Last updated: 12 October 2026. Contact: legal@memberpress.ai
MemberPress.ai is built and operated by Caseproof, LLC, the company behind MemberPress. This notice covers the marketing site at memberpress.ai, your MemberPress.ai account, and the MemberPress.ai plugin running on any WordPress site you connect. For anything in this notice, write to legal@memberpress.ai.
We handle personal data in two different roles, and your rights run through different doors depending on which one applies to you:
We use Cloudflare Web Analytics to count visits to this marketing site. It records the page path, the referring page, and broad device characteristics (browser, operating system, country). It sets no cookie, stores nothing in your browser, and collects no identifier — we cannot tell one visitor from another, and we don't try. Cloudflare processes these measurements for us as a service provider. Our lawful basis is our legitimate interest in knowing whether the site works and which pages people read. We are confirming Cloudflare's retention period for these measurements in writing and will state it here once we have it.
Because these measurements contain no identifier, we cannot link them back to you, and GDPR does not require us to collect extra data just to make that possible (Article 11). In practice this means access, deletion, and portability requests cannot be applied to analytics data — there is nothing of yours in it to find.
We also use Google Analytics to see how people use this site: which pages they visit, how they arrived, and broad device and location details. Unlike Cloudflare's measurements, Google Analytics uses cookies and an identifier for your browser. Google processes this data for us as a service provider.
Google Analytics does not load until you choose Accept on the banner, and if you choose Decline it never loads. Our lawful basis is your consent. Google's advertising storage stays off, so this data is not used for ads. To change your answer at any time, use Change analytics choice below: it forgets your saved answer and asks again, and if you choose Decline, Google Analytics stops loading on this site. Google's own browser add-on also works.
One promise that follows: we do not place this analytics beacon or Google Analytics on any page whose URL carries a token or identifier, and we do not encode people or accounts into marketing URLs.
The marketing site uses three local-storage keys and reads one cookie, all first-party. It sets no cookies of its own. Google Analytics, when it loads, sets its own cookies (named _ga and _ga_ followed by our property's id).
There is no advertising and no cross-site tracking.
This marketing site has no forms. In the MemberPress.ai app, Cloudflare Turnstile runs on forms such as plugin connect signup, signed-in dashboard contact, and the signed-in report-a-problem dialog to tell humans from bots. When a protected form loads, Turnstile runs a check in your browser; Cloudflare processes the signals needed to make that call, on our behalf.
When you email support@memberpress.ai we receive your email address, your message, and anything you include with it. We use it to reply, and for nothing else; see "Email" below for how long we keep that correspondence.
When you contact us from your dashboard after signing in, your message is tied to your account. We may attach your most recently connected site, if you have one, to help route support, and we store the IP address and User-Agent of that request with the message. It's kept as part of your account data (see "How long we keep things" for messages we can't link to an account).
When you send a report from the signed-in report-a-problem dialog, the message includes your account email, and we also receive the diagnostic report that dialog previews before you send it: your site and which screen you were on; your browser, operating system, language, window size, time zone, and the app version; a reference to the advisor conversation you had open, if any; any error messages the app recorded during that session; and technical details of your recent activity. Those details say which requests were made and whether they succeeded. They do not include the contents of your data or your advisor conversations.
Signing up collects your email address and a password, or — if you choose "Continue with Google" — Google tells us your email address and basic profile instead. We use this to run your account, and it's needed to perform our contract with you.
When you connect a WordPress site, you authorize us to install the plugins you approve — including the free version of MemberPress, if your site doesn't already have it — and the MemberPress.ai plugin. Installing uses a site credential that exists only for the length of that installation: it's encrypted, used once, and discarded automatically when the install finishes, whether it succeeds or fails. Your password never leaves your site. Once installed, the plugin running on your own site works with your business data — members, memberships, transactions, subscriptions, and content — to power the advisor and carry out the work you approve. That data does not stay only on your site: the plugin sends it to our service, which stores it on Google Cloud and sends what the advisor needs to Anthropic to produce its answers (see "Who else touches your data"). This is the substance of the service; see "How long we keep things" for what happens when you disconnect.
Your conversations with the advisor are stored in our database on Google Cloud so you can return to them, and the text of each one is sent to Anthropic to produce the advisor's reply. The advisor also keeps a business profile for the site, and notes and conclusions it records about your business across sessions, to make it useful over time. Neither your conversations nor your site's content are used to train AI models (see "Our commitments" in the Terms of Service).
Paid billing runs through Stripe. We send Stripe your email address; the checkout and billing pages where you enter card details are operated by Stripe, so your payment details go to Stripe directly and never touch our servers.
We send transactional email (receipts, connection alerts, account notices) via Resend. If you email support or legal@memberpress.ai, we keep the correspondence as long as we need it to help you.
If you're a member of a membership site and that site's owner connected it to MemberPress.ai, the plugin on that site sends us a copy of some of your data: your email address, first and last name, and your membership, transaction, and subscription records and engagement activity from that site. We store it in our database on Google Cloud, and parts of it are sent to Anthropic when the advisor needs them to answer the site owner. It's processed only on the site owner's instructions, to give them insights about their own business — the site owner is the controller of that data, and we are their processor.
That means your privacy rights over this data — access, correction, erasure — run through the site owner, not through us. Contact the site you're a member of; when they act on your request, we carry it out: when a member is erased on a connected WordPress site, we erase their name, email address, and engagement data here. We keep payment records with no name or email attached, still keyed to the member's ID on that site. We also keep a one-way code made from their email address, so a later sync cannot add them back. We are finalizing our data processing agreement with site owners; contact legal@memberpress.ai for availability.
