Last updated: October 21, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between Melora Connect, Inc. ("Melora") and the Association that signs it ("Customer"). It applies whenever Melora processes Personal Data on Customer's behalf in providing Melora Connect (the "Service").
In plain English: your Association decides what member data is collected and why. Melora only processes that data to run the Service for you, under your instructions, with the security described on our Security page, a published list of providers, and prompt notice if anything goes wrong.
1. Definitions
1.1 "Data Protection Laws" means all laws that apply to the processing of Personal Data under the Terms, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other United States state privacy laws, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, Canada's PIPEDA, and their implementing regulations.
1.2 "Personal Data" means any information relating to an identified or identifiable natural person that is contained in Customer Data (as defined in Section 9.1 of the Terms) and processed by Melora on Customer's behalf.
1.3 "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Melora's possession or control.
1.4 "Subprocessor" means a third party engaged by Melora that processes Personal Data on Customer's behalf.
1.5 "Controller", "Processor", "Data Subject", "processing", "business" and "service provider" have the meanings given in the applicable Data Protection Laws.
2. Roles and instructions
2.1 Roles. Customer is the Controller (or "business") and Melora is the Processor (or "service provider") of Personal Data. Where Customer is itself a Processor for a third party, such as a parent association or federation, Melora is Customer's Subprocessor.
2.2 Instructions. Melora processes Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's configuration and use of the Service are Customer's complete instructions. Melora will tell Customer if it believes an instruction violates Data Protection Laws.
2.3 Customer obligations. Customer is responsible for the lawfulness of its instructions and for having a lawful basis, all required notices and all required consents for the processing of Personal Data through the Service, including for marketing emails sent to Members.
2.4 Details of processing. The subject matter, nature, purpose and duration of processing, and the categories of Personal Data and Data Subjects, are described in Annex 1.
3. CCPA and US state law commitments
3.1 Melora will not: (a) sell or share Personal Data, as those terms are defined under the CCPA; (b) retain, use or disclose Personal Data for any purpose other than providing the Service or as otherwise permitted for service providers under Data Protection Laws; (c) retain, use or disclose Personal Data outside the direct business relationship between Melora and Customer; or (d) combine Personal Data with personal data received from other sources, except as permitted by Data Protection Laws. Melora certifies that it understands and will comply with these restrictions.
4. Confidentiality and personnel
4.1 Melora ensures that everyone it authorizes to process Personal Data is bound by written confidentiality obligations. Melora staff have no standing access to Customer's records: access is requested for one Association, with a written reason and a time limit, approved by a designated approver, and recorded, as described in Section 2.4 of the Security page.
5. Security
5.1 Melora implements and maintains the technical and organizational measures described in Annex 2 and on the Security page. Melora may update these measures, provided that updates do not materially reduce the overall level of protection.
6. Subprocessors
6.1 Authorization. Customer gives general authorization for Melora to engage the Subprocessors listed in Annex 3, which is the same list as Section 5 of the Privacy Policy.
6.2 Obligations. Each Subprocessor processes Personal Data under data processing terms that limit its use to providing its service to Melora. Melora remains responsible for each Subprocessor's performance.
6.3 Changes. Melora will update the Privacy Policy and notify Customer at least fifteen (15) days before authorizing a new Subprocessor. If Customer reasonably objects on data protection grounds within that period, the parties will discuss the objection in good faith. If they cannot resolve it, Customer may cancel its plan and ask for its Customer Data to be deleted under Section 9.4 of the Terms.
7. Security Incidents
In plain English: if there is ever a breach affecting your data, we will tell you within 72 hours of confirming it and help you meet your own notification duties.
7.1 Notice. Melora will notify Customer's account owner without undue delay, and no later than seventy-two (72) hours after confirming a Security Incident.
7.2 Content. The notice describes, to the extent known, what happened, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Melora will add to the notice as more information becomes available.
7.3 Cooperation. Melora will take reasonable steps to contain, investigate and fix the Security Incident and will give Customer the information it needs to notify its own Members where the law requires. Notice of a Security Incident is not an acknowledgment of fault or liability.
8. Data Subject requests
8.1 Association administrators can view, correct and export member records in the admin portal, and Members can download a copy of their own data from the member portal. If Customer cannot fulfill a Data Subject request through the Service, Melora will provide reasonable assistance. If Melora receives a request directly from a Data Subject who identifies Customer, Melora will redirect the request to Customer and will not respond except as required by law.
9. Where data is stored and international transfers
9.1 Customer Data is stored in Canada, with Supabase on Amazon Web Services in Montreal. Cloudflare serves the application from its global network and stores Melora's encrypted backups, and other Subprocessors, including Stripe, Resend and HubSpot, process data in the United States.
