Privacy Policy

This Privacy Policy explains how [Company legal name] (“memberbeam”, “we”, “us”, or “our”) handles personal data. It applies to our website at https://memberbeam.com, our web application at https://app.memberbeam.com, our mobile apps, and related services (together, the “Service”).

memberbeam is membership management software used by associations, clubs, chapters, alumni groups, nonprofits, and community organizations (“Organizations”). Because of how the Service works, our role depends on whose data it is. Please read Section 1 first.

1. Our role: controller or processor

1.1 When we are the controller

We decide how and why personal data is used, and act as the “controller” (or “business” under California law), for:

visitors to our marketing website at https://memberbeam.com;
people who contact us, sign up for our newsletter, book a demo, or attend our webinars;
the administrators, staff, and volunteers who create or use an Organization’s memberbeam account (“Admins”), for account, security, support, and billing purposes; and
business contacts at Organizations, partners, and suppliers.

This Privacy Policy describes how we handle that data.

1.2 When we are a processor

When an Organization uses memberbeam to manage its members, prospects, donors, event attendees, and other contacts (“Members”), the Organization is the controller of that data, and memberbeam is a “processor” or “service provider” acting on the Organization’s instructions. This includes membership records, household and family details, payment history, event registrations and check-ins, wallet passes, emails and SMS messages sent by the Organization, form and survey responses, and signed waivers and consent forms.

For that data, the Organization’s own privacy notice applies, not this Privacy Policy. Our handling of it is governed by our contract with the Organization, including our Data Processing Addendum.

If you are a Member and have a question about your data, or want to exercise your privacy rights, please contact the Organization directly. If you contact us, we will refer your request to the relevant Organization and help them respond.

2. Personal data we collect

2.1 Information you give us

Account information. Name, email address, phone number, password (stored in hashed form), job title or role, and the name of your Organization.
Billing information. Billing contact, billing address, tax identifiers, and subscription details. Card details are collected and stored by Stripe, not by us; we receive only limited information such as card brand, last four digits, and expiry date.
Payment account information. When an Organization connects Stripe or GoCardless, we receive account identifiers, onboarding status, and transaction data needed to run the Service and collect platform fees. Identity verification for those accounts is carried out by Stripe or GoCardless.
Communications. Messages you send us through email, chat, support tickets, surveys, or social media, and the content of calls or meetings where you agree to them being recorded.
Marketing preferences. Newsletter subscriptions, event or webinar registrations, and your communication preferences.

2.2 Information we collect automatically

Device and usage information. IP address, browser type and version, operating system, device identifiers, pages viewed, links clicked, referring URL, and the date and time of visits.
Product usage. How Admins use features of the Service, such as which screens they visit and which actions they take. We use this to improve the Service and help customers succeed.
Diagnostic data. Error reports, crash logs, and performance data from our web application and mobile apps.
Cookies and similar technologies. See our Cookie Policy.

2.3 Information from third parties

Payment providers. Stripe and GoCardless send us information about subscription payments, connected account status, and transactions.
Integrations. If an Organization connects QuickBooks Online, Xero, Zapier, or another integration, we receive data from that service as instructed by the Organization.
Single sign-on. If you sign in with a third-party identity provider, such as Google or Apple, we receive your name, email address, and a unique identifier.
Business sources. We may receive business contact information from partners, event organizers, or public sources, such as an Organization’s public website.

2.4 Information we do not want

Please do not send us sensitive information, such as health information, government identification numbers, or financial account numbers, through support channels unless we specifically ask for it.

3. How we use personal data

We use personal data for the following purposes. Where the GDPR or UK GDPR applies, we have listed the legal basis we rely on.

Purpose	Examples	Legal basis
Providing the Service	Creating accounts, authenticating Admins, running features, processing subscription payments	Performance of a contract
Billing and collecting fees	Invoicing subscriptions, collecting platform fees and usage fees, tax compliance	Performance of a contract; legal obligation
Support	Responding to questions, troubleshooting, onboarding help	Performance of a contract; legitimate interests
Security and fraud prevention	Detecting abuse, preventing unauthorized access, enforcing our Acceptable Use Policy	Legitimate interests; legal obligation
Service communications	Account notices, security alerts, billing reminders, changes to terms	Performance of a contract; legitimate interests
Improving the Service	Analyzing usage trends, diagnosing errors, developing new features	Legitimate interests
Marketing	Newsletters, product updates, webinar invitations	Consent, or legitimate interests where permitted by law
Website analytics	Understanding how visitors use our website	Consent, where required by law; otherwise legitimate interests
Legal and compliance	Responding to legal requests, keeping records, defending claims	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing.

