Privacy Policy

1. Introduction

Mashi Digital ("Mashi Digital," "we," "us," or "our") respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use Community Cloud Platform ("MCC," "Community Cloud," or the "Platform").

The Platform enables individuals to discover, join, and participate in independent communities, organizations, chapters, clans, committees, and other entities.

This Privacy Policy applies to MCC's websites, mobile applications, desktop applications, account services, and related Platform functionality unless a separate privacy notice expressly applies.

It does not automatically govern the independent websites, applications, or external activities of communities using MCC.

Please read this Privacy Policy together with our Terms of Service.

2. Who Controls Your Information?

Mashi Digital operates the shared Platform and generally determines how personal information is processed for:

• Global MCC account registration.
• Authentication and account security.
• Platform administration.
• Community discovery.
• Platform-wide governance.
• Service operations and security.
• Platform communications.
• Compliance and fraud prevention.

Independent communities may determine how they process information for their own membership decisions, governance, events, communications, and internal activities.

Depending on the activity and applicable law, a community may act as an independent controller, Mashi Digital may act as a service provider or processor on its behalf, or the parties may have other legally defined responsibilities.

These roles depend on actual processing arrangements and are not determined solely by labels in this Policy.

Where required, Mashi Digital and community operators will enter into appropriate data-processing agreements.

Community administrators are not automatically authorized to access all information held in a User's global MCC account.

3. Personal Information We Collect

Depending on how you use the Platform, we may collect the following categories of information.

A. Account and identity information

• Preferred name.
• Account identifier.
• Phone number.
• Email address.
• Country or region.
• Date of birth.
• Gender, where provided.
• Profile photograph.
• Account status.
• Language preferences.
• Authentication and verification status.

We collect date of birth to support the Platform's 18-and-older eligibility requirement and related compliance needs.

A declared date of birth and phone OTP verification do not necessarily establish a person's legal identity.

B. Authentication and security information

• Phone verification events.
• Authentication timestamps.
• Device identifiers and trusted-device records.
• Session information.
• Security event logs.
• Account recovery events.
• IP addresses.
• Device and application characteristics.
• Fraud and abuse indicators.

Passwords are handled through secure authentication mechanisms and should not be stored in plaintext.

We do not intentionally store OTP codes in ordinary application logs.

C. Community membership information

• Communities you discover or join.
• Membership applications.
• Membership status.
• Chapter or entity affiliations.
• Community roles and permissions.
• Membership review information.
• Administrator decisions.
• Invitations and approvals.
• Community proposal submissions.
• Governance records.

Community affiliation may reveal or suggest sensitive information about a person's ethnicity, ancestry, religion, cultural identity, political interests, or other protected characteristics.

We apply additional restrictions where appropriate and required by law.

D. Communications and content

Depending on enabled features, we may process:

• Community posts.
• Comments.
• Messages.
• Meeting chat.
• Meeting participation records.
• Audio and video communications.
• Meeting recordings.
• Uploaded documents.
• Event registrations.
• Administrative communications.
• Reports and moderation records.

Content visibility depends on the relevant feature, community permissions, and applicable settings.

E. Technical and usage information

• Device type.
• Operating system.
• App version.
• Browser information.
• Approximate location inferred from network information.
• Application activity.
• Feature usage.
• Error diagnostics.
• Performance information.
• Security logs.

We do not claim to collect precise GPS location unless a feature actually requests and processes it.

If precise location is introduced, we will provide appropriate notice and permissions.

F. Payments and transaction information

If payment, donation, or subscription functionality is enabled, we may process:

• Transaction identifiers.
• Payment status.
• Amount and currency.
• Relevant billing information.
• Refund records.
• Payment-provider references.

Payment card details may be handled directly by independent payment processors.

We will disclose the applicable payment providers and practices when those features are introduced.

G. Support and administrative information

We may collect information you provide when contacting support, reporting misconduct, appealing decisions, or submitting privacy requests.

This may include correspondence, attachments, incident descriptions, and information needed to investigate or respond.

4. Sources of Information

We obtain information from:

1. You, when registering or using the Platform.
2. Community administrators, when reviewing applications or managing memberships.
3. Other Users, when they invite you, mention you, or report content.
4. Authentication and communications providers.
5. Devices and applications used to access the Platform.
6. Payment providers, where relevant.
7. Security and fraud-prevention systems.
8. Other lawful sources where necessary and appropriately disclosed.

