Privacy Policy

Comm (“Comm”, “we”, “us”) is operated by Australian Event Productions Pty. Ltd. (ABN: 97 016 334 024), an Australian company. This policy explains what personal information we handle through the Comm website, web app, admin console and companion apps (iOS and Android), why, how long we keep it, and your rights. Privacy questions go to jt@jamietaylor.co.

We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Where the EU or UK General Data Protection Regulation (GDPR) applies, this policy also gives the information it requires.

Comm is used by event and production companies. For your own Comm account, we decide how your information is used (under the GDPR, we’re the “controller”). For information an event owner adds about their crew, cast or contractors, the event owner decides what is collected and why, and we handle it on their behalf (we’re their “processor”). If you’re on an event’s roster, the company running that event is your first point of contact; we’ll also help if you contact us.

• Account information: name, email address and a securely hashed password (we never see or store your password in plain text), plus an optional profile photo and your settings. If you sign in with Google or Apple instead, we receive your name and email address from them, and no password is stored.
• Billing information: if you subscribe to a paid plan, Stripe handles the payment. We never see your full card details; we only receive what we need to manage your subscription, such as your plan and billing status.
• Event roster data: what an event owner adds about their crew, cast or contractors: name, role, department, company, mobile number, email and optionally a photo, plus which equipment, channels and locations they’re assigned.
• ID card checks: if an event owner uses the optional ID check, a photo of a person’s ID card or badge taken in the Comm app before equipment is handed out. The app reads the name (and, on a staff badge, the department and company) from the card on the device to fill them in, and may cut out the face on the card to use as the person’s roster photo. The ID photo is used only to confirm who is collecting equipment.
• Signed rental agreements: if an event owner uses this optional feature, the person’s signature and the agreement text, stored as a PDF.
• Activity log: a record of what happened within an event (for example, who checked out a device, or when a setting changed), tied to the account or paired device that did it.
• Support requests: what you write in a support ticket, any files you attach, and a technical diagnostic bundle (browser or device details and recent errors; no screenshots or page content).
• Contact form: your name, email address and message. Cloudflare Turnstile checks the form isn’t being sent by a bot, which involves your browser and IP address.
• Technical logs: our hosting providers record requests to Comm, including IP addresses and browser details, to run and secure the service.
• Cookies: functional cookies only: your sign-in session, your light or dark theme, and which event you last had open. We don’t use advertising, analytics or tracking cookies.

An event owner who adds information about other people is responsible for having the right to do so (see our Terms of Service) and for telling those people how it will be used.

• To provide Comm: sign you in, run the features you use, and keep each event’s data visible only to the people it’s shared with (GDPR basis: performing our contract with you or your organisation).
• To handle roster, ID check and rental agreement data on the event owner’s instructions (the event owner decides the basis for collecting it).
• To keep Comm secure, keep the activity log and investigate problems (basis: our legitimate interest in a secure, reliable service).
• To answer support requests and messages (basis: our contract, or your request).
• To send emails: account emails such as verification, password resets and reminders before your free trial ends; emails an event owner sends to their crew, such as broadcasts and invitations to fill in their channels; invitations when someone shares an event or a team seat with you; and occasional emails to account holders about Comm (see section 4).
• To meet legal obligations, such as tax and accounting records.

We don’t sell personal information, we don’t use it for advertising, and we don’t send it to AI services. We don’t make decisions about people by automated means.

We may email account holders about Comm, such as new features or changes to plans. Every one of these emails has an unsubscribe link, and unsubscribing takes effect straight away. We keep a list of unsubscribed addresses so we don’t email them again. Account emails (like password resets) aren’t affected, except that we also stop sending free-trial reminders to an unsubscribed address.

We use these service providers to run Comm, and give each only what it needs:

• Supabase: database, sign-in, file storage and backend functions. Most of the information above is stored here.
• Vercel: hosts the Comm website and web app.
• Resend: delivers our emails and event owners’ broadcasts.
• Stripe: processes payments for paid plans.
• Cloudflare: checks contact form submissions for bots (Turnstile).
• Google and Apple: only if you choose to sign in with them: they confirm who you are and give us your name and email address.

If you connect your own AI assistant to Comm (through Comm’s MCP server), it can read and change the event data you give it access to; that is between you and your AI provider. We may also disclose information when the law requires it, or to protect the rights, property or safety of Comm, our users or others.

Comm’s database and files are stored, and the web app runs, in India (Mumbai). Our hosting, email, payment, sign-in and bot-check providers are mainly based in the United States. These countries may not have privacy laws equivalent to Australia’s or the EU’s.

For Australian law, by using Comm you consent to your information being handled in these countries. For information covered by the GDPR, transfers rely on the European Commission’s Standard Contractual Clauses in each provider’s data processing terms.

Each event’s data is only available to its owner and the people it’s shared with, enforced in the database itself. Roster photos, ID photos and signed rental agreements are kept in private storage and shown only through links that expire within an hour. Information is encrypted in transit and at rest, and two-factor sign-in is available. No system is perfectly secure, but we take reasonable steps to protect your information.

If a data breach is likely to cause serious harm, we’ll notify the people affected, the event owner concerned and the regulators as the law requires.

• ID card photos: deleted 30 days after the event ends (or 30 days after they were taken, if the event has no dates).
• Signed rental agreements: 2 years after the event ends.
• Activity log entries: 2 years.
• Support tickets: 2 years after they’re closed.
• Roster data and events: until the event owner deletes them, or within 90 days after their account is closed.
• Your account: until you ask us to close it, then within 90 days.
• Unsubscribe list: kept, so we never email those addresses again.

Files are removed from storage within two days of the record they belong to being deleted. Backups held by our database provider expire on their own schedule. We may keep information longer where the law requires it (for example, billing records for tax).

You can ask to access the personal information we hold about you, and to correct or delete it. You can correct most of your own account information in the app. Where the GDPR applies, you can also ask us to restrict or stop using it, to give it to you in a portable form, and you can withdraw consent at any time.

Email jt@jamietaylor.co. We’ll reply within 30 days, and may need to confirm who you are first. If your information is on an event’s roster, we’ll pass your request to the event owner or help them act on it, since they decide how it’s used.

If you have a concern about how we’ve handled your information, email jt@jamietaylor.co and we’ll respond within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU or UK, to your local data protection authority.

Comm isn’t directed at children. An event’s roster can include people under 18 (for example, young cast or crew); the event owner who adds them is responsible for getting any permission needed from a parent or guardian.

We’ll update the date at the top of this page whenever this policy changes, and let account holders know about significant changes.

Australian Event Productions Pty. Ltd., trading as Comm: jt@jamietaylor.co, or through Support.