3.1 AI features

The Service includes optional AI features that help Admins draft content and summarize information. When an Admin uses an AI feature, the relevant input is sent to our AI provider to generate a response. Output is presented to the Admin to review before use. We do not use Customer Data or Admin inputs to train third-party AI models, and our AI providers are contractually prohibited from using them to train their models.

3.2 No sale, no advertising use of Member data

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We never use Member data to advertise to Members or to anyone else.

3.3 Automated decision-making

We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

We share personal data only as described below.

Sub-processors and service providers. We use trusted providers for hosting, email delivery, payments, error monitoring, analytics, support, and similar services. They may process personal data only on our instructions and under contracts that require them to protect it. Our current list is at Sub-processors.
Organizations. If you are an Admin, your name, email, and activity in the Service may be visible to other Admins of the same Organization.
Payment providers. We share information with Stripe and GoCardless as needed to process payments, onboard connected accounts, collect fees, and prevent fraud.
Integrations you enable. When an Organization connects an integration, we share data with that service as the Organization directs.
Apple and Google. When an Organization issues wallet passes, pass content and push registration data are shared with Apple or Google so that passes can be delivered and updated.
Professional advisors. Lawyers, accountants, auditors, and insurers, under confidentiality obligations.
Legal requirements. Where we believe disclosure is required by law, regulation, or valid legal process, or is necessary to protect the rights, property, or safety of memberbeam, our customers, or others. We review requests carefully and push back on requests that are overly broad or lack a valid legal basis.
Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations. We will notify you if your personal data becomes subject to a different privacy policy.
With your consent. In other cases where you have asked us to, or agreed to it.

5. Wallet passes

Organizations can issue membership cards and event tickets as Apple Wallet and Google Wallet passes. When a Member adds a pass to their device, the device registers with our servers so that the pass can be updated, for example when a membership is renewed. To do this, we process the pass’s serial number, a device library identifier, and a push token, along with the information shown on the pass. We use this data only to deliver and update passes on behalf of the Organization.

Members can remove a pass from their wallet at any time, which stops further updates to that device. Information already displayed on a pass may remain on the device until the pass is removed.

6. Digital waivers and signatures

Organizations can ask Members to electronically sign waivers, releases, and consent forms, including a parent or guardian signing on behalf of a minor. When a document is signed, memberbeam stores, on behalf of the Organization, the signed document and an audit trail that may include the signer’s name, any signature image or typed signature, the date and time of signing, IP address, device and browser information, and the version of the document that was signed.

memberbeam processes this information as a processor for the Organization, which decides what documents to collect and how long to keep them. Questions about a signed waiver should be directed to the Organization that requested it.

7. International data transfers

memberbeam operates internationally. Organizations’ data is hosted on Amazon Web Services in either the United States or the European Union, depending on the region selected for their account. Some of our sub-processors process data in other countries, as listed on our Sub-processors page.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been found to provide adequate protection, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, and, where available, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. We also take reasonable steps to ensure transfers from Australia, Canada, New Zealand, and other jurisdictions comply with local law. You can request a copy of the relevant safeguards by contacting privacy@memberbeam.com.

8. How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in this policy, unless a longer period is required or permitted by law.

Account data is kept for as long as the account is active and for up to 30 days afterward to allow data export, then deleted from active systems within a further 30 days and from backups within 35 days after that.
Billing and tax records are kept for as long as required by tax and accounting laws, typically seven years.
Support communications are kept for up to three years after the conversation ends.
Marketing data is kept until you unsubscribe or ask us to delete it, after which we keep a minimal record so that we respect your choice.
Website analytics data is kept for up to 24 months.
Security and system logs are generally kept for up to 12 months.

