This policy describes how Community Intelligence ("we", "us", "the Service") processes personal data when providing community engagement analysis and outreach automation to community platform operators ("the Customer").
We process community member data that the Customer's platform makes available through its API:
We do not collect data directly from community members. All data is accessed through the Customer's platform API, using credentials the Customer provides and controls.
We store the following in our database, isolated per Customer (tenant):
We do not store raw member profiles. Member data is read from the platform API at analysis time and not persisted beyond the analysis results.
Each Customer's data is isolated by tenant ID at the database level. One Customer's data is never accessible to another. This is enforced in application code and database queries.
Member data is sent to AI models (currently Anthropic Claude) for analysis and email drafting. This processing uses the AI provider's API subject to their data processing terms. Anthropic's commercial API terms prohibit training on API inputs.
Community members are data subjects of the Customer, not of us. The Customer is responsible for handling data subject requests (access, deletion, portability) under GDPR. We assist by deleting or exporting stored data for specific members on request, and by respecting do-not-contact flags set in the Customer's platform.
Data is retained while the Customer's account is active. On termination, all Customer-specific data is deleted within 30 days. Earlier deletion available on request.
Community Intelligence provides AI-powered community engagement analysis and outreach automation. The Service connects to your existing community platform via its API to analyse member behaviour, draft personalised outreach, and manage communications on your behalf.
The Service uses AI models to analyse data and draft emails. While we design prompts and guardrails to produce appropriate content, AI-generated text may occasionally be inaccurate or inappropriate. The guardrails (human review, auto-send rules, exclusion lists) mitigate this risk. We do not guarantee error-free content.
The Service, including its workflows, prompts, and methodology, is our intellectual property. Email content generated for your community is yours.
The Service is provided "as is." We are not liable for damages arising from AI-generated content, delivery failures, or member responses to automated outreach. Total liability limited to fees paid in the 12 months preceding the claim.
Either party may terminate with 30 days' notice. On termination, all data deleted within 30 days. Export available on request before deletion.
This DPA forms part of the agreement between the Customer ("Data Controller") and Community Intelligence ("Data Processor") for the provision of the Service.
The Customer is the Data Controller. Community Intelligence is the Data Processor. Processing is carried out solely for providing the Service as described in the Terms above.
| Category | Data elements | Purpose |
|---|---|---|
| Identity | Name, email, member ID | Identify members for analysis and outreach |
| Profile | Headline, location, membership tier | Personalise outreach content |
| Engagement | Login history, email opens/clicks, event attendance | Assess engagement risk level |
| Communications | Email subject, body, timestamp, outcome | Delivery and tracking |
| AI reasoning | Assessment, risk tags, suggested actions | Audit trail, EU AI Act compliance |
| Sub-processor | Location | Purpose |
|---|---|---|
| Anthropic | San Francisco, USA | AI model API |
| Infrastructure provider | EU | Hosting |
30 days' notice for sub-processor changes. Controller may object within that period.
Data sent to Anthropic's API in the US under Standard Contractual Clauses (SCCs). Anthropic does not use API inputs for model training.
Processor assists Controller with access, rectification, erasure, and portability requests within 10 business days.
Processor notifies Controller of any personal data breach within 72 hours, including nature of breach, data affected, and measures taken.
Controller may audit Processor's compliance once per year with 30 days' notice.
Questions or requests: legal@community-intelligence.io