Privacy notice

It covers visitors, residents, people who contact a local organisation, people who submit news, events, map information or requests for community support, and authorised Community Ready portal users. It also covers information stored on a device so that selected map and emergency content remains available without an internet connection.

Community Ready is a trading name of Ionmhas Limited (company number SC632601), whose registered office is 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN. Ionmhas Limited is registered with the Information Commissioner's Office under number C2030374.

Ionmhas Limited is the controller responsible for personal information used for Community Ready customer administration, portal accounts, platform security, direct support enquiries, device registration and the technical operation and improvement of the service.

The participating community organisation is the controller responsible for information sent to that community, including resident submissions, community contact messages and offers or requests for help. Ionmhas Limited provides the technology and processes that information only on the community controller's documented instructions. Each participating community is identified with its own contact details.

Ionmhas personnel do not have routine application access to the contents of community submissions. News, event and map suggestions can be reviewed by authorised community administrators through the Community Ready portal. Offers and requests for help are delivered to the community's nominated mailbox instead of being retained as portal submission records. Infrastructure providers may process information as needed to provide their services.

Questions about this notice or Ionmhas Limited's use of personal information can be sent to office@communityready.co.uk.

The information depends on how you use Community Ready and may include:

• Event interest and updates: a persistent app-installation identifier (or first-party website device cookie), selected event dates, and any name or optional email address you provide. Interest counts are public; names are visible only to authorised event managers. Email updates require email verification and opt-in for that occurrence. Emails are sent individually through Resend, with replies going to the organiser. Replying shares your email address with that organiser. Withdraw interest or use the email unsubscribe link to stop updates for that date.
• Enquiries and contact forms: your name, email address or telephone number, community, role, selected recipient and message.
• Portal accounts: name, email address, authentication details, community membership, role, permissions and the local bodies an authorised user may represent.
• Resident submissions: submitted news, event or map details, images and documents, name and contact information, event dates, and a location selected on the map. Offers or requests for help may also include a house name, telephone number and the details provided by the person making the submission.
• Welfare information: the name, address, telephone number and reason a person may need a check-in. This may reveal information about health, disability or other personal circumstances, and may be submitted by the person concerned or by somebody else on their behalf.
• App and notification details: a random installation identifier, push-notification token, device platform and name, and the communities followed or selected as the home community.
• Location: a position you choose on a map and, only if you grant device permission, your approximate or precise device location when using a location feature.
• Technical and security information:routine service logs, IP address, browser or device information, authentication events, timestamps and diagnostic information needed to protect and operate the service. App failure reports contain bounded counts by error category, app version and iOS or Android. They do not include message text, document links, community names or device identifiers. These aggregate counts are retained for 30 days.
• Service totals: community-level counts of devices following a community and devices to which a notification was delivered. We use aggregate totals where individual device information is not needed.

Please do not submit medical records, financial details or other highly sensitive information through general forms. If an emergency presents an immediate risk to life, call 999 rather than relying on Community Ready.

The relevant community controller decides why a local submission is needed, who within the community may review it, whether any submitted content should be published, who it may be disclosed to and how long it should be retained. Ionmhas Limited does not use the contents of community submissions for its own purposes.

Completed Offer help and Request help forms are sent through Resend to the email address chosen by the community. Community Ready does not create a copy of those completed forms in its portal database. The email provider and receiving mailbox process and retain the message according to their service settings and the community controller's documented retention arrangements.

Welfare information can include special-category personal information and requires additional protection. The community controller is responsible for identifying and documenting its lawful basis and any required special-category condition before using that information. Only information reasonably needed to arrange support should be provided. Community Ready is not an emergency service; call 999 if someone is in immediate danger.

If you submit information about another person, the community receives that information from you. The community controller is responsible for giving that person the applicable privacy information when it first contacts them and, ordinarily, no later than one month after receiving their information, unless a lawful exemption applies.

Ionmhas Limited uses personal information for the following purposes:

• provide, administer and secure Community Ready accounts and services;
• provide the technical route by which messages reach the local body selected by the sender;
• operate the app, website, offline content and opted-in notification service;
• answer direct enquiries and provide technical or account support;
• prevent misuse, maintain security and diagnose faults;
• produce community-level service totals and improve the reliability of the service; and
• comply with legal obligations or protect life in a genuine emergency.

The community controller uses information sent to it to review and respond to local messages, assess offers or requests for help, and decide whether submitted news, event or map content should be edited, approved, rejected or published. Ionmhas Limited performs the associated storage and technical operations as that community's processor.

Ionmhas Limited relies on:

• Legitimate interests to administer and support Community Ready, secure accounts and systems, prevent misuse, diagnose faults, measure aggregate service use and improve reliability. These interests are balanced against the rights and reasonable expectations of the people affected.
• Contract where processing is necessary to provide a service to an individual who is party to a contract, or to take steps they request before entering one.
• Consent where an optional feature requires it. Notifications and location access can be withdrawn through the relevant iOS or Android settings.
• Legal obligation where the law requires us to retain, use or disclose information.
• Vital interests only where processing is strictly necessary to protect somebody's life in a genuine emergency.

Each community controller is responsible for stating the lawful basis, and any special-category condition, that applies to its own use of community submissions. A device permission is also controlled through your phone and does not replace any lawful basis required by data-protection law.

We do not use personal information to make automated decisions that have legal or similarly significant effects.

Content approved by a community administrator may be published for anyone to see on the community's public website and in the app. This may include the content, image, publishing body and publication date. The separate name and contact fields used for News and Event moderation are never published and are automatically erased when a decision is recorded.

Community administrators may edit, decline, hide, archive or remove content in line with their local responsibilities.

