Who we are
MemberPress.ai is built and operated by Caseproof, LLC, the company behind MemberPress. This notice covers memberpress.ai and the MemberPress.ai plugin running on any WordPress site you connect. For anything in this notice, write to legal@memberpress.ai.
Two hats: whose data, whose rules
We handle personal data in two different roles, and your rights run through different doors depending on which one applies to you:
- Visitors and account holders. If you browse this site, contact us, or sign up for a MemberPress.ai account, we decide how and why your data is used — in GDPR terms, we are the controller, and this notice is addressed to you.
- Members of a connected site. If your data reached us because a site you belong to connected itself to MemberPress.ai, the owner of that site is the controller and we act as their processor. The section "Members of a connected site" below is for you.
Visitors to this website
Analytics
We use Cloudflare Web Analytics to count visits to this marketing site. It records the page path, the referring page, and broad device characteristics (browser, operating system, country). It sets no cookie, stores nothing in your browser, and collects no identifier — we cannot tell one visitor from another, and we don't try. Cloudflare processes these measurements for us as a service provider. Our lawful basis is our legitimate interest in knowing whether the site works and which pages people read. Cloudflare retains the aggregate measurements for [TBD — Cloudflare's written retention position for Web Analytics].
Because these measurements contain no identifier, we cannot link them back to you, and GDPR does not require us to collect extra data just to make that possible (Article 11). In practice this means access, deletion, and portability requests cannot be applied to analytics data — there is nothing of yours in it to find.
One promise that follows: we do not place this analytics beacon on any page whose URL carries a token or identifier, and we do not encode people or accounts into marketing URLs.
Cookies and local storage
The marketing site uses functional, first-party mechanisms only: a session indicator set when you're logged in, so this site can show "open the app" instead of "sign up," and a small amount of localStorage for display preferences that never leaves your browser. There is no advertising, no third-party tracking, and no cross-site anything.
Bot protection
Our connect and contact forms use Cloudflare Turnstile to tell humans from bots. Turnstile runs a check in your browser when those forms load; Cloudflare processes the signals needed to make that call, on our behalf.
The contact form
When you write to us through the contact form we collect your email address, your message, and — if you give them — your name and a subject line. We use it to reply, and for nothing else. Once your request is resolved, the submission is automatically deleted 90 days after resolution.
Account holders
Your account
Signing up collects your email address and a password, or — if you choose "Continue with Google" — Google tells us your email address and basic profile instead. We use this to run your account, and it's needed to perform our contract with you.
Connecting a site
When you connect a WordPress site, you authorize us to install the plugins you approve — including free MemberPress, if your site doesn't already have it — and the MemberPress.ai plugin. Installing uses a site credential that exists only for the length of that installation: it's encrypted, used once, and discarded automatically when the install finishes, whether it succeeds or fails. Once installed, the plugin running on your own site works with your business data — members, revenue, subscriptions, and content — to power the advisor. This is the substance of the service; see "How long we keep things" for what happens when you disconnect.
Chats and advisor memory
Your conversations with the advisor are stored so you can return to them, alongside the plugin on your own site. The advisor also keeps a business profile for the site, and notes and conclusions it records about your business across sessions, to make it useful over time. Neither your conversations nor your site's content are used to train AI models (see "Our commitments" in the Terms of Service).
Billing
Paid billing runs through Stripe. We send Stripe your email address; the checkout and billing pages where you enter card details are operated by Stripe, so your payment details go to Stripe directly and never touch our servers.
We send transactional email (receipts, connection alerts, account notices) via Resend. If you email support or legal@memberpress.ai, we keep the correspondence as long as we need it to help you.
Members of a connected site
If you're a member of a membership site and that site's owner connected it to MemberPress.ai, the plugin on that site holds your email address, name, and your membership, transaction, and subscription records and engagement activity from that site. It's processed only on the site owner's instructions, to give them insights about their own business — the site owner is the controller of that data, and we are their processor.
That means your privacy rights over this data — access, correction, erasure — run through the site owner, not through us. Contact the site you're a member of; when they act on your request, we carry it out. Our data processing agreement with site owners is available on request via legal@memberpress.ai.
Who else touches your data
Sub-processors currently in use are named throughout this notice: Stripe (billing), Resend (transactional email), and Cloudflare (analytics and bot protection). As the product matures we'll publish a single canonical, dated list rather than let this notice and that list drift apart.
How long we keep things
| Data | How long |
|---|---|
| Contact-form submissions | Deleted automatically 90 days after your request is resolved. |
| Site installer credential | Exists only for the length of the installation. Encrypted, used once, and discarded automatically on completion — never retained afterward. |
| Business data (members, transactions, subscriptions, content) | Processed by the MemberPress.ai plugin on your own WordPress site. It does not leave your site as part of normal operation. If you connect your own AI assistant, it reads this data directly from your site over your own authorized connection — not through memberpress.ai's servers. |
| Chat transcripts and advisor memory | Stored on your own site alongside the plugin, for as long as the plugin remains installed and connected. Deleted when you disconnect or uninstall it. |
| Account and billing data (email, connected-site list, subscription status) | Kept while your memberpress.ai account exists. See "Your rights" for deletion. |
| Analytics measurements | [TBD — Cloudflare's written retention position]; contain no identifier either way. |
Two things stated plainly, because they surprise people: disconnecting a site is not deleting your account — your account and billing data stay with you, as the in-app disconnect screen also tells you. And there is no self-serve delete-account button yet: to delete your account, email legal@memberpress.ai and we handle it through support.
Where your data lives
MemberPress.ai's account and billing infrastructure runs in the United States, on the same Google Cloud footprint Caseproof uses for its other products. If you're in the EU/EEA or UK, your account data is transferred to the US; where the law requires it, those transfers are covered by Standard Contractual Clauses with our vendors. [TBD — confirm executed SCC/DPA coverage per vendor before this sentence is published unqualified.] Your site's business data, processed by the plugin itself, stays on your own WordPress hosting.
Your rights
Under GDPR
If GDPR applies to you, you have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive a portable copy. Email legal@memberpress.ai and we'll act on it — including full account deletion, which is handled through support today. You can also complain to your local supervisory authority, though we'd rather you gave us the chance to fix it first. The one carve-out: identifier-free analytics data, per the analytics section above — there is nothing in it we could match to you.
Under CCPA
If you're a California resident: the categories we collect are identifiers (name, email), commercial information (billing records, subscription status), and internet activity (the aggregate, identifier-free analytics described above). We collect them for the purposes in this notice, from you directly or from your connected site. We do not sell your personal information and we do not share it for cross-context behavioral advertising — which is why you won't find a "Do Not Sell or Share" link here; there's nothing it would turn off. You have the right to know, to delete, to correct, and to never be discriminated against for exercising any of it. Same email: legal@memberpress.ai.
Children
MemberPress.ai is a business tool. It is not directed at anyone under 16, and we don't knowingly collect their data.
Changes to this notice
When this notice changes, we'll update it here and move the date at the top. If a change meaningfully reduces your rights or expands what we collect, we'll tell account holders directly before it takes effect.
Contact
Caseproof, LLC — legal@memberpress.ai. That mailbox is read by humans who can actually do something about your request.