We do not assume that information supplied by a community administrator is always accurate.

5. How We Use Personal Information

We use personal information to:

• Create and manage MCC accounts.
• Authenticate Users.
• Enforce the 18+ eligibility requirement.
• Protect accounts and trusted devices.
• Process community membership requests.
• Support community discovery and participation.
• Enable meetings, discussions, events, and governance tools.
• Manage community proposals.
• Send service and security notifications.
• Provide customer support.
• Prevent fraud, abuse, and unauthorized access.
• Investigate Terms of Service violations.
• Maintain Platform reliability and performance.
• Meet legal obligations.
• Exercise or defend legal claims.
• Improve the Services using appropriately governed operational information.

We will not use personal information for materially incompatible purposes without an appropriate legal basis, notice, or consent where required.

6. Legal Bases for Processing

Where the GDPR, UK GDPR, or similar legal frameworks apply, our processing may rely on one or more of the following legal bases:

• Performance of a contract.
• Compliance with legal obligations.
• Legitimate interests, where not overridden by applicable individual rights.
• Consent, where required.
• Protection of vital interests in exceptional circumstances.
• Other bases expressly permitted by applicable law.

Examples include:

Account authentication: Performance of our contract and security-related legitimate interests.

Fraud prevention: Legitimate interests and applicable legal obligations.

Service communications: Contract performance or legitimate interests.

Optional marketing: Consent or another permitted basis, depending on applicable law.

Sensitive community affiliation: An applicable special-category processing condition must be identified where such information is processed under laws that require one.

Membership in a cultural or ethnic community must not automatically be treated as unrestricted consent to process sensitive personal information.

We will provide supplemental jurisdiction-specific disclosures where required.

7. Date of Birth and Adult Eligibility

Community Cloud Platform is intended only for Users aged 18 or older.

We request date of birth during registration to determine whether a User meets the minimum-age requirement.

We may process DOB to:

• Evaluate age eligibility.
• Prevent unauthorized underage registration.
• Meet legal or regulatory obligations.
• Investigate suspected eligibility misrepresentation.

A User's full DOB is not intended to be publicly visible.

Community administrators should generally receive an eligibility indicator rather than a full birth date unless access is specifically authorized and necessary.

We may request additional verification where justified by law, security, or risk.

8. Community Membership and Sensitive Affiliation Information

Joining a community may disclose or imply information about your background, identity, relationships, or interests.

For example, membership in a culturally identified community may suggest ethnic or ancestral affiliation, although membership does not conclusively establish any such characteristic.

We seek to limit disclosure of membership information to authorized parties and applicable community visibility settings.

Information submitted for membership review may be accessible to authorized reviewers within the relevant community.

Community administrators must not use membership information for unlawful discrimination, harassment, intimidation, or unauthorized profiling.

We do not automatically share one community's private membership application with administrators of unrelated communities.

Users should avoid submitting unnecessary sensitive documents or personal information.

Where special-category data protections apply, we will implement an appropriate legal basis and additional safeguards.

9. How We Share Information

We may disclose personal information to the following categories of recipients.

A. Authorized community administrators

We share information necessary for legitimate membership review, governance, and community administration.

Access is subject to the administrator's permissions and the applicable community scope.

B. Other community members

Information you choose to publish or share may be visible to other authorized Users according to feature settings.

For example, your display name and contributions may be visible in meetings or discussions.

C. Service providers

We may engage providers for:

• Cloud hosting and storage.
• Database and infrastructure services.
• Phone and OTP delivery.
• Email and notifications.
• Audio/video communications.
• Recording and media processing.
• Security monitoring.
• Analytics and diagnostics.
• Payment processing.
• Customer support.

Providers may process information under contracts and safeguards appropriate to their roles.

D. Legal and safety purposes

We may disclose information when reasonably necessary to:

• Comply with lawful legal process.
• Meet legal obligations.
• Protect Users from serious harm.
• Investigate fraud or security incidents.
• Enforce our Terms.
• Establish, exercise, or defend legal claims.

We assess requests according to applicable law.

E. Business transactions

Information may be transferred in connection with a merger, acquisition, financing, restructuring, or sale of relevant business assets, subject to applicable law and appropriate protections.

We do not disclose personal information to third parties merely because they request it.

10. Sale of Personal Information and Advertising

This section must be verified against the actual Platform's advertising, analytics, and data-sharing practices before publication.

Mashi Digital's intended policy is not to sell Users' personal information or use sensitive community affiliation data for cross-context behavioral advertising.

If actual operations differ, we will update this Policy, provide legally required notices, and implement applicable opt-out mechanisms before engaging in such processing.

Certain privacy laws define "sale" or "sharing" more broadly than ordinary commercial usage.

We will assess relevant SDKs, analytics, advertising integrations, and third-party data transfers under applicable definitions.

We will honor legally required opt-out rights and recognized preference signals where applicable.

11. Meetings, Communications, and Recordings

When meeting functionality is enabled, we may process meeting identifiers, participant information, connection metadata, chat, audio, video, and recordings.

Live communications may be transmitted through third-party infrastructure.

Where recordings are enabled:

• Recording should be disabled by default unless a different approved configuration applies.
• Authorized organizers must initiate recording.
• Participants should receive appropriate recording notices.
• Recording access must be permission-controlled.
• Retention and deletion must follow documented policies.
• Organizers and participants must comply with applicable recording-consent laws.

Recording content may contain sensitive personal information.

Mashi Digital does not guarantee that other participants will comply with confidentiality expectations or refrain from unauthorized off-platform recording.

We may preserve relevant records where legally necessary for security, disputes, or investigations.

Specific recording retention periods must be published after operational verification.

12. International Processing and Transfers

MCC may serve Users in multiple countries, including the United States and other regions.

Personal information may be processed in countries where Mashi Digital or its authorized providers operate.

Those countries may have privacy laws different from the laws of your country of residence.

Where applicable law requires safeguards for international transfers, we will use appropriate legal mechanisms, such as approved contractual clauses or other recognized transfer arrangements.

We do not guarantee that all information remains within a particular country unless an expressly applicable service commitment provides otherwise.

Regional routing of live communications does not necessarily mean recordings, backups, support access, or other processing remain within the same region.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable law, contractual obligations, security requirements, and legitimate dispute-resolution needs.

Retention periods depend on the type of information and the reason for processing.

Examples include:

• Account information: While the account remains active and for a justified period after closure.
• Membership records: While needed for membership administration and lawful recordkeeping.
• Meeting recordings: According to the approved recording-retention schedule.
• Messages and discussions: According to applicable feature and community retention policies.
• Security logs: For a limited period justified by security and operational needs.
• Audit records: As required for accountability, legal obligations, and dispute resolution.
• Backup copies: Until expiration of applicable backup retention cycles.

Specific retention periods will be maintained in an operational retention schedule and disclosed where legally required.

When retention is no longer justified, information will be deleted, de-identified, or otherwise disposed of securely, subject to legal holds and technical backup cycles.

Deletion from active systems may not immediately remove information from all backups.

We will not describe information as permanently deleted until the applicable deletion process has actually been completed.

14. Data Security

We implement technical and organizational safeguards appropriate to the nature of the information and the risks involved.

Depending on the system, safeguards may include:

• Encryption in transit.
• Encryption at rest.
• Access controls.
• Role-based permissions.
• Tenant isolation.
• Secure authentication.
• Session management.
• Security logging.
• Infrastructure monitoring.
• Backup and recovery controls.
• Vulnerability management.
• Administrative access restrictions.

No system is completely secure.

We cannot guarantee that unauthorized access, loss, or misuse will never occur.

If a security incident occurs, we will investigate and provide notifications as required by applicable law.

Users should report suspected security issues to [SECURITY CONTACT EMAIL].

15. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have rights to:

• Access personal information.
• Request correction.
• Request deletion.
• Obtain a copy of certain information.
• Withdraw consent where processing relies on consent.
• Object to certain processing.
• Restrict certain processing.
• Opt out of qualifying sale, sharing, or targeted advertising.
• Limit certain uses of sensitive personal information.
• Appeal a denied privacy request.
• Lodge a complaint with a relevant privacy authority.

Rights are subject to legal conditions and exceptions.

To submit a request, contact:

[PRIVACY EMAIL]

or use:

[PRIVACY REQUEST WEB FORM URL]

We may verify your identity before fulfilling a request.

We will respond within applicable legal time limits.

We will not unlawfully discriminate or retaliate against Users for exercising privacy rights.

Where authorized agents may submit requests, we will follow applicable verification requirements.

16. California Privacy Rights

If the California Consumer Privacy Act, as amended, applies to Mashi Digital and your personal information, you may have rights to know, access, correct, delete, opt out of qualifying sale or sharing, limit certain uses of sensitive personal information, and receive equal treatment for exercising your rights.

Categories of personal information collected and their purposes are described in Sections 3 through 5.

Categories of recipients are described in Section 9.

Retention practices are described in Section 13.

Mashi Digital will provide additional California-specific disclosures and request mechanisms where required, including information about relevant collection and disclosure periods.

If we engage in activities qualifying as sale or sharing under applicable law, we will provide the required opt-out controls.

We will recognize legally required preference signals where applicable.

This section does not imply that every California privacy law applies to Mashi Digital regardless of statutory thresholds and exemptions.

17. Other U.S. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights.

Where applicable, we will provide appropriate request methods, appeal procedures, sensitive-data controls, and other notices required by state law.

Mashi Digital will evaluate the applicability of state privacy laws based on its actual operations, processing activities, and legal status.

18. European Economic Area, United Kingdom, and Other International Rights

Where the GDPR, UK GDPR, or similar laws apply, individuals may have additional rights relating to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

Applicable laws may also require:

• Identification of the relevant controller.
• Specific legal bases.
• Special-category data safeguards.
• International transfer mechanisms.
• Retention information.
• Supervisory authority information.
• Local representative or data protection officer contact details where required.

Mashi Digital will provide supplemental disclosures and arrangements when legally necessary.

Nothing in this Policy limits nonwaivable statutory privacy rights.

19. Children's Privacy

The Platform is intended exclusively for adults aged 18 or older.

We do not knowingly permit children to register for MCC accounts.

If we learn that an underage person has registered, we may suspend the account, investigate, and take appropriate deletion or restriction measures.

If you believe an underage person is using the Platform, contact:

[PRIVACY EMAIL]

We will handle such reports according to applicable child-privacy and data-protection laws.

20. Cookies, SDKs, and Similar Technologies

Our websites and applications may use cookies, local storage, SDKs, and similar technologies for:

• Authentication.
• Session continuity.
• Security.
• Preferences.
• Performance diagnostics.
• Feature operation.
• Analytics, where implemented.

We will provide any required cookie or tracking notices and consent controls.

Nonessential tracking will be subject to applicable consent or opt-out requirements.

We will not claim that optional analytics or advertising SDKs are absent without verifying the deployed applications.

21. Automated Decision-Making

The Platform may use automated rules for security, spam prevention, eligibility checks, and workflow routing.

Community membership decisions may involve human administrators.

We do not intend to make legally significant decisions solely through automated processing without appropriate safeguards where required by law.

If automated decision-making practices materially change, we will provide required disclosures and rights.

22. Account Closure and Deletion

Users may request account closure through available account controls or by contacting support.

Account closure may result in loss of access to community memberships, communications, and Platform services.

Deletion requests will be evaluated under applicable law.

Some information may need to be retained for:

• Security investigations.
• Fraud prevention.
• Legal obligations.
• Financial recordkeeping.
• Dispute resolution.
• Protection of other Users' rights.
• Backup lifecycle requirements.

Content shared with other Users may remain in certain records or communications where lawful and necessary.

We will explain relevant limitations when responding to deletion requests.

23. Changes to This Privacy Policy

We may update this Policy as our Services, processing practices, laws, or providers change.

We will update the effective date and provide additional notice where required.

Where a new processing activity requires consent, we will seek that consent before beginning the activity.

Material changes will not be treated as authorization to disregard previously applicable privacy obligations.

24. Contact Us

For privacy questions, access requests, deletion requests, or concerns:

Community Cloud Platform

Operated by Mashi Digital

Legal Entity: [FULL REGISTERED LEGAL NAME]

Privacy Contact: [PRIVACY EMAIL]

Security Contact: [SECURITY EMAIL]

Address: [REGISTERED BUSINESS ADDRESS]

Website: [OFFICIAL PLATFORM WEBSITE]

Where required by applicable law, additional local representative or data protection officer information will be provided.

END OF PRIVACY POLICY — DRAFT FOR LEGAL REVIEW