to is subject to a legal hold. If you rejoin an organisation within the 30 days, your account continues as normal. Content your organisation retains is handled as described in (c);

(e) on subscription termination by an organisation: Customer Content is available for export for 30 days. The organisation is then archived and its data, including member records and the records the Service holds of payments members made to the organisation, is permanently deleted by our scheduled clean-up, normally within 30 days after the export period ends, unless a legal hold applies. Copies of those member payments remain in the organisation's own Stripe account, and the organisation is responsible for keeping any records it needs for its own accounting;

(f) our billing records: our own records of subscription invoices and payments between Monosphere and an organisation are retained for 7 years after the end of the financial year to which they relate, to meet UK accounting and tax obligations;

(g) logs and security data: retained for up to 24 months for security, abuse-detection and audit purposes;

(h) anonymised, aggregated data: may be retained indefinitely (it does not identify you);

(i) prospective customer and demo data: kept only while we are discussing the Service with you, and deleted when it is no longer needed for that purpose. A demo workspace, and the names and email addresses of the people in it, can no longer be opened once the demo expires (fourteen days after it was opened) and is removed by our scheduled clean-up after that.

(j) emergency contacts and club notes: deleted when your organisation deletes your membership, when your account is deleted or anonymised under (c) or (d), and in any event 30 days after your membership of that organisation ended because you left or were removed, even if you are still a member of another organisation. We do not do this while your membership is suspended rather than ended or while the organisation is subject to a legal hold.

9. Your rights

9.1 Under UK GDPR you have the following rights, subject to the conditions and exceptions in the law:

(a) right of access: to obtain a copy of personal data we hold about you;

(b) right to rectification: to have inaccurate or incomplete data corrected;

(c) right to erasure: to have your data deleted in certain circumstances;

(d) right to restriction: to limit how we process your data in certain circumstances;

(e) right to data portability: to receive certain data in a structured, commonly used format;

(f) right to object: to processing based on legitimate interests, and to processing for direct marketing (which we will always respect);

(g) rights relating to automated decisions, including profiling, that produce legal or similarly significant effects (we do not currently make such decisions);

(h) right to withdraw consent: at any time, where processing is based on consent.

9.2 To exercise any of these rights, email support@comnly.com with the subject line "Data subject request". We may need to verify your identity. We will respond within one month or tell you if we need a longer period.

9.3 For Member data we hold as a processor for your organisation, please direct your data subject request to your organisation. We will assist your organisation in responding.

9.4 If you are unhappy with how we have handled your personal data, you can complain to us at support@comnly.com. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. For Member data we hold as a processor, we will pass your complaint to your organisation where it is for them to answer.

9.5 You also have the right to complain to the Information Commissioner's Office (the UK supervisory authority), at ico.org.uk or on 0303 123 1113, if you think your personal data has been mishandled. We would appreciate the opportunity to address your concerns first.

10. Children

10.1 Account creation is strictly limited to individuals aged 18 and over. We do not knowingly permit individuals under 18 to register accounts or use the Service directly. If we discover that an account belongs to a person under 18 we will delete it. If you believe a child under 18 has registered an account, please contact support@comnly.com.

10.2 While individuals under 18 cannot create accounts, adult members who hold parental responsibility may voluntarily submit limited personal data of children (specifically first name, last name, date of birth and junior-section assignments) as sub-records under their own membership to manage junior section activities. We process this child data strictly as a processor on behalf of your Organisation (the controller) and in accordance with the Parental Responsibility Attestation. Removing a junior deletes the live junior record and its section links; the separate parental-attestation audit record, including the child's name, is retained where necessary to evidence the attestation. Automated archiving at age 18 removes the junior from active junior features; it is not deletion. See section 8 for retention and section 9 for your rights.

11. Cookies and similar technologies

11.1 The web Service uses strictly necessary cookies and limited functional storage (including localStorage) to keep you signed in, remember in-progress signup drafts and remember your preferences. We do not use cookies for advertising or cross-site tracking, and our website analytics is cookieless, so it neither sets a cookie nor reads anything already stored on your device. See the Cookie Policy for details.

12. Security

12.1 We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, encryption at rest for our hosted database and storage, role-based access control, least-privilege permission design for operational roles, audit logging, secure software development practices, and regular review of our security posture. We require sub-processors to maintain equivalent protections.

13. Changes to this Policy

13.1 We may update this Policy from time to time. If a change is material, we will notify users at least 14 days in advance by email or in-product notice, except where the change is required immediately by law or for security reasons.

14. Contact us

14.1 Monosphere Ltd (trading as Comnly), a company registered in England and Wales under company number 16315949. Registered office: 3 Broadway East, Chester, CH2 2DW, United Kingdom.

14.2 Privacy enquiries, legal notices, and support: support@comnly.com.