Data processing agreement (DPA)

Last updated: November 1, 2026.

1. Parties and acceptance

This Agreement is part of the Terms of use and is entered into between:

• the Customer: the individual or entity that creates and runs a community on Memberfy (the owner, personally or for the company they represent); and
• Memberfy: Memberfy, Inc. (Delaware, file number 10796969) for Customers outside Brazil, or LUMA VENTURES LTDA - ME (CNPJ 21.951.820/0001-39) for Customers in Brazil.

By creating a community, or continuing to run one after this date, the Customer accepts this Agreement. If this Agreement and the Terms conflict on personal data, this Agreement prevails.

2. Definitions

"Personal data", "processing", "data subject", "controller", "processor" and "personal data breach" have the meaning given in the GDPR (Regulation (EU) 2016/679) and, where applicable, the UK GDPR and Brazil's LGPD (Law 13,709/2018). Sub-processor means a third party engaged by Memberfy that processes Customer Data. Customer Data means personal data Memberfy processes on the Customer's behalf to provide the service.

3. Roles

3.1. For Customer Data, the Customer is the controller and Memberfy is the processor.

3.2. Memberfy is an independent controller of the account data of the people who run the community and of data it processes for its own purposes: authentication, security and fraud and abuse prevention, platform fee billing, KYC required by the payment provider, legal compliance and aggregated platform statistics. That processing is governed by the Privacy Policy, not this Agreement.

3.3. The Customer warrants that it has a legal basis for the data it places on the platform or asks members for (including custom fields and forms, imports and invitations), that it informs members of the processing, and that its instructions comply with the law.

4. Subject matter, nature and purpose

Memberfy processes Customer Data only to provide the contracted service (hosting the community, the modules the Customer enables, payments and communications), as described in Annex 1, for the term of the Terms.

5. Instructions

5.1. Memberfy processes Customer Data only on the Customer's documented instructions. These are the Terms, this Agreement, and the settings and actions the Customer and its team take on the platform (including the API, MCP, webhooks and integrations).

5.2. Memberfy will inform the Customer if, in its opinion, an instruction infringes the law, and may suspend that instruction until confirmed. Processing required by law is the exception; Memberfy will inform the Customer first unless the law prohibits it.

6. Confidentiality

Memberfy personnel with access to Customer Data are bound by confidentiality and access only what their role requires. Private messages between members are not accessible to the Customer's team through any screen, API or assistant.

7. Security

Memberfy maintains the technical and organizational measures in Annex 2, reviewed periodically. The Customer is responsible for the security of what it controls: its team's passwords and access, assigned roles, API keys, webhook destinations and integrations it configures.

8. Sub-processors

8.1. The Customer gives Memberfy general authorization to engage the Sub-processors in Annex 3 and others as needed.

8.2. Memberfy will notify the Customer of any new or replacement Sub-processor in advance, by email to the owner or on the public list. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may terminate the affected service and Memberfy will refund prepaid fees for the unused period.

8.3. Memberfy imposes on each Sub-processor, by contract, data protection obligations at least as protective as this Agreement, and remains liable to the Customer for the Sub-processor's performance.

8.4. Destinations the Customer itself chooses are not Sub-processors: its webhooks, its Google Analytics, its own AI keys in automations, AI assistants each person connects through MCP, and other integrations the Customer enables. The Customer is responsible for those destinations.

9. Data subject requests

9.1. The platform gives the Customer means to respond to data subjects: view, correct and export member, registration and answer lists (CSV), remove members and delete content.

9.2. If a data subject contacts Memberfy about Customer Data, Memberfy forwards the request to the Customer without responding on the merits, unless instructed by the Customer or required by law, and assists the Customer with what the platform does not let it do on its own.

10. Personal data breaches

10.1. Memberfy will notify the Customer without undue delay after becoming aware of a breach affecting Customer Data, with the information available: nature, categories and approximate number of data subjects and records, likely consequences, measures taken and a contact point.

10.2. Memberfy will assist the Customer with notifications to supervisory authorities (72 hours under GDPR art. 33; ANPD Resolution 15/2024) and to data subjects. Notification is not an admission of fault.

11. Assistance, impact assessments and audits

11.1. Memberfy will provide reasonable information the Customer needs for data protection impact assessments and prior consultations regarding Memberfy's processing.

11.2. Memberfy will make available the information necessary to demonstrate compliance with this Agreement. On-site audits, where required by law or after a material breach, require prior notice, at most once a year, during business hours, without access to other customers' data, under confidentiality and at the Customer's expense.

12. International transfers

12.1. Memberfy and its Sub-processors may process Customer Data outside the Customer's country, mainly in the United States.

12.2. For data subject to the GDPR, the parties adopt the European Commission Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor) and, where applicable, Module 3 (processor to processor), and the UK International Data Transfer Addendum for UK data, incorporated by reference with the options in Annex 4. For data subject to the LGPD, the parties adopt the ANPD standard contractual clauses (Resolution CD/ANPD 19/2024), incorporated by reference. Where a recipient is certified under the EU-US Data Privacy Framework, that certification may be relied on instead.

13. Term, return and deletion

13.1. This Agreement applies for as long as Memberfy processes Customer Data.

13.2. When the service ends, the Customer may export the data the platform allows it to export. After termination, at the Customer’s request, Memberfy deletes or anonymizes Customer Data, except what it must retain by law (such as tax, payment and KYC records, and access logs under Brazilian law), which is restricted to that purpose.

14. Liability and governing law

14.1. Each party's liability follows the Terms and applicable law.

14.2. For Customers in Brazil, Brazilian law and the Portuguese version apply; for all others, the English version applies, without prejudice to the Standard Contractual Clauses, which follow the law they designate.

Annex 1. Description of processing

Annex 2. Security measures

Described in general terms; details are confidential.

• Encryption in transit; data held with cloud providers that encrypt at rest.
• Passwords stored only as hashes; card numbers never touch Memberfy's storage (tokenized at the payment provider).
• Logical isolation between communities and role-based access control (owner, admin, moderator, finance, member) enforced on the server for every operation.
• Audit logs of team actions and of actions taken by connected AI assistants.
• Rate limiting and anti-automation on login and public forms.
• Removal of location metadata (EXIF) from uploaded images.
• Automatic purge of short-lived data (raw browsing events after 30 days, abandoned checkouts after 90 days, inactive push subscriptions after 60 days).
• Security review of changes before each production release, with findings tracked until fixed.
• Test environments never send real email, SMS or WhatsApp.
• Personnel access limited to need.

Annex 3. Sub-processors