Depending on the service used, information may be shared with:

• authorised administrators of the community that received a submission and the local body selected by the sender;
• suppliers that operate the service, including Supabase for authentication, database and file storage; Vercel for web hosting; Resend for email delivery; and Expo, Apple and Google for app distribution and notifications;
• mapping services and libraries, including MapLibre, OpenFreeMap and OpenStreetMap. When an online map loads, the map provider may receive routine connection information such as an IP address;
• professional advisers, regulators or public authorities where disclosure is lawful; and
• a successor organisation if the service is reorganised or transferred.

We do not sell personal information. Some suppliers may process information outside the UK. Where required, we rely on an adequacy decision or approved contractual safeguards and carry out the checks required by UK data-protection law. The primary Community Ready database is hosted in London, but supplier support and subprocessors may operate elsewhere. You can ask us for more information about the safeguard used for a transfer.

Ionmhas Limited and each community controller apply retention periods or criteria that reflect their different responsibilities:

• portal account information is kept while access is active. Access is disabled when the community or Ionmhas Limited confirms that it is no longer required. Limited account, audit and security records may be kept afterwards where needed to protect the service, investigate misuse or establish legal rights;
• contact messages are delivered to the relevant mailbox and are not ordinarily copied into the Community Ready database. The organisation controlling the receiving mailbox decides how long its copy is required;
• a name and phone number or email address supplied with a news or event suggestion are kept only while that suggestion is awaiting review and are automatically erased when it is approved or rejected. The suggestion itself may then remain under the relevant community controller's retention schedule, and approved material may remain as published or archived community content until that community removes it;
• offers and requests for help are not retained as Community Portal submission records. They are delivered to the community's nominated mailbox, where the community must delete or anonymise them when they are no longer needed under its documented schedule;
• notification registrations remain until notifications are disabled, the community is unfollowed, a token is replaced or invalidated, or the registration is deleted;
• app preferences and downloaded offline data remain on the device until refreshed, cleared or the app is removed.

When a community ceases to be a live customer, the community has up to 60 calendar days to download its data. If the service is not resumed and no further payment is received, the community workspace and its active production data are deleted after that 60-day period. Residual copies in protected backups are removed as those backups expire, within a maximum of 90 calendar days after the service ends, and are not used for other purposes.

A limited record may be kept for longer where this is necessary to resolve a complaint, establish or defend legal rights, comply with law or maintain security. Information is not retained indefinitely merely because it might be useful later.

The portal uses strictly necessary cookies to keep authorised users signed in and to protect their sessions. Authentication cookies last for the session or until their configured expiry, and are cleared or invalidated when the user signs out. Community Ready does not currently use advertising cookies, behavioural tracking or analytics cookies on its public website.

The app stores followed and home communities, accessibility choices, an installation identifier, offline map and emergency content, cached community information and an emergency-essentials checklist on the device. This allows the app to remember choices and provide selected information without a connection.

You can turn notifications and location permission on or off in iOS or Android settings. You can also unfollow a community in the app. Clearing the app's data or uninstalling it removes locally stored information from that device.

Apple, Google and Expo may generate app-delivery, interaction, crash or diagnostic information under their own privacy notices. Ionmhas Limited may receive relevant reports to diagnose faults and improve reliability. We do not use app information for advertising or cross-service behavioural tracking.

We use access controls, role-based permissions, encrypted connections, managed authentication, database security rules and restricted administration tools. Platform owners can access community submissions, Forms and community archives when they open a selected community support workspace using password and authenticator verification. Authorised community administrators can access only submissions for their own community and assigned responsibilities.

No online service can guarantee absolute security, so portal users should keep emailed login codes private, sign out on shared devices and tell us promptly if they think an account or submission has been compromised. The Portal Owner also uses a strong password and an authenticator app.

Depending on the circumstances, you may have the right to ask for access to your information, correction, deletion, restriction, portability, or to object to its use. Where processing relies on consent, you may withdraw that consent at any time. These rights are not absolute and an exemption may apply.

For information controlled by Ionmhas Limited, contact office@communityready.co.uk. For a local submission, contact the community controller that received it. Ionmhas Limited will forward or assist with a request concerning community-controlled information in accordance with that community's instructions. Please identify the community and service involved.

You may ask the relevant community controller to delete an individual offer of help, request for help or other submission. Authorised community administrators can delete individual submissions through the Community Ready portal. The community will consider the request under data-protection law and explain if it must retain limited information because a legal requirement or exemption applies.

You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

Community Ready is a general community-information service that may be used by people under 18. Children are not given community-administrator accounts. We do not use children's information for advertising or behavioural profiling.

Information can normally be read without giving a name. Notifications and location are off until the user chooses the relevant feature or device permission. Support forms are sent privately to the community's nominated mailbox, while publishable suggestions remain private until an authorised community administrator reviews them. Children should share only the information needed and ask a parent, guardian or trusted adult for help if they are unsure.

A welfare request may concern a child and may be submitted by somebody else. The relevant community controller is responsible for handling that information fairly, protecting the child's best interests and providing the required privacy information. If consent is used as the lawful basis for an online service offered directly to a child under 13, permission from a person with parental responsibility is required unless a legal exception applies.

Read the shorter, plain-language children, privacy and safeguarding information.

DPIA owner and privacy contact: Adam Finkel-Gates, Director of Ionmhas Limited. He coordinates the Community Ready children's data-protection impact assessment and its reviews. This records ownership of the assessment and does not state that Ionmhas Limited has appointed a statutory Data Protection Officer.

We may update this notice when the service, suppliers or law changes. The latest version will always be published on this page with its updated date. We will use an appropriate additional notice if a change materially affects how personal information is used.