Privacy Policy

Orana Software Inc. (Wyoming, USA) and Orana Software Pty Ltd (Australia), trading as My Member Buddy ("we", "us", "our"), are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform at mymemberbuddy.com and any associated services (the "Service").

By using the Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

Information you provide directly

• Account registration details — name, email address, association name, contact details
• Billing information — processed and stored by Stripe; we do not store card details
• Communications — emails, support requests, and demo bookings sent to us
• Association content — logos, cover images, descriptions, business categories, branding settings, blog posts, events, photo galleries, email campaign templates, and any other content you upload during onboarding or ongoing use
• Member data — names, emails, phone numbers, addresses, business details, photos, categories, and any other fields you choose to record for your association's members

Information collected automatically

• Usage data — pages visited, features accessed, time spent, clicks and interactions
• Device and browser information — IP address, browser type, operating system
• Cookies and tracking technologies — see Section 6 (Cookies) for full details
• Log data — server logs including access times, error reports, and referring URLs

Information from third parties

• Member data imported via CSV — when you upload a member list, we store the rows you provide
• Logto identity data — when committee members or members sign in, we receive their authenticated user identifier and email from Logto (our identity provider)
• Stripe payment events — webhook events confirming charges, subscription state changes, and refunds, relating only to transactions involving your association

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process payments and manage your subscription via Stripe
• Send transactional and informational communications relating to your account, service updates, and platform changes — we do not send unsolicited marketing emails
• Deliver association-authored communications to your members (campaigns, transactional emails, event invites) via our email infrastructure on your behalf
• Provide AI-suggested member categories during CSV import (optional; runs only when you enable it)
• Generate AI-authored starter content for the association's own website (paid add-on; runs only when you subscribe to it)
• Geocode member addresses for the directory map view
• Analyse usage patterns to improve the Service
• Respond to support requests and enquiries
• Comply with legal obligations

3. Data Storage and Security

All data collected and processed by My Member Buddy is securely stored on Microsoft Azure cloud infrastructure. Azure maintains industry-standard security certifications including ISO 27001, SOC 2, and compliance with GDPR, the Australian Privacy Act, and other applicable regulations.

We implement appropriate technical and organizational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), encryption at rest, access controls, and regular security reviews.

While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share information with:

Service providers

• Microsoft Azure — cloud infrastructure, data storage, and static site hosting
• Stripe — payment processing for association subscriptions and (where enabled) member-to-association payments via Stripe Connect
• Mailgun — transactional and campaign email delivery
• Logto — authentication and identity management
• OpenAI — AI category suggestion during member import and AI-authored starter content for association websites (paid add-on)
• Azure Maps — geocoding member addresses for directory map plotting
• Google Maps — map rendering on the Members map view in the admin app

Legal requirements

We may disclose your information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers

In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred as part of that transaction. We will notify you of any such change.

5. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide the Service. If you cancel your account, we will delete or anonymise your personal data within 90 days, unless we are required to retain it for legal, regulatory, or legitimate business purposes (for example, financial records required for tax compliance).

Aggregated, anonymised analytics data may be retained indefinitely.

6. Cookies

We use cookies and similar tracking technologies on our website. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data, subject to legal retention requirements
• Portability — request your data in a structured, machine-readable format
• Objection — object to processing of your data for certain purposes
• Restriction — request that we restrict processing of your data

To exercise any of these rights, contact us at hello@mymemberbuddy.com. We will respond within 30 days.

8. Australian Privacy Act

For users in Australia, Orana Software Pty Ltd complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are an Australian resident and believe we have not handled your personal information in accordance with the APPs, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. GDPR (European Users)

If you are located in the European Economic Area, our legal basis for processing your personal data is:

• Contract performance — to provide the Service you have subscribed to
• Legitimate interests — to improve the Service, prevent fraud, and ensure security
• Legal obligation — where required by applicable law
• Consent — where you have given explicit consent (e.g. optional cookies)

You may have the right to lodge a complaint with your local data protection authority.

10. Children's Privacy

The Service is intended for business use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Continued use of the Service after any changes constitutes acceptance of the updated policy.