Privacy Policy

1. Introduction

Community Magazine ("we", "our", "us") is a multi-tenant digital magazine platform that enables organizations to collect and publish community stories. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform.

By using Community Magazine, you agree to the collection and use of information in accordance with this policy. Please also review our Terms of Service.

2. Data Controller

Community Magazine operates as a platform used by multiple organizations. The data controller for content and personal data collected through an organization's instance of Community Magazine is the organization itself. Community Magazine acts as a data processor on behalf of each organization.

For data relating to your platform account (e.g. login credentials, billing), Community Magazine is the data controller. If you have questions about how a specific organization handles your data, please contact that organization directly.

3. Data We Collect

3.1 Information you provide

• Account information: name and email address when you create an account or are invited to an organization.
• Submissions: text content (stories, articles), photos, audio recordings, and drawings that you submit to an organization.
• Billing information: payment details processed securely through Stripe. We do not store your full card details on our servers.

3.2 Information collected automatically

• IP addresses: collected for security, rate limiting, and fraud prevention.
• Usage data: pages visited, features used, and interactions with the platform.
• Device information: browser type, operating system, and screen size for optimizing your experience.

4. Cookies

We use a minimal number of cookies for the platform to function. We do not use advertising cookies. If you accept non-essential cookies, we use privacy-friendly analytics (PostHog) to understand how the platform is used so we can improve it. Analytics data is not shared with third parties for advertising purposes. You can change your preference at any time by clearing your browser storage.

5. How We Use Your Data

We use the data we collect to:

• Provide and maintain the Community Magazine platform.
• Authenticate your identity and manage your account.
• Process and display submissions (stories, photos, audio, drawings) within your organization's magazines.
• Send transactional emails such as magic link sign-in emails and team invitations.
• Process payments and manage subscriptions.
• Improve the platform, fix bugs, and develop new features.
• Ensure security, prevent abuse, and enforce our Terms of Service.

6. Third-Party Services

We share data with the following third-party service providers, each of which processes data in accordance with their own privacy policies:

• Resend -- Email delivery service. Receives email addresses to send magic link authentication emails and team invitations.
• Cloudinary -- Media storage and delivery. Stores and serves uploaded images, audio recordings, and drawings.
• Stripe -- Payment processing. Handles subscription payments and billing. Stripe receives payment information directly; we do not store full card details.
• Unreal Speech -- Text-to-speech service. Receives article text to generate audio versions for accessibility. No personal data is sent.
• Google AI (Gemini) -- Content analysis and AI draft generation. Submission text may be sent to Google AI for thematic grouping and content safety analysis. No personal identifiers are included in AI requests.

7. Data Retention

• Account data (name, email, credentials) is retained until you request deletion of your account.
• Submissions (stories, images, audio, drawings) are retained for as long as the organization remains active on the platform.
• Billing records are retained as required by applicable financial regulations.
• Audit logs (security and administrative actions) are retained for up to 12 months.

8. Your Rights Under GDPR

If you are located in the United Kingdom or the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate or incomplete personal data.
• Right to erasure: You can request that we delete your personal data, subject to legal obligations.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to object: You can object to our processing of your personal data where we rely on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time.

9. Exercising Your Rights

You can exercise your data rights in the following ways:

• Account deletion: Use the account deletion feature available at /account/delete to delete your account and associated data.
• Email request: Contact our support team by email. We will respond to your request within 30 days.

For data held by a specific organization using Community Magazine, please contact that organization directly, as they are the data controller for submission content.

10. Data Security

We take appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit using TLS/HTTPS.
• Passwords hashed using bcrypt; authentication via HTTP-only JWT cookies.
• Rate limiting on sensitive endpoints to prevent brute-force attacks.
• Role-based access control and multi-tenant data isolation.
• Regular security reviews and audit logging.

11. Children's Privacy

Community Magazine may be used by organizations that work with children (such as schools). In these cases, the organization is responsible for obtaining appropriate parental or guardian consent before allowing children to submit content. We do not knowingly collect personal data from children under 13 without verified parental consent.

12. International Data Transfers

Some of our third-party service providers may process data outside the United Kingdom or the European Economic Area. Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact our support team at [email protected].