Privacy Policy

Introduction

We value your privacy and are committed to protecting your personal data in compliance with Cyprus and EU data protection law, in particular the General Data Protection Regulation (GDPR). This privacy policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have when you use the MemberArea platform and our website.

Scope

This policy applies to our marketing website, the MemberArea application and all related services (together, the “Service”). Where you use a MemberArea workspace operated by a business customer, that customer is the controller for the personal data processed inside their workspace; in that case we act as a processor on their behalf and our processing is governed by our Data Processing Agreement. This policy describes the processing for which we ourselves are the controller, for example our website, account sign-up, billing and support.

Data Controller

The data controller responsible for the processing described in this policy is:

Contact Email: support@memberarea.io

Data Protection Officer

We are not legally required to appoint a Data Protection Officer and have not done so. For any privacy-related question you can reach us at the email address above; we will route your request to the responsible person internally.

Categories of Personal Data We Collect

Depending on how you interact with us, we collect the following categories of personal data:

• Identification and contact data: name, email address, and any details you provide when creating an account or contacting us.
• Account and profile data: login credentials (stored only as salted hashes), profile settings, language and locale, and workspace membership.
• Billing and payment data: invoicing details, plan and subscription history, and payment identifiers. Full card numbers are never stored by us; card data is handled by our payment provider.
• Usage and log data: IP address, browser type and version, device and operating system, pages viewed, referring URL, timestamps and event data, collected to operate and secure the Service.
• Content you create: posts, messages, files, images, videos, course progress and other material you upload to the Service.
• Support and communication data: the content of emails, contact-form messages and support tickets you send us.
• Cookies and similar technologies: see the Cookies section below.

How We Use Your Data and the Legal Basis

We process personal data only where we have a lawful basis under Art. 6 GDPR. The main purposes and their legal bases are:

• To provide, operate and maintain the Service, and to manage your account: performance of a contract (Art. 6(1)(b) GDPR).
• To process payments, issue invoices and prevent payment fraud: performance of a contract and compliance with a legal obligation (Art. 6(1)(b) and (c) GDPR).
• To provide customer support and respond to your enquiries: performance of a contract and our legitimate interest in helping users (Art. 6(1)(b) and (f) GDPR).
• To secure the Service, detect abuse and keep audit logs: our legitimate interest in the security and integrity of the platform (Art. 6(1)(f) GDPR).
• To analyse aggregated usage and improve the Service: our legitimate interest in developing our product (Art. 6(1)(f) GDPR).
• To send marketing communications: only on the basis of your consent, which you can withdraw at any time (Art. 6(1)(a) GDPR).
• To comply with tax, accounting and other legal obligations: compliance with a legal obligation (Art. 6(1)(c) GDPR).

Sub-Processors and Data Sharing

We do not sell your personal data. We share personal data with carefully selected service providers (sub-processors) who process it on our behalf, only as needed to run the Service, and under data processing agreements that include GDPR-standard safeguards. The current sub-processors are:

We may also disclose personal data to public authorities or courts where we are legally required to do so, and to professional advisers or to an acquirer in the context of a merger, acquisition or sale of assets, in each case subject to appropriate confidentiality safeguards.

Connected online shops

If a customer connects an online shop such as Shopify to their workspace, that shop sends us data about its orders and its customers so we can unlock the access that was bought. We act as a processor for our customer here. We store the order, the link between the shop customer and the member, and the notifications the shop sent us. Those notifications contain personal data and are stored encrypted.

We answer the requests the shop platform passes on to us. A data request is recorded and forwarded to the workspace owner, who is the controller for that data. A request to delete a shop customer removes the link and the stored notifications about that person. The member account itself is not deleted by us, because it belongs to the contractual relationship between our customer and their member. When a shop is disconnected and its data is requested to be deleted, we remove the links, the product mappings and the notifications of that shop; orders and members remain with the workspace that they belong to.

Free browser tools (camera, microphone, screen)

Our free tools under /free-tools let you record your camera, your microphone or your screen, cut a video and export it. These tools run entirely in your browser. Picture and sound are never transmitted to us, never stored on our servers and never passed to a third party. There is no upload, no account and no processing on our side. The finished file is written directly to your device's downloads folder.

Access to camera, microphone or screen is requested by your browser, not by us, and only after you have chosen what you want to record. You can withdraw that permission at any time through the padlock icon in your browser's address bar or in your browser settings. Withdrawing it does not affect any recording you have already downloaded, because that file only exists on your device.

Because nothing is transmitted, we have no personal data from these tools to disclose, correct or erase. Should you nevertheless contact us about them, we will process your message under the same rules as any other enquiry.

The recording and editing tools deliberately store nothing about you in your browser. Your camera and microphone choice, your recorder settings and any edit in progress are kept in memory only and are gone when you close the tab. This is why they need no consent for storage.

A few entries do remain in your browser, and each of them is needed for a tool or for the site to work at all. You can remove them at any time by clearing the site data in your browser. Most of them never leave your device. The exception is your cookie choice: when you save it, we receive the choice itself, the random identifier listed below, the address of the page you were on and a one way hash of your IP address, so that we can later show what was decided and when.

• ma_lang_v2:*: the cached interface texts for your language, so that pages load faster.
• maio_consent_*: your own cookie choice, so that we do not ask again on every page.
• maio_consent: the same choice again as a cookie, so that our server already knows it with the very first page you open.
• maio_anon_*: a random identifier for your browser, without a name, an address or an email address. It is sent to us together with your cookie choice so that several decisions from the same browser belong together.
• ma_free_*, ma_thumb_studio_v1: the draft you are working on in the curriculum builder, the certificate designer or the thumbnail designer, so that it is still there when you come back. Only your own work, never anything about you.

Payments

Payments are processed by Stripe Payments Europe, Ltd. and its group companies. When you pay, your card data is transmitted directly to Stripe and is not stored on our servers. Depending on the context, Stripe acts as an independent controller or as a processor; its handling of your data is additionally governed by Stripe's own terms and privacy policy.

International Transfers

We host and process personal data primarily within the EU/EEA. Where a sub-processor processes data outside the EU/EEA, for example email delivery in the United States, we ensure an appropriate transfer mechanism is in place, such as an EU Commission adequacy decision or the EU Standard Contractual Clauses (SCCs), supplemented with additional technical and organisational measures where required.

Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or for as long as required by law. Typical retention periods are:

• Account data: kept for the lifetime of the account and deleted within 90 days after the account is closed (residual copies in encrypted backups expire shortly afterwards).
• Content you create: kept until you delete it or your workspace is closed, then hard-deleted within 90 days.
• Support records: retained for up to 24 months after a request is resolved.
• Security and audit logs: retained for 12 to 24 months depending on the log type.
• Billing, invoicing and tax records: retained for at least 6 years to meet statutory accounting obligations under Cyprus law.

Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encryption in transit (TLS/HTTPS) and at rest, role-based access control following the principle of least privilege, multi-factor authentication for privileged accounts, strict tenant separation, monitoring, audit logging and regular security reviews. No system can be guaranteed completely secure; we continuously work to improve our safeguards.

Your Rights

Subject to the conditions of the GDPR, you have the right to access your personal data, to have inaccurate data rectified, to have data erased, to restrict or object to processing, and to data portability. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at the email address above. We will respond within one month; this period may be extended by up to two further months for complex requests, in which case we will inform you. We may ask for additional information to verify your identity before acting on a request.

Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service and understand how it is used. Strictly necessary cookies are required for the Service to function. For non-essential cookies we obtain your consent where the law requires it. You can control or delete cookies through your browser settings, and withdraw any consent at any time; disabling strictly necessary cookies may affect how the Service works.

If you accept marketing cookies, we load the Meta Pixel on our website. It sets the cookies _fbp and _fbc, records which pages you opened and whether you created an account, and sends this to Meta Platforms Ireland Ltd. so that we can measure our ads and show you relevant ads on Facebook and Instagram. For the same purpose we also send the signup event to Meta from our server (Conversions API), with your email address and name transmitted only as an irreversible hash. Nothing of this happens without your consent, and withdrawing it stops the transmission and deletes the two cookies.

Children's Privacy

The Service is intended for business use and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy). You may also contact the supervisory authority in your country of residence or place of the alleged infringement.

Personal Data Breaches

We maintain procedures to detect, assess and respond to security incidents. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where the risk is high, the affected individuals, in line with Art. 33 and 34 GDPR.

Changes to this Policy

We may update this privacy policy from time to time to reflect changes to the Service or to legal requirements. Material changes will be posted on this page with an updated effective date; where appropriate we will also notify you directly.

Effective Date

This policy is effective as of 19 October 2026.

Contact

For any question about this policy or our handling of your personal data, please contact us at support@memberarea.io.