Effective Date: February 10, 2026
Last Updated: February 10, 2026
Community X ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our platform.
This policy is governed by the applicable data protection laws of the Arab Republic of Egypt, including the Egyptian Personal Data Protection Law No. 151 of 2020.
1. Data Controller
Community X
Cairo, Egypt
Email: support@joincommunityx.com
2. Information We Collect
2.1 Information You Provide
- Account Information: Full name, email address, Egyptian mobile phone number, password
- Profile Information: Job title, company, bio, location, avatar/photo
- Professional Tags: Industry tags (up to 3), skill tags (up to 10)
- Payment Information: Payment method details are processed by Paymob; we store transaction IDs, order IDs, payment status, and amounts
- Booking Information: Space bookings, dates, times, cancellation reasons
- Communications: Messages sent through the AI concierge, contact form submissions (name, email, profession, reason)
- Connection Data: Connection requests sent and received, accepted connections
2.2 Information Collected Automatically
- Authentication Cookies: Session tokens and refresh tokens managed by Supabase Auth
- Usage Data: API request logs, rate-limiting counters (stored temporarily in memory)
- Payment Audit Logs: Payment status changes with timestamps
2.3 Information Generated by AI
- Member Suggestions: AI-generated connection recommendations based on shared industries, skills, mutual connections, and location proximity
- Suggestion Explanations: One-sentence explanations generated by AI describing why a member was suggested
- Chat Responses: AI-generated responses to your questions about the platform
3. How We Use Your Information
We use your personal data for the following purposes:
- Account creation and authentication — Legal basis: Performance of contract
- Processing workspace bookings and payments — Legal basis: Performance of contract
- Managing hour bundles and subscriptions — Legal basis: Performance of contract
- Displaying your profile to other members — Legal basis: Legitimate interest (community networking)
- Sending connection requests and recommendations — Legal basis: Legitimate interest (community networking)
- Generating AI-powered member suggestions — Legal basis: Legitimate interest (enhancing user experience)
- Providing AI concierge chat support — Legal basis: Legitimate interest (customer support)
- Sending booking confirmations and payment receipts — Legal basis: Performance of contract
- Enforcing no-show and cancellation policies — Legal basis: Legitimate interest (fair platform usage)
- Fraud prevention and security — Legal basis: Legitimate interest (platform security)
- Responding to contact form inquiries — Legal basis: Legitimate interest (customer support)
- Platform administration and analytics — Legal basis: Legitimate interest (service improvement)
4. Third-Party Services and Data Sharing
We share your data with the following third-party service providers, solely for the purposes described:
4.1 Supabase (Database and Authentication)
- Data shared: All account and profile data, bookings, connections, chat messages
- Purpose: Database hosting, user authentication, data storage
- Location: Cloud-hosted infrastructure
- Website: supabase.com
4.2 Paymob (Payment Processing)
- Data shared: Full name, email, phone number, payment amounts
- Purpose: Processing card and wallet payments, refunds
- Location: Egypt
- Website: paymob.com
4.3 Google Generative AI (Gemini)
- Data shared: Profile information (name, job title, company, industries, skills, bio, location) for matched members; chat messages
- Purpose: Generating member connection explanations, powering AI concierge
- Retention by Google: Subject to Google's AI data processing terms
- Website: ai.google.dev
4.4 Resend (Email Service)
- Data shared: Email address, name, booking/payment details for transactional emails
- Purpose: Sending booking confirmations, payment receipts, admin notifications
- Website: resend.com
4.5 Payload CMS (Content Management)
- Data shared: Contact form submissions
- Purpose: Content management and form submission storage
- Website: payloadcms.com
We do not sell your personal data to any third party.
5. Cookies and Tracking
5.1 Essential Cookies
We use essential cookies for authentication and session management. These are required for the platform to function and cannot be disabled.
- Supabase session token: Maintains your login session (duration: session/refresh-based)
- Supabase refresh token: Refreshes your session without re-login (duration: as set by Supabase Auth)
5.2 No Tracking or Marketing Cookies
We do not use any advertising, analytics, or tracking cookies. We do not use third-party trackers such as Google Analytics, Facebook Pixel, or similar services.
6. Data Retention
- Account and profile data: Until account deletion or as required by law
- Booking records: Retained for financial record-keeping as required by Egyptian law
- Payment records and audit logs: Retained for 5 years per Egyptian tax and commercial regulations
- Chat messages: Retained for the lifetime of your account
- AI suggestion cache: Automatically expires after 24 hours
- Rate-limiting data: Stored in memory only; cleared on server restart
- Connection data: Until you remove the connection or delete your account
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption: All data transmitted between your device and our servers is encrypted using TLS/HTTPS.
- Authentication: Passwords are hashed using Supabase Auth's secure hashing algorithms. We never store plaintext passwords.
- Access control: Row-Level Security (RLS) policies ensure users can only access their own data. Administrative access requires explicit role verification.
- CSRF protection: Cross-site request forgery protections are enforced on all state-changing requests.
- Rate limiting: API endpoints are rate-limited to prevent abuse and brute-force attacks.
- Payment security: Payment webhook signatures are verified using HMAC to prevent tampering.
8. Your Rights
Under Egyptian data protection law, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Rectification: Correct inaccurate or incomplete personal data via your profile settings
- Erasure: Request deletion of your account and associated personal data
- Restriction: Request that we limit the processing of your data in certain circumstances
- Objection: Object to the processing of your data for certain purposes
- Portability: Request your data in a structured, commonly used format
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, please contact us at support@joincommunityx.com. We will respond to your request within 30 days.
9. Children's Privacy
Community X is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child's data has been collected, we will take steps to delete it promptly.
10. International Data Transfers
Your data may be processed by third-party service providers located outside of Egypt (e.g., Supabase, Google, Resend). Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable Egyptian law.
11. AI-Specific Disclosures
11.1 Member Suggestions
- Your profile data (name, job title, company, industries, skills, bio, location) may be sent to Google's Gemini AI to generate personalized connection explanations.
- This processing is automated; no human reviews individual AI requests.
- You can identify AI-generated content by the indicators shown in the interface.
- If AI processing fails, the system falls back to algorithmic reasons that do not involve external AI services.
11.2 AI Concierge Chat
- Messages you send to the AI concierge are processed by Google's Gemini AI.
- Chat messages are stored in our database and associated with your account (if logged in).
- The AI concierge does not make decisions that produce legal effects or significantly affect you.
11.3 Automated Decision-Making
- AI-generated member suggestions are recommendations only and do not restrict your access to other members.
- No automated decisions are made that have legal or similarly significant effects on you.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a notice on the platform. Your continued use of the platform after such changes constitutes your acceptance of the updated policy.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: support@joincommunityx.com
Platform: Community X
