Privacy, from the start.

What we collect

• Waitlist interest: your email, whether you represent a company, chapter or campus, any organization details you provide, and your signup permission and date. A waitlist submission does not create an account or verify an organization.
• Private beta and accounts: invitation eligibility, verified sign-in identity, profile details, representative role, consent choices and the references you submit for organization review.
• Conversations and support: messages, read status, notification preferences, blocks, reports, review notes and information you send to our support inbox.
• Private test agreements: deal terms and versions, test signer names and roles, verified account references, signature acknowledgments and dates, Common review decisions, test checkout references and status, delivery notes and a history of test actions. Test signatures and payments do not create a real sponsorship or move real money.
• Security and service operation: authentication cookies, browser storage for preferences such as shortlists, and limited technical information needed to provide the service and limit abuse. Waitlist rate limits use hashed identifiers derived from the email and network address.

Please leave out government identifiers, payment-card information, medical information, member rosters and other people’s private details. Common’s organization accounts are intended for authorized representatives who are 18 or older.

How we use it

We use these details to record interest, manage private testing, review organizations and representative authority, support conversations, provide requested notifications and launch updates, and investigate abuse or service problems. We do not sell or rent waitlist email addresses.

Outreach, launch updates and account notifications are different activities. Joining the waitlist gives permission for Common’s launch updates; it does not make your details public or give another organization permission to market to you.

What other people can see

Waitlist records and beta invitations are private to Common’s operator. An organization profile is shared with marketplace viewers only after review and publication permission. During the private beta, marketplace access is limited to admitted testers. At a public launch, published profile details may be visible to public visitors.

Contact email publication is a separate choice. Account emails, private review evidence and ownership identifiers are not part of public profiles. Test agreements and their history are available to their recorded participants and Common’s operator. Removing marketplace beta access does not by itself remove authenticated access to a participant’s own existing test agreement history. Private conversations are available to their participants and may be reviewed by Common’s operator for support, safety, reports or disputes.

Providers that help operate Common

Common uses OpenAI Sites and Cloudflare for hosting and storage; OpenAI and Clerk for supported sign-in methods; Resend for permitted service email; and Google Workspace for our company inbox. Relevant information is processed by these providers to perform those functions. We do not receive or store your sign-in password. If Common’s optional Stripe sandbox is connected, Stripe processes test checkout information. Common sends the saved test amount and agreement/checkout references, and stores payment references and status. Enter only Stripe test payment details on Stripe’s checkout page; Common does not collect card or bank numbers. Common’s local payment simulator does not contact a payment provider. Their own privacy terms also apply to the services they provide.

Keeping and removing information

We keep waitlist information while preparing the launch and managing the interest you have asked us to record. You can ask to stop updates or remove your waitlist details at any time. When an address is opted out, we retain a minimal hashed address and opt-out date to avoid contacting or automatically re-enrolling it.

Account, campaign-related, support and safety records are kept as needed to operate the service, investigate problems and meet applicable obligations. A deletion request may require us to verify your identity, and some records may need to remain for safety, disputes or legal requirements. We will explain relevant limitations when handling your request.

Your choices and requests

We will update this notice when our practices change. This page shows its effective date so you can see which notice is current.