Privacy Policy

1. Who we are

COMUNO is operated by RAVORA S.R.L., CUI 55332988, J2026047270004, Sălicea nr. 248 Z, Sat Sălicea, Comuna Ciurila, jud. Cluj, România.

For anything about your data, write to [email protected].

2. Our role, and the organization’s role

COMUNO is used by organizations — creators, clubs, associations, companies — to run their communities. Your data is handled in two different ways:

We decide how your data is used (we are the controller) for: visits to comuno.ro, requests made through the “Get started” form, your COMUNO account (sign-in details, profile, devices and security records), and the organizations that are our customers.

The organization decides (it is the controller, and we process the data on its behalf) for everything that belongs to its community: your membership in its communities, what you post there, event sign-ups and reviews, messages sent through its website’s contact form, newsletter sign-ups, emails it sends you, and materials it shares or sells. Its own privacy notice applies to that data, and you can ask it directly about your rights.

We process community data only on the organization’s instructions, under a data processing agreement [DPA — to be attached to the customer contract].

3. What we collect

Website and “Get started” form: your name, email, organization name, type of community and message.

Your account: name, email address, username, password (stored only as a secure hash), and what you add to your profile, such as a photo, city or short bio. You can also sign in with Google (and other providers, when we enable them); we then receive your name, email and profile picture from that service.

Security and devices: for each sign-in we record the device, IP address, and when the session was created and last used, so you and the organization’s admins can see active devices and sign them out. We limit failed sign-in attempts per email and per IP address.

Community content: posts, discussions and replies, mentions, reviews and ratings, reading lists and progress, books you lend or borrow, badges, notifications, and files you upload (images up to 5 MB). If you import a Goodreads export, we read the books, shelves, ratings and reviews it contains.

Events: when you sign up for an event we store your name, email and any note you add; event reviews you leave are stored too.

Purchases: when you buy a PDF, the payment is made on PayU’s page and we never see or store your card details. We keep the order (your email, the item, the amount, its status and a download link).

Organizations: for our customers we also keep billing and subscription details, and the settings they connect — such as their PayU account, their outgoing email account and a Facebook page with its Instagram account. Passwords and secret keys for these are stored encrypted.

4. Cookies

We use only cookies needed for the service to work: to keep you signed in, to remember your language, to protect sign-ins through Google or another provider, and to connect an organization’s Facebook page when its admin asks for it.

We don’t use advertising or analytics cookies, and we don’t track you across other websites.

5. Why we use it, and on what legal basis

To provide the service you or your organization asked for — your account, sign-in and the community features (GDPR art. 6(1)(b)).

To answer a “Get started” request — steps taken at your request before a contract (art. 6(1)(b)).

To keep the platform secure: limiting failed sign-ins, recording devices, keeping an activity log of administrative actions, and keeping organizations’ data separated (art. 6(1)(f), our legitimate interest).

To meet legal obligations, such as accounting and tax records (art. 6(1)(c)).

For community data, the organization chooses the legal basis and is responsible for it — for example, consent for its newsletter.

6. Who can see it

Other members of a community see what you share there: your profile, posts, reviews and what you are reading. Nothing from a private community appears on the organization’s public website.

The organization’s admins and moderators can manage its members: see who belongs, when someone was last active and on how many devices, move members between communities, issue a temporary password, and remove content.

Our support staff can open an organization’s admin area, for at most one hour at a time, to help it. Every such session is shown with a banner and recorded in a log the organization can read.

We don’t sell your data and don’t use it for advertising.

7. Service providers

Hosting and storage: Hetzner Online GmbH (Falkenstein, DE); [FILE STORAGE PROVIDER AND LOCATION].

PayU, for card payments — for an organization’s sales it is the organization’s own PayU account; for COMUNO subscriptions, ours. PayU handles card data under its own privacy policy.

The email provider an organization connects, to send its emails to members; and our own email provider, to send billing emails (reminders, payment confirmations) to organizations’ admins.

Google (or another sign-in provider we enable), only if you choose to sign in with it; Meta, when an organization posts its events to Facebook and Instagram.

Open Library and Google Books, to find book information and covers — these lookups contain book titles, not personal data.

If data is transferred outside the European Economic Area, we do so only with the safeguards the GDPR requires, such as the European Commission’s standard contractual clauses.

8. How long we keep it

Your account is kept until you delete it, or until it is closed under our Terms. You can delete your account at any time from Settings: this deletes your profile and everything tied to it — your posts, reviews, reading lists and devices — and cannot be undone.

Sign-in sessions expire after 30 days; failed sign-in records are kept only for the short window they protect.

“Get started” requests: 12 months after our last contact, unless you become a customer. Server logs: 30 days.

Order and invoice records are kept as long as accounting law requires.

When an organization stops using COMUNO: if it is suspended, its members lose access at once and its website goes offline one month later. Its community data is deleted [PERIOD AFTER THE CONTRACT ENDS — e.g. 90 days], unless the law requires us to keep part of it.

9. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format.

Many of these you can do yourself in Settings: edit your profile, change your password, sign out other devices and delete your account. There is no download button yet — to get a copy of your data, write to us and we will send it.

For data we control, write to [email protected]; we answer within one month. For community data, contact the organization — and if you write to us, we will pass your request on to it.

You can also complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in your country.

10. Security

Passwords are stored only as secure hashes, and the secret keys organizations connect are encrypted. Each organization’s data is kept separate from every other’s, and this separation is tested. Changing your password signs out your other devices.

11. Children

COMUNO is not intended for children under 16 without the consent of a parent or guardian [MINIMUM AGE — to be confirmed]. Communities that welcome younger members are responsible for obtaining that consent.

12. Changes

If we change this policy, we will publish the new version here with its date, and tell organizations in advance of significant changes.