9.2 To the extent Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Module Two, Controller to Processor) and the UK International Data Transfer Addendum, as applicable, are incorporated into this DPA by reference, with Customer as data exporter and Melora as data importer.
10. Audits and assessments
10.1 On Customer's written request, no more than once a year (or following a Security Incident), Melora will answer Customer's reasonable security questionnaire and provide its current security documentation, including the Security page and the Subprocessor list. Information provided is Melora's confidential information.
11. Return and deletion
11.1 Customer can export its data at any time as described in Section 9.3 of the Terms. Customer's account owner can ask for Customer Data to be deleted from the admin portal once the plan is set not to renew, or at any time after it ends. The request can be canceled within 7 days; after that the deletion runs automatically, and Melora aims to complete it within 30 days of the request, as set out in Section 9.4 of the Terms. Encrypted backups are deleted after 30 days, so deleted data leaves the backups within 30 days. Payment and tax records are kept as long as the law requires.
12. General
12.1 This DPA is governed by the governing law and dispute terms in Section 20 of the Terms, except where Data Protection Laws or the Standard Contractual Clauses require otherwise. Liability under this DPA is subject to the limitations in Section 15 of the Terms. If this DPA and the Terms conflict on the processing of Personal Data, this DPA controls.
Annex 1: Details of processing
- Subject matter: provision of the Melora Connect membership management platform and its support.
- Duration: while Customer's account is active, plus the deletion period in Section 11.
- Nature and purpose: hosting, storage, organization, retrieval, transmission and deletion of Customer Data to provide membership management, dues and renewals, event registration and check-in, communications, directories, member portals, payments through MeloraPay (if enabled), reporting and support; and transmission to systems Customer connects, such as its own HubSpot account, Slack or Microsoft Teams channels and webhook addresses.
- Data Subjects: Customer's members, applicants, event attendees, donors, sponsors, volunteers, committee members, staff and other authorized users.
- Categories of Personal Data: contact details; organization, job title and professional information; membership status, type and history; event registrations and attendance; communication preferences and engagement; directory profile content; payment records (card details are entered in Stripe's own forms and are not stored by Melora); account and usage logs.
- Sensitive data: not intended. Customer will not upload special category data, government ID numbers or full payment card numbers unless agreed in writing.
Annex 2: Technical and organizational security measures
- Separation of data: row-level security rules in the database decide which rows each signed-in user can read or change, based on their organization and role.
- Staff access: no standing access; time-limited, approved and logged access to one Association at a time.
- Signing in: passwords of at least 8 characters, never stored in readable form; optional two-step sign-in; Cloudflare Turnstile on sign-in and other public forms.
- Encryption: HTTPS in transit; encryption at rest by the database and storage provider; webhook secrets in an encrypted vault; API keys stored only as a one-way fingerprint.
- Payments: card details go straight to Stripe; every charge is made on the Association's own Stripe account.
- Abuse protection: rate limits on public forms, sensitive endpoints and the API.
- Audit logs: important actions, such as permission changes and account deletions, are recorded and visible to Association administrators.
- Backups: a daily database backup, encrypted before it is stored with Cloudflare, separately from the database provider, and deleted after 30 days; a full restore has been tested.
- Monitoring: error reports carry an internal user ID and are configured not to include names, email addresses, IP addresses, cookies or sign-in headers.
Annex 3: Authorized Subprocessors
The current list is Section 5 of the Privacy Policy, which this Annex follows:
- Supabase: database, sign-in and file storage (Canada, Amazon Web Services Montreal).
- Cloudflare: hosting and delivery of the application, bot protection on public forms, and storage of encrypted database backups (global network).
- Stripe: payment processing and connected accounts for MeloraPay (United States).
- Resend: sending email (United States).
- Sentry: error monitoring, with an internal user ID and no names or email addresses.
- Mapbox: address suggestions.
- US Census Bureau geocoder: finding the location coordinates of the address a member enters to look up their representatives (United States).
- Open States (Plural Policy): finding a member's legislators from location coordinates (United States).
- HubSpot: Melora's customer relationship system for follow-up of event landing page sign-ups, vendor applications, demo requests and inquiries (United States).
- Anthropic: drafts and suggestions in AI-assisted features, from what a person types into an AI feature and the information that feature uses (Privacy Policy 3.1).
- Unlayer: the page editor Association staff use to design event pages.
- GitHub: runs the daily backup job, which handles the database briefly before the backup is encrypted.
- Google Fonts: web fonts for the application.
- Browser push services (Google, Mozilla, Apple): delivering push notifications a user turns on.