Craft Connect Privacy Notice
Notice version: 2026-11-11-bd6d4a73014d
About Craft Connect
Craft Connect is an Adair Club initiative helping brethren find lodge meetings, plan visits, connect with one another, exchange messages and arrange companions and shared lifts. It is a web app accessed through a link, rather than through general app stores. It can also be added to a phone’s Home Screen.
A public link, including one on the Adair Club website, does not grant member access. The initial pilot is invitation-only: 13 invited testers, one reserved place and a separate member/admin account for Michael. Pilot access ends after 30 November 2026 GMT. A wider rollout will require updated arrangements before it begins.
Who is responsible for your information
The Adair Club is the data controller for Craft Connect: it is responsible for deciding why members’ information is used, the rules for its use and how members’ rights are respected. Michael Beasley operates the service as data processor, acting on the Club’s documented instructions.
Craft Connect follows the Adair Club’s privacy arrangements. The Club’s published website Privacy Policy refers to the Somerset Provincial policy. This notice supplements those website policies with the information specific to Craft Connect; sharing a policy does not by itself transfer controller responsibility to the Province.
For support, privacy questions or requests to leave, contact craftconnectadmin@gmail.com. Michael currently manages this mailbox on the Club’s behalf. His personal member account and the separate technical-owner account are not the public support contact.
Registration and membership approval
You must use the email address invited for the pilot, confirm control of it and complete registration. We record the Privacy Notice version you acknowledge and the time of acknowledgement. Reading and acknowledging this notice is not consent to processing under data-protection law.
Authorised membership staff check eligibility and an authorised administrator records the approval decision. Checks, their source and the decision are recorded. A check based on personal knowledge is recorded as such, rather than described as independent verification. This process does not depend on Michael personally approving every future applicant: additional approvers may act only when properly authorised.
An invitation, confirmed email or password alone does not grant protected access. Member access opens only after approval and may be suspended or withdrawn. Staff permissions are separate from ordinary member permissions and limited to their authorised tasks.
What information we use and why
We use your name, email address and lodge details to identify your account and check eligibility. We also use membership decisions, account and security records, Privacy Notice acknowledgements and the visiting plans, connections, messages, private notes, lift arrangements, optional representative claims, feedback and support information you choose to provide.
Invitations use contact details you supplied or already provided through contact with the pilot organiser. If your details came from someone else, your invitation will identify the source.
Our lawful basis is legitimate interests: providing the optional invited service, checking eligibility, keeping access secure and evaluating the pilot. We use only what is needed for those purposes. Membership decisions are made by authorised people, not solely by an automated system.
Please do not put identity documents, health information, religious beliefs or other sensitive personal details about yourself or others into profiles, messages, notes, lift arrangements, feedback or support correspondence. These details are not required for the pilot.
Your optional member profile can include your Mother Lodge, additional Craft lodge memberships and current lodge office. These are self-declared and do not replace membership checks. Your existing profile-discovery and visit-sharing choices continue to apply. You can also choose to include external Craft lodge memberships, offices held in each lodge and other Masonic orders; these follow your existing profile visibility choice. For higher-title requests, authorised administrators record the request, their decision and an audit record, kept under the periods below.
Who can see your information
Approved members see information according to the feature and your sharing choices. Private messages are available to the conversation participants. Private notes are restricted to your account within the app. Authorised staff may access information where necessary for their assigned membership, support, security, privacy or recovery duties, with access limited to what is needed. Being an approver does not itself entitle someone to read private conversations or notes.
Automated activity emails are off. Firebase sends secure account emails; invitations and ordinary support use craftconnectadmin@gmail.com. We ask you not to email passwords, sign-in links, identity documents or sensitive personal details. Contact us first to arrange a suitable route for detailed privacy disclosures.
Google services and international processing
Google provides Firebase hosting and authentication and the feedback form. The pilot Firestore database is in London. Firebase Authentication processes sign-in information in the United States. Covered transfers to certified Google LLC use the UK–US data bridge. Hosting, feedback and support may involve other international processing; restricted transfers outside that coverage require applicable adequacy or contractual safeguards. Ask craftconnectadmin@gmail.com for information or a copy of the applicable safeguards.
The support mailbox uses free Gmail. Google LLC acts as a separate controller under its consumer terms and Privacy Policy for information it processes through that service, including email content and service information. Gmail correspondence is not guaranteed to stay in the UK.
Sign-in and storage on your device
Firebase manages email verification, passwords, sign-in and password recovery. Essential browser or device storage keeps your session and app settings. An installed Home Screen app can have a separate session from your browser. You can sign out within Craft Connect. Your access remains subject to approval, suspension and the pilot cutoff, regardless of how you sign in.
How long we keep your information
- Expired invitations and unused provisional accounts are removed within seven days of invitation expiry.
- Declined or withdrawn applications and accounts are removed within 30 days of the decision or withdrawal. If you leave after joining, access is closed first. Eligible account and activity data is deleted or irreversibly anonymised within 30 days of departure or pilot end, whichever comes first.
- Where another participant still needs a shared message or lift record, we keep only what is necessary and remove identifying details where possible. Minimal, restricted security or decision evidence is kept for up to 90 days after the decision or incident closes, unless a documented legal or security need requires longer.
- Routine support and privacy emails are deleted within 30 days of closing the case, except where a documented legal or security need requires limited retention. Identifiable pilot feedback follows the pilot-end deletion period above.
- Managed backups expire seven days after the snapshot. Deleted information in a backup is kept out of routine use. Before reopening restored data, we reapply deletions and withdrawals.
Your rights and how to contact us
Email craftconnectadmin@gmail.com to request access, correction, deletion or restriction, or to ask about portability where it applies. We check your identity through a channel we already trust. You can object to processing based on legitimate interests at any time. Taking part is optional, and you can ask to leave. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/.
Related website policies: https://www.adairclub.com/privacy-policy/ and https://www.somersetfreemasons.org/privacy-policy/. This notice explains Craft Connect’s own processing; those website policies are not a substitute for it.