Privacy policy

App Community Suite is a private application provided to associations. Each association has its own application, its own database and its own server: no data is shared between associations.

This document describes what the software actually does with the data it handles. It was written from how the software works, not from a template.

1. Who is responsible

The association that invited you is the data controller: it decides what data is collected and who can see it. Its name and contact address appear on its own website, on the Privacy page.

App Community Suite acts as a processor: we host and maintain the software on the association's behalf and on its instructions, without using its data for our own purposes.

Wisepear (wisepear.eu), which designs, develops and operates the software for App Community Suite, acts as a sub-processor, and accesses the data only to keep the service running.

We do not sell data, we do not pass it to brokers, and we display no targeted advertising.

2. What data is processed

• Your account: email address, display name, avatar picture or colour, role in the association, permissions granted, sign-up date.
• What you post: room messages and private messages (text, photos, GIFs, voice messages), gallery photos, reactions, comments.
• Your participation: event sign-ups, attendance, payments recorded by the association, shop orders, poll answers.
• Your usage: experience points, objectives and distinctions, last read position in each room.
• Your devices: notification identifier, platform, and the date of the last message that reached you — so we can send you the notifications you accepted.
• Moderation: the reports you file, together with a copy of the reported content taken at the moment of the report; the members you block, visible to you alone.
• Security and administration: your IP address when you request a password reset, and the log of administrative actions — who changed what, when, and with what result.

The app asks for the camera, the microphone and the photo library only at the moment you use them, and only for that. It never asks for your location.

3. If you are not a member

Two forms concern you without you having an account. In both cases no account is created and no rights are granted to you.

• Membership request: your name, your email address and your message are passed to the association's officers, who decide. If the request is refused, the reason is kept so that the association can answer you.
• Signing up for an event open to non-members: your name, your email address, your phone number if you give one, and the number of people you announce. An email asks you to confirm: without confirmation the sign-up is not firm. These details are readable only by the officers in charge of events, never by other members.

The number of attempts per IP address is counted for a few hours, to keep automated submissions out.

4. Why, and on what basis

• Performance of the service: your account, your messages, your sign-ups and your orders exist because you created them by using the app.
• Legitimate interest of the association: association life, moderation, the security of the service and the administration log.
• Your consent: notifications, which you can refuse at first launch and turn off at any time in the settings.
• Legal obligation: orders and payments, which the association must be able to account for.

5. Who can see it

• Other members, for what you post voluntarily: room messages, photos, comments, event participation.
• The association's officers, according to the permissions granted to them: member management, moderation, orders, publishing.
• Anyone, for what the association chooses to publish on its public website: calendar, news, gallery, shop, sponsors. That is an explicit decision, taken item by item; once taken, the page can be read without an account and becomes indexable by search engines. Conversations, private messages, polls, orders and the member directory have no public path at all — that is not a setting left at zero, it is the absence of code.
• App Community Suite and Wisepear, only to keep the service running and to answer a request from the association.

Your private messages are readable only by you and the person you are writing to — except for an officer holding a moderation permission, who can delete a reported message.

6. Processors and transfers

Your association's server and database are hosted at OVH, in the European Union, and operated by Wisepear. The only other services that receive data are:

Service	What it receives	When
Google Firebase	Notification identifier, notification content	On every notification sent
Google Tenor	IP address, search terms	Only if you open the GIF picker
Google Fonts	IP address	On the public website of an association that chose a Google typeface, and on this site
OpenStreetMap	IP address	Only if you display an event map
OpenRouteService	An event's address	When a route is computed, from our server
Resend	Recipient's email address	Invitations and notification emails

The typeface of the mobile app is embedded in the app: unlike the common practice, it is not downloaded at launch, so your IP address is not sent anywhere to display it. Web pages are the exception, and the row above says so rather than keeping quiet about it.

7. How long

Your data is kept for as long as your account exists within the association.

Deleting does not erase immediately. So that one click cannot destroy an association's history, a deleted item — message, photo, event, order — is marked as deleted, disappears from the app, and remains restorable by an officer. We would rather tell you than let you assume immediate erasure.

The account you delete yourself is the exception. That one is not restorable. Your personal data — name, email address, profile picture, role, notification devices — is erased there and then, and your address is released. What you posted stays in the association's archive, without your name.

A few periods are fixed by the software itself:

• A non-member's event sign-up: erased for good 365 days after the event, and 7 days after the request if it was never confirmed.
• Notification device: deactivated after 270 days without any notification reaching it, then deleted 60 days later.
• Password reset link: valid for 2 hours, single use.
• Sponsor display measurement: kept for as long as the association must be able to account for what it invoices.

Permanent erasure is possible: ask your association, or ask us if it cannot do it. The procedure is on your association's website, on the Eliminar a conta page.

8. Three things you would not guess

Polls are not anonymous. The association can see who answered what. Bear that in mind before answering.

Sponsor display is counted per member. When a sponsor is shown, the app records per day how many times you saw it and whether you clicked — that is what lets the association account for what it invoices. These figures are never passed to the sponsor by name: it receives totals only.

A file opens without a password. The app checks your permissions before showing you a list of photos; the file itself, however, opens for anyone holding its exact address. An address you pass on is passed on for good, even if the photo is later removed from the app.

9. Your rights

You may request access to your data, its correction, its erasure, the restriction of its processing, and you may object to processing based on legitimate interest. You may also ask for a copy of your data in a readable format.

Erasing your account needs no one: it is done from the app, Definições → Conta → Eliminar a conta.

Go to your association first, since it decides about this data: it must answer you within one month. If it does not answer, write to us — we have the technical means to act. You may also complain to the data protection authority of your country: the CNPD in Portugal, the CNIL in France.

10. Security

Traffic between the app and the server is encrypted (HTTPS). Passwords are never stored in the clear. Each association has a database and a server isolated from the others. Access to administrative functions is limited by permissions granted by name, and administrative actions are logged.

11. Minors

The app is not intended for children under 13. A minor may only have access if their association invites them, under the responsibility of the association and of their legal guardians.

12. This website

appcommunitysuite.com — the site you are reading — sets no cookies, uses no analytics and does not track you.

The contact form opens your own email program: what you write there reaches us directly, without passing through this site.

Its typefaces are loaded from Google Fonts, which sends your IP address to Google. Our host also keeps technical logs — IP address, page requested — for as long as security and diagnosis require.

13. Changes

If this policy changes substantially, the association is informed and the date at the top of the page is updated.

14. Contact

App Community Suite — hello@appcommunitysuite.com

Our full identification is on the Legal notice page.