Privacy Policy

Last updated: September 24, 2026

Memberlyst (“Memberlyst”, “we”, “us”, or “our”) provides membership-management software for organizations such as clubs and community groups, delivered as a website and as mobile apps for iOS and Android. Memberlyst is based in Alberta, Canada. This policy explains what personal information we handle, why, and the choices you have. It applies to our website (memberlyst.com and its subdomains), our web application, and our mobile apps.

We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA).

Two roles: our customers, and their members

Memberlyst is used by organizations to manage their own members and operations. This creates two different relationships:

  • Organizations and their staff (our customers). When an organization signs up and its administrators or staff use Memberlyst, we act as the party responsible for that account information and handle it as described below.
  • Members and other people an organization adds to Memberlyst. When an organization records information about its members, event attendees, service clients, or contacts, it does so under its own relationship with those people. For that information, Memberlyst acts as a service provider processing the information on the organization’s behalf and under its instructions. If you are a member of an organization that uses Memberlyst and you have questions about your information, please contact that organization first; we will support their handling of your request.

Information we handle

Depending on how Memberlyst is used, this may include:

  • Account and identity information: names, email addresses, phone numbers, postal addresses, dates of birth, membership status and history, member numbers, roles and staff assignments.
  • Payment information: records of payments (amount, method, date) and issued receipts, and, where an organization enables online payments, transactions processed by Stripe or PayPal. We do not store full card numbers; card and PayPal payment details are handled by those providers.
  • Location information: for the field-service check-in feature, the mobile apps capture a device’s location only while the app is in use and only when a worker checks in or out of a job, to record where the visit happened. Separately, member and client postal addresses may be converted to map coordinates (geocoding) so organizations can view them on a map.
  • Check-in and activity records: door/visit check-ins, event attendance and registrations, and service-job activity.
  • Communications: emails we send on an organization’s behalf (for example renewal reminders and broadcasts), delivery and unsubscribe records, and support requests.
  • Mobile push tokens: to deliver notifications, with your permission, through Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android).
  • Technical information: IP address, browser or device type, and cookies needed to keep you signed in and to keep the service secure (see Cookies).

How we use information

  • To provide and operate the service for organizations and their members.
  • To process membership payments and issue receipts.
  • To send account, membership, and service-related messages, and organization broadcasts, and to let recipients unsubscribe from non-essential messages.
  • To show member and service locations on a map and to record where field-service check-ins occur.
  • To secure the service, prevent abuse, and troubleshoot problems.
  • To meet legal, tax, and financial-record obligations.

We do not sell personal information, and we do not use it for advertising.

Cookies

We use cookies that are strictly necessary to keep you signed in and to protect the service. We do not currently use advertising cookies. If we introduce non-essential analytics in the future, we will ask for your consent first and update this policy.

Service providers (sub-processors)

We rely on a small number of providers to run the service. They handle information only as needed to provide their part of the service:

  • Amazon Web Services (AWS) - application hosting, database, email delivery, address-to-map geocoding, and encrypted off-site backups, in a Canadian data centre (Canada, ca-central-1 region).
  • Cloudflare - content delivery, DNS, secure network access, file/media storage (R2), and protection against attacks.
  • Stripe and PayPal - online card and PayPal payments, where an organization enables them.
  • Apple (APNs) and Google/Firebase (FCM) - mobile push notifications.

Some of these providers may process limited information outside Canada. Our primary application data is stored in Canada (AWS ca-central-1).

Data retention

We keep information for as long as an organization’s account is active and as needed to provide the service. Financial records (payments and receipts) are kept as required for tax and accounting purposes. Backups are retained for approximately 30 days (daily) and up to about 13 months (monthly) before being overwritten. When information is deleted, copies may persist in backups until those backups age out.

Your choices and rights

Subject to applicable law, you may request access to, or correction of, your personal information, and you may withdraw consent for non-essential communications at any time (for example via the unsubscribe link).

  • If you are a member of an organization that uses Memberlyst, contact that organization first - they control your information in their account.
  • For information Memberlyst holds directly (for example your Memberlyst account), contact us at privacy at memberlyst dot com.

You also have the right to complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

Security

We protect information with encryption in transit, encryption of sensitive stored values (such as payment-provider keys), access controls that isolate each organization’s data, and off-site encrypted backups. No system is perfectly secure, but we work to protect information and to respond quickly to issues. See our security policy at memberlyst.com/security.

Children

Memberlyst is provided to organizations, not marketed to children. Where an organization records information about minors (for example youth members), it does so under its own relationship with those members and their guardians.

Changes to this policy

We may update this policy as the service evolves or the law changes. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify organizations.

Contact

Questions about this policy or your information: privacy at memberlyst dot com. Memberlyst, Alberta, Canada.