Privacy notice

Memberly is run by Harry Mattocks, a sole trader, of 6 Wiltshire Drive, Congleton, Cheshire, CW12 1NX.

Email hi@harry.bz about anything on this page. There is no data protection officer; the business is too small to need one.

We are the controller for club administrators' accounts — the people who sign in to Memberly.

We are a processor for everything the membership finder collects from a club's members. The club decides what is collected and why; we only act on its instructions. The club's own privacy notice covers that data, and the terms of our processing are in the Data processing section of our terms.

• Your name or club name, email address and a hashed password.
• Sign-in sessions, with the IP address and browser they were created from.
• Subscription and payment records. Card details go straight to Stripe; we never see them.
• Emails we send you about your account, and support messages you send us.
• A record of administrative actions: who invited, removed or changed a colleague, rotated a key or deleted data, and when.
• A running count of AI usage and cost per club, so we can apply the allowance on your plan.

• Running your account and the service you subscribe to — performance of our contract with you.
• Taking payment and chasing failed payments — performance of our contract.
• Keeping the service secure, preventing abuse, and answering support requests — our legitimate interests in running a safe, working service.
• Telling you about changes to Memberly that affect your account — our legitimate interests in keeping customers informed. We do not send marketing email to people who have not asked for it.
• Keeping accounting records — a legal obligation.

Only the suppliers that run the service for us. Each one is listed, with what it does and where it is, on the sub-processors page. We do not sell personal data and we do not share it for anyone else's marketing.

The application and its database run in London on Fly.io. Data stays in the United Kingdom except in one case: when a club switches on AI explanations or the member assistant, the text of that request is sent to Anthropic in the United States. That transfer is covered by the UK Addendum to the EU standard contractual clauses, backed by a transfer risk assessment, and Anthropic does not use the text to train models.

• Account details: while the account is open, then twelve months after it closes.
• Sign-in sessions: until you sign out, or after thirty days of inactivity.
• Invoices and accounting records: six years, because tax law requires it.
• Club members' data: the period each club sets, twenty-four months by default. Deleting a club account deletes all of it at once.

You can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, or ask for your data in a portable format. Where we rely on consent you can withdraw it at any time. Nothing here involves automated decisions with a legal or similarly significant effect.

You can also object to anything we do on the basis of our legitimate interests. Tell us why and we will stop unless we have a compelling reason not to.

Email hi@harry.bz and we will answer within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

If your question is about data a club collected through its membership finder, ask the club — it is the controller. We will pass on anything sent to us by mistake.

If we change this notice we will update the date at the top and email account holders about anything significant before it takes effect.