Member data that we process on behalf of Organizations is retained and deleted according to the Organization’s instructions and our Data Processing Addendum.

9. How we protect personal data

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit and at rest, role-based access controls, multi-factor authentication for staff, logging and monitoring, regular backups, and vendor security reviews. A summary of our security measures is in Annex 2 of our Data Processing Addendum.

No method of transmission or storage is completely secure. If you believe you have found a security vulnerability, please report it to security@memberbeam.com.

10. Your choices

Marketing emails. You can unsubscribe at any time using the link in any marketing email or by contacting privacy@memberbeam.com. We will still send you service messages about your account.
Cookies and analytics. You can manage non-essential cookies through our cookie banner or settings, and through your browser. See our Cookie Policy.
Account information. Admins can update their profile information in the Service.
Mobile app permissions. You can manage permissions for the camera, location, Bluetooth, NFC, and notifications in your device settings. Some features, such as QR check-in, badge printing, and Tap to Pay, may not work without them.

11. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

to know what personal data we hold about you and to receive a copy;
to correct inaccurate personal data;
to delete your personal data;
to receive your personal data in a portable format;
to object to or restrict certain processing;
to withdraw consent at any time, where we rely on consent;
to opt out of the sale or sharing of personal data, or targeted advertising (we do not do either); and
to complain to a data protection authority.

To exercise these rights, contact privacy@memberbeam.com. We will respond within the time required by law, usually within 30 days (or 45 days where California law applies). We may need to verify your identity before responding. You may use an authorized agent to make a request where the law allows it, and we may ask for proof of the agent’s authority. We will not discriminate against you for exercising your rights.

If your request concerns Member data held by an Organization, we will forward it to that Organization.

11.1 European Economic Area, United Kingdom, and Switzerland

The GDPR, UK GDPR, and Swiss data protection law give you the rights listed above. You can lodge a complaint with your local supervisory authority, such as the Information Commissioner’s Office in the UK. We would appreciate the chance to address your concern first, so please contact us at privacy@memberbeam.com.

11.2 California and other US states

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), and to residents of other US states with similar laws.

In the last 12 months, we have collected the following categories of personal information, for the business purposes described in Section 3:

Category	Examples	Disclosed for a business purpose to
Identifiers	Name, email address, IP address, account ID	Service providers, payment providers
Customer records	Phone number, billing address, limited payment card details	Service providers, payment providers
Commercial information	Subscription plan, purchase and billing history	Service providers, payment providers
Internet or network activity	Pages viewed, product usage, diagnostic data	Service providers
Geolocation data	Approximate location derived from IP address	Service providers
Audio or electronic information	Recorded calls or meetings, where you agree	Service providers
Professional information	Job title, organization name	Service providers

We do not collect sensitive personal information for the purpose of inferring characteristics about you. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.

11.3 Australia

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). You can request access to or correction of your personal information by contacting privacy@memberbeam.com. If you are not satisfied with our response to a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

11.4 Canada

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. Our privacy contact, who is accountable for our compliance, can be reached at privacy@memberbeam.com. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

11.5 New Zealand

We handle personal information in accordance with the Privacy Act 2020. You can request access to or correction of your personal information by contacting privacy@memberbeam.com. You can also contact the Office of the Privacy Commissioner at privacy.org.nz.

12. Children

The Service is not directed to children, and we do not knowingly allow anyone under 16 to create an account as an Admin. If we learn that we have collected personal data from a child under 16 in our role as controller, we will delete it.

Organizations may store information about minors in the Service, for example as part of a family or household membership, or when a parent or guardian signs a waiver for a child. In those cases the Organization is responsible for obtaining any required consent from a parent or guardian, and memberbeam processes the data only on the Organization’s behalf.

13. Third-party links and services

Our website and the Service may link to third-party websites and services, such as Stripe, Apple Wallet, Google Wallet, and accounting integrations. Their privacy practices are governed by their own policies, and we are not responsible for them.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy here and change the date at the top. If changes are material, we will notify Admins by email or through the Service before they take effect.

15. Contact us

For questions about this Privacy Policy, or to exercise your rights, contact us at:

[Company legal name] [Registered address] Email: privacy@memberbeam.com

For security issues, contact security@memberbeam.com.