Privacy Policy

Last updated: November 9, 2026

Melora Connect, Inc. ("Melora", "we", "us")

Privacy questions: privacy@meloraconnect.com. Support: support@meloraconnect.com or (240) 896-1404.

1. Who this policy covers, and our role

1.1 Melora Connect is software that chambers of commerce, trade associations, professional societies and other member organizations ("Organizations") use to run their membership, events, payments and communications.

1.2 When we act for an Organization. Most personal information in Melora Connect is member, event and payment information that an Organization puts in or collects. For that information, the Organization decides what is collected and why, and we process it on the Organization's behalf. If you are a member of an Organization, its own privacy notice applies, and requests about your data should go to it first. We will help the Organization answer them.

1.3 When we act for ourselves. We decide how to use information about the people who run Organization accounts, Vendors and Vendor applicants, visitors to our websites, and people who contact us or sign up for our updates. This policy explains that use.

1.4 We do not sell personal information, and we do not share it for cross-context behavioral advertising.

2. Information we collect

• Account information: name, email address, organization and role. Passwords are handled by our authentication provider and stored only as secure hashes.
• Profile details you choose to add: a profile photo, social media links, date and time preferences and saved posts. Two-step sign-in is optional for everyone. When it is on, our authentication provider stores the setup for your authenticator app.
• Member and event data that Organizations import or collect: member records, contact details, membership status, dues, event registrations, forms and applications, documents and messages. Organizations may ask for personal details, such as a date of birth, in their own forms, or ask members to upload documents such as a W-9 or a photo ID.
• Payment information: payments through MeloraPay are processed by Stripe on the Stripe account of the business being paid. Card details are entered in Stripe's payment forms and are not stored by Melora. We keep records of payments, such as amount, date, status and fees. When Organizations and Vendors set up payouts, Stripe collects identity and bank details directly, and we do not receive tax identification numbers, bank account or routing numbers, or dates of birth from that process.
• Gifts on public fundraiser pages: your name (optional, and not shown if you give anonymously), email address, the amount and the fundraiser. Stripe also returns the name and email address on the payment.
• Vendor applications: business name, contact name, email, phone, location, website, social media handle, service categories, description, price range, chosen plan, portfolio files and notes.
• Event landing page sign-ups: name, email and phone number, and an optional message, from people who register interest on an Organization's public event page.
• Demo requests: name, email, organization, role, phone, organization size and message, from people who ask us for a demo.
• Messages sent through Melora Connect, between an Organization and its Members and between Members of the same Organization. They are stored in Melora's database.
• Email activity: emails sent through Melora Connect may record whether they were opened and which links were clicked.
• Address searches: when you type an address into an address field, the text is sent to our mapping provider to suggest matches.
• Technical information: error reports and basic usage information needed to run and fix the Service. Error reports include an internal user ID, not your name, email or IP address. Where we use analytics, they collect the information described in Section 4.3.
• Security records: IP address and browser details, used to block abuse. Records used for rate limits are kept for one day. Refused attempts to reach administrator areas are logged with the IP address and browser.
• Support and feedback: what you send us when you contact support.

3. How we use information

• To provide, secure and support Melora Connect, including member portals, events, payments and messaging.
• To process payments and record fees through MeloraPay and Stripe.
• To review Vendor applications.
• To send service emails, such as receipts, invitations, reminders and account notices.
• To send the emails an Organization sets up, such as newsletters, automatic welcome, renewal and win-back series, and document expiry reminders. An Organization can pause its automatic emails, and Members can stop newsletters with the link in each one.
• To send marketing emails, only where the law allows, with an unsubscribe link in each one.
• To send Melora's own newsletter to people who subscribe on our website. To subscribe, you give your email address and, if you choose, your first name. We record your consent in HubSpot and send the newsletter only to subscribers. Each issue has an unsubscribe link, and you can also ask us at privacy@meloraconnect.com.
• To follow up on event landing page sign-ups, vendor applications, demo requests and sales inquiries in our customer relationship system (HubSpot), as described in Section 6.
• To prevent fraud and abuse, and to enforce our Terms of Service.
• To meet legal obligations.

3.1 AI-assisted features. Some features use Claude models from Anthropic to draft text and suggest next steps, such as event agendas, contracts, campaign emails, introductions, advocacy letters, vendor proposals and staff briefings. When you use one, we send Anthropic what you type and the information the feature needs, for example the names, companies and industries of people suggested for an introduction, or totals from your Organization's dashboard. Anthropic processes it under its commercial terms and data processing addendum: it may not use it to train its models, and it deletes it within 30 days, unless it is flagged for a Usage Policy review, in which case it may keep it for up to 2 years. We keep a record of each AI request (who made it, when, which feature and its size) for 90 days, never what was sent or returned. AI output is a draft: check it before you use it.

4. Cookies and browser storage

4.1 Apart from analytics, described in Section 4.3, we use only storage that the Service needs to work. We do not use advertising cookies. On an Organization's public event pages we count visits ourselves, with a random visitor ID. Stripe sets cookies on payment pages to prevent fraud, and embedded YouTube videos may set YouTube cookies.

• Sign-in session, stored in your browser so you stay signed in.
• Preferences, such as theme, sidebar state and the organization you last worked in.
• Drafts of forms you have not submitted yet, kept on your device.
• Event page visitor ID, a random identifier on Organization event landing pages used to count visits and sign-ups. With each visit we record the page that referred you, campaign tags in the link, the type of device and the country.
• Your organizations, a saved list of the organizations you belong to, so the app opens faster.
• An unfinished application, a link that takes you back to an application you started.
• Your cookie choice from our cookie banner.

4.2 The Melora Connect application loads fonts from Google Fonts, so your browser sends its IP address to Google when a page loads. Our website, meloraconnect.com, serves its own fonts.

4.3 Analytics. We use, or may use, third-party analytics services to understand how our website and the Melora Connect application are used, and to improve them. These services may receive the pages you view, your device and browser type, your approximate location based on your IP address, and how you interact with pages. We do not use analytics for advertising, and we do not sell personal information. Each analytics provider is listed in Section 5 while we use it. On our website, analytics and marketing cookies load only after you accept them in the cookie banner. You can accept all, reject all or choose by category, and change your choice at any time with the Cookie settings link at the bottom of every page. Storage the website needs