Data Processing Agreement

MemberCanary Version 1.0 — 5 September 2026

This DPA forms part of the Terms of Service between MemberCanary ("Processor", "we") and the customer ("Controller", "you"). It applies wherever we process personal data on your behalf, and it is written to satisfy Article 28 of the UK and EU GDPR.

If you need this signed on paper, email biruk@membercanary.com.

1. Roles

You are the Controller of your community members' personal data. You decide why and how it is processed. We are the Processor and act only on your documented instructions.

Your instructions are: the Terms of Service, this DPA, your configuration inside the product, and anything else you tell us in writing.

If we believe an instruction breaches data protection law, we will tell you and may pause that processing.

2. Subject matter and duration

Subject matter. Detecting and reporting engagement decline among members of your paid community.

Duration. For as long as your account is active, plus the deletion window in section 9.

3. Nature and purpose of processing

Collecting membership and activity metadata from platforms you connect; unifying it into one record per member; scoring engagement; generating digests identifying members likely to lapse and members highly engaged; and enabling you to contact them.

4. Categories of data subject

Members — free and paying — of the communities you connect.

5. Types of personal data

Processed:

• Platform user identifiers (Whop, Discord, Telegram)
• Display names and, where the platform exposes it, email address
• Membership records: plan, price, join date, status changes, renewal and payment-failure events
• Activity metadata: message counts, message timestamps, last-active time, channels used, roles held
• Data we derive: engagement score, risk tier, reason codes

Not processed:

• Message content of any kind, including direct messages
• Voice or video
• Payment card or bank details
• Special category data under Art. 9

We have designed the system so content is never received, not merely never stored.

6. Our obligations

We will:

1. Process personal data only on your documented instructions, including for international transfers, unless required otherwise by law — in which case we will tell you first unless legally prohibited.
2. Ensure anyone authorised to process the data is under an appropriate duty of confidentiality.
3. Implement the technical and organisational measures in Annex B.
4. Respect the sub-processor conditions in section 7.
5. Assist you, taking account of the nature of processing, in responding to data subject requests (section 8).
6. Assist you with security, breach notification, impact assessments and prior consultation, taking account of the information available to us.
7. Delete or return personal data at the end of the relationship (section 9).
8. Make available the information needed to demonstrate compliance and allow audits (section 10).

7. Sub-processors

You give general authorisation for us to engage the sub-processors in Annex A.

We will give you 30 days' notice before adding or replacing one. If you reasonably object on data protection grounds, tell us within that period; if we cannot resolve it, you may terminate and receive a pro-rata refund of any prepaid unused period.

Each sub-processor is bound by written terms offering protection materially equivalent to this DPA. We remain fully liable to you for their performance.

8. Data subject requests

Where a member contacts us directly, we will not respond substantively but will forward the request to you without undue delay.

We provide tooling to let you access, export, correct and delete an individual member's data yourself. Where you cannot self-serve, we will assist within 10 business days.

9. Deletion and return

On termination, or on your written request, we will delete all personal data within 30 days, including from backups on their normal rotation cycle, unless law requires retention.

We will confirm deletion in writing on request.

10. Audits

On reasonable notice, no more than once a year — unless required by a regulator or following a breach — we will provide the information reasonably needed to verify compliance with this DPA, and will respond to a reasonable security questionnaire.

11. International transfers

We operate from Ethiopia and use sub-processors in the United States.

Where personal data of EEA or UK data subjects is transferred, the parties incorporate by reference the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum, with:

• Clause 7 (docking) — included
• Clause 9 — Option 2, general written authorisation, notice period per section 7
• Clause 11 — independent dispute resolution not selected
• Clause 17 — governing law per the Terms, section 11
• Annex I, II and III — as set out below

The parties will complete any additional annex information reasonably required to make those transfer safeguards effective. Appropriate supplementary measures and a transfer-risk assessment will be used where required.

12. Liability

Liability under this DPA is subject to the limitation in section 9 of the Terms of Service.

Annex A — Sub-processors

Annex B — Technical and organisational measures

Data minimisation. Message content is never ingested. Only counts, timestamps and membership metadata are processed. This is the single most significant measure here: it caps the severity of any breach.

Encryption. TLS in transit. Encryption at rest via the database provider. Platform tokens stored encrypted and never committed to source control.

Access control. Least privilege. Access is currently limited to one individual. Administrative access requires multi-factor authentication.

Segregation. Each customer's data is logically separated and queries are scoped per customer. No customer can access another's data.

Monitoring. Operational monitoring is configured to exclude personal data where possible and to scrub it before transmission where exclusion is not possible.

Backups. Automated database backups, encrypted, with deletion propagating on the normal rotation cycle.

Incident response. Breach notification to affected customers without undue delay and within 72 hours of becoming aware, with the facts, likely consequences, and measures taken.

Review. These measures are reviewed at least annually and whenever the architecture changes materially.