Komuniti Privacy Policy
About this policy
This policy explains how FloudWorks handles personal information in Komuniti, its website and its mobile app. It is written for the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).
Komuniti is used by non-profit and community organisations ("Organisations") to run their membership, events, communications and records. Two parties are involved:
Your Organisation decides what member information it collects and how it uses it. It is responsible for that information, and its own privacy notice applies to it. Questions about your membership record should go to your Organisation first.
FloudWorks, ABN 20739506927 provides and operates the Komuniti platform. We handle Organisation data on each Organisation's behalf. We are directly responsible for platform account data, billing for Organisation subscriptions, and the security of the platform.
In this policy, "we" and "us" means FloudWorks, and "you" means anyone who uses Komuniti, including members, committee members, staff and Organisation administrators.
Information we collect
We collect only the information your Organisation needs to run its activities, and what is needed to operate Komuniti securely.
| Category | Examples | Where it comes from |
|---|---|---|
| Account and sign-in | Name, email address, username, password (stored hashed), sign-in provider (Google, Facebook or Microsoft) and its account id | You, or the provider you sign in with |
| Profile and contact | First and last name, mobile number, address, date of birth, gender, photo | You or your Organisation |
| Membership | Membership number, status, type, registration and expiry dates, payment and renewal history, committee roles | Your Organisation, and you when you apply or renew |
| Events and attendance | Event registrations, check-in time (including QR code scans), voting participation, proxies | You and your Organisation |
| Communications | Messages in the Community chat, feedback and its reference number, letters, notification history (SMS, WhatsApp, app) | You, your Organisation and Komuniti |
| Education programs | Student and teacher details, class enrolments, attendance and results, where your Organisation runs classes | Your Organisation, parents or guardians |
| Payments | Subscription and payment records. Card details are entered with and held by our payment provider, not by Komuniti | You, your Organisation and the payment provider |
| Device and technical | Mobile app installation id, push notification token, device platform, IP address, browser type, error and audit logs | Your device and our servers |
We do not ask for sensitive information (such as health, religious or political details) unless your Organisation's activities need it and you have agreed. Organisations are told not to store sensitive information in free-text fields without consent.
The mobile app does not collect your location, contacts, or advertising identifiers, and it does not track you across other apps or websites.
How we use information
We use personal information to provide Komuniti to you and your Organisation, and for no unrelated purpose. That includes:
signing you in and keeping your account secure, including detecting misuse and locking accounts after failed sign-ins;
maintaining membership records, renewals and payments for your Organisation;
running events: registration, QR code check-in, quorum counts and voting;
sending messages your Organisation chooses to send you by email, SMS, WhatsApp, app notification or the Community chat;
answering your questions in the Community chat, including automated answers about your own membership, events and letters, and passing other questions to your Organisation's committee;
recording feedback and letting you check its status by reference number;
billing Organisations for their Komuniti subscription;
supporting, maintaining and improving the platform, including fixing errors.
We do not sell personal information, use it for advertising, or share it with data brokers. Your Organisation's committee members and administrators can see member information according to the roles your Organisation assigns them.
Sharing and service providers
We share personal information only with your Organisation, with the service providers below that help us run Komuniti, or where the law requires it. Each provider receives only what it needs for its task.
| Provider | What it does | Information involved | Location |
|---|---|---|---|
| Microsoft Azure | Hosts the website, API, database, files and app notification hub | All Komuniti data | Australia East |
| Google, Facebook (Meta), Microsoft | Sign-in, when you choose that provider | Name, email, provider account id | United States and other countries |
| Meta (WhatsApp Business) | WhatsApp messages and QR codes sent by your Organisation | Mobile number, message content | United States and other countries |
| SMSBroadcast by Sinch (or configured by tenant) | SMS messages sent by your Organisation | Mobile number, message content | Australia and other countries |
| Google Firebase Cloud Messaging, Apple Push Notification service | Delivering app notifications | Push token, notification title and text | United States |
| Square | Subscription and payment processing | Payer name, email, payment details | Australia and United States |
| Microsoft Exchange 365 (or configured by tenant) | Sending emails and letters | Email address, message content | Australia and other countries |
We may also disclose information when required or authorised by law, to protect someone's safety, or as part of a sale or restructure of our business (in which case this policy continues to apply).
Storage, security and retention
Where it is stored. Komuniti data is stored in Microsoft Azure in Australia East. Some providers in the table above process information overseas, mainly in the United States. We take reasonable steps under APP 8 to ensure they protect it consistently with the APPs, including through their contractual commitments.
How we protect it.
All traffic is encrypted in transit (HTTPS), and the database is encrypted at rest.
Each Organisation's data is kept separate, and every request is checked against the signed-in person's Organisation.
Passwords are stored as hashes. App sign-in tokens are short-lived, and the app keeps its renewal token in the device's secure storage.
Access is controlled by role, so people see only what their role in their Organisation allows.
Secrets and keys are kept out of our source code in protected configuration.
No system is completely secure. If a data breach is likely to cause serious harm, we will notify the affected Organisations, the people affected and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.
How long we keep it. We keep information while your Organisation uses Komuniti and as needed for its records. Many Organisations must keep membership, meeting and financial records for a number of years. When an Organisation leaves Komuniti, we return or delete its data within 90 days, except backups (deleted within 35 days afterwards) and records we must keep by law. App sign-in codes expire after 2 minutes and renewal tokens after at most 365 days.
Your choices and rights
Access and correction. You can view and update your own name, mobile and address in the app (Account tab) or on the website. For other information, ask your Organisation, or contact us and we will pass the request on. We respond within 30 days.
Deletion. You can ask your Organisation to remove your record or close your account. Some records, such as financial and meeting records, may need to be kept for legal reasons. Ending your membership may not delete them straight away.
Messages. You can turn off app notifications in your device settings, sign out of the app, or ask your Organisation to stop SMS or WhatsApp messages. Important membership notices may still be sent by email.
Sign-in. Signing out of the app ends that device's session. You can remove Komuniti's access from your Google, Facebook or Microsoft account settings.
Anonymity. You can contact us without identifying yourself, but we need your identity to act on a membership record.
Complaints. Contact your Organisation or us first (see Contact). We will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
If you are in the European Union or United Kingdom, you also have rights under the GDPR, including data portability and objection. Contact us to use them.
Children
Members' accounts and the mobile app are for people aged 18 and over. Organisations that run classes may record information about students under 18. They do so with a parent's or guardian's consent and are responsible for it. Students do not get their own Komuniti accounts.
Changes to this policy
We will post any update on this page with a new effective date. If a change is significant, we will tell Organisations and show a notice in the app or website before it takes effect.
Contact
FloudWorks Privacy Officer
Email: info@floudworks.com.au
Post: U2 6 First Ave, Belfield NSW 2191, Australia
Effective date: 17 August 2026