These service providers receive personal data from us in order to run MemberPress.ai:
Optional providers are used only if you turn on the feature that needs them, and turning it on is your opt-in: ElevenLabs (voice chat with Opal, the advisor, only when you open and use voice chat: it transcribes your spoken message and reads the advisor's reply aloud; we request zero retention and don't store your recordings), and GitHub (only if you connect our GitHub App (Opal) or sign in with GitHub: the App sends us events about the repositories you choose, such as pull requests, reviews and checks, and receives repository contents and metadata when it opens a pull request on your behalf; sign-in reads your GitHub account's verified email addresses to match it to your existing account).
We have not yet confirmed which company hosts the WordPress sites we set up for you; we will name it here once we have. As the product matures we'll publish a single canonical, dated list rather than let this notice and that list drift apart.
| Data | How long |
|---|---|
| Support emails and in-app contact messages | Emails are kept as long as we need them to help you. Messages sent from your dashboard are kept with your account and deleted when your account is deleted. If your sign-in had expired when you sent it, we can't link the message to your account; it's kept until we resolve it and deleted 90 days after that. |
| Report-a-problem submissions | Technical details are deleted 30 days after you send them, or sooner once we have closed your report. The description you wrote stays with your support history for as long as your account exists. Deleting your account deletes it. If your sign-in had expired when you sent it, we can't link the description to your account; it's kept until we resolve it and deleted 90 days after that. |
| Site installer credential | Exists only for the length of the installation. Encrypted, used once, and discarded automatically on completion — never retained afterward. |
| Business data (members, transactions, subscriptions, content) | Used by the MemberPress.ai plugin on your own WordPress site, and sent to our service, which stores what the advisor needs in our database. No time limit: it is kept until deleted. If you connect your own AI assistant over your site's MCP endpoint, it reads this data directly from your site over your own authorized connection — not through memberpress.ai's servers. |
| Chat transcripts and advisor memory | Stored in our database on Google Cloud. No time limit: they are kept until deleted. |
| Account and billing data (email, connected-site list, subscription status) | No time limit: kept until deleted. See "Your rights" for deletion. |
| Database backups | About 14 days: 14 backups are retained, with 7 days of point-in-time recovery. |
| Logs | Our admin audit log (actions taken on your account) is kept for 365 days, except entries that include an email address or text one of our team wrote, which are deleted after 90 days. The record of what connected AI agents did on your account is kept for 90 days. Records of site connections, and of each write an agent made so it can be undone, are kept until your account is deleted. Application logs are kept for 90 days. Google Cloud's own audit log, which records our team's own access and includes the operator's email address, is kept for 365 days. |
| Voice chat turns and evaluation samples | Voice turns are deleted after 90 days, and no audio is stored. Evaluation samples are deleted after 30 days. |
| Cloudflare analytics measurements | We are confirming the retention period in writing. They contain no identifier either way. |
| Google Analytics data | Kept for the retention period set on our Google Analytics property. We will state it here once the property is live. |
| Records of our staff setting a plan's AI model back to its default (with any note they typed) | Deleted automatically after 90 days. |
Three things stated plainly, because they surprise people: disconnecting a site is not deleting your account — your account and billing data stay with you, as the in-app disconnect screen also tells you. There is no self-serve delete-account button yet: to delete your account, email legal@memberpress.ai and we handle it by hand through support. And there is no self-serve data export either; ask by email.
MemberPress.ai's infrastructure runs in the United States, on Google Cloud in the us-central1 region, and that is where your account, site, member, chat, and billing data is stored. If you're in the EU/EEA or UK, your data is transferred to the US. Where the law requires a transfer mechanism, Standard Contractual Clauses are the intended mechanism. We are verifying executed coverage with each vendor and will state the confirmed position here. For the position on a specific vendor before then, write to legal@memberpress.ai. Your own WordPress site keeps its own copy of its data on your hosting; the copy the plugin sends us is the one stored in the US.
If GDPR applies to you, you have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive a portable copy. Email legal@memberpress.ai and we'll act on it — including full account deletion, which is handled through support today. You can also complain to your local supervisory authority, though we'd rather you gave us the chance to fix it first.
The one carve-out: Cloudflare's identifier-free analytics data, per the analytics section above — there is nothing in it we could match to you.
If you're a California resident: the categories we collect are identifiers (name, email, and the IP address stored with a signed-in dashboard message or report-a-problem submission), commercial information (billing records, subscription status), and internet activity (the site analytics described above, the User-Agent stored with those submissions, and, for a report-a-problem submission, the screen, browser details, and recent-request activity described under "Contacting us"). We collect them for the purposes in this notice, from you directly or from your connected site. We do not sell your personal information and we do not share it for cross-context behavioral advertising — which is why you won't find a "Do Not Sell or Share" link here; there's nothing it would turn off. You have the right to know, to delete, to correct, and to never be discriminated against for exercising any of it. Same email: legal@memberpress.ai.
MemberPress.ai is a business tool. It is not directed at anyone under 16, and we don't knowingly collect their data.
When this notice changes, we'll update it here and move the date at the top. If a change meaningfully reduces your rights or expands what we collect, we'll tell account holders directly before it takes effect.
Caseproof, LLC — legal@memberpress.ai. That mailbox is read by humans who can actually do something about your request.