Privacy Policy

Commlly ("Commlly", "we", "us") provides a professional platform for public relations, communications, events, invitations, guest experience and newsletters. This policy explains what personal data we collect, why we collect it, how we use it and the rights you have over it. It applies to the Commlly website at commlly.com and to the Commlly application.

For personal data belonging to your own contacts and guests that you upload to Commlly, you are the data controller and Commlly acts as a data processor on your instructions.

Account information. Your name, email address, organisation name, role, language preference and, where applicable, billing details processed by our payment provider.

Google account data (if you sign in with Google). When you choose to sign in with Google, we receive from your Google account only the basic profile information you authorise: your name, your email address, your Google account identifier and your profile picture. We never request or receive your Google password, and we do not request access to Gmail, Google Drive, Contacts, Calendar or any other restricted or sensitive Google API scope.

Content you create. Contacts, lists, events, venues, invitations, RSVPs, credentials and passes, newsletters, campaigns and uploaded images.

Usage and technical data. Log data, device and browser information, IP address, and email engagement events such as delivery, opens, clicks and unsubscribes for messages sent through Commlly.

• To create and authenticate your account and keep your session secure.
• To provide the platform: contacts, events, invitations, check-in, newsletters, analytics.
• To send service and transactional email such as invitations, passes and account notices.
• To measure delivery and engagement of messages you send, and to enforce plan allowances.
• To protect the platform against fraud, abuse and security incidents.
• To comply with legal obligations.

We do not use your data, or your Google account data, for advertising, profiling for advertising, or resale.

Commlly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features of Commlly that you have asked for.
• We do not sell Google user data, and we do not transfer it for advertising purposes.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
• We do not allow humans to read Google user data, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymised.

Where the GDPR applies, we rely on: performance of a contract (providing the platform), your consent (Google sign-in, optional communications), our legitimate interests (platform security, service improvement, fraud prevention) and compliance with legal obligations.

We do not sell personal data. We share data only with service providers who process it on our behalf and under contract: our cloud hosting and database provider, our email delivery provider (messages are sent from notify.commlly.com), our payment provider, and mapping services used for venue lookup. Data may also be disclosed where legally required, or as part of a corporate transaction, in which case this policy continues to apply.

Our providers may process data outside your country, including in the United States. Where required, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Data is encrypted in transit, access is restricted by organisation-level isolation and row-level security rules, event credentials are validated server-side, and administrative access is limited to authorised personnel. No system is perfectly secure, but we work to protect your data and to notify you of any incident that affects it as required by law.

We keep your account data for as long as your account is active. When an account is deleted, the account and its associated organisation content are removed from our production systems within 30 days, and from routine backups within 90 days, except where we must keep records for legal, accounting or security reasons.

You may access, correct, export, restrict or delete your personal data, object to processing, and withdraw consent at any time. You can edit your profile and delete records directly in Commlly, or request full account and data deletion by emailing privacy@commlly.com from your account address. We respond within 30 days.

Revoking Google access. You can disconnect Commlly from your Google account at any time at myaccount.google.com/permissions. Revoking access stops any further use of your Google account data; to also delete the data we already hold, contact us at the address above.

You also have the right to lodge a complaint with your local data protection authority.

Every newsletter sent through Commlly contains an unsubscribe link, and unsubscribed recipients are excluded from future sends. Service messages necessary to operate your account, such as invitations you requested, sign-in and security notices, are not marketing messages.

We use strictly necessary cookies and browser storage to keep you signed in and to remember your language preference. We do not use third-party advertising or cross-site tracking cookies.

Commlly is a business tool and is not directed to children under 16. We do not knowingly collect data from children.

We may update this policy. Material changes will be announced in the application or by email, and the date at the top of this page will be revised.

Commlly — privacy enquiries: privacy@commlly.com. Website: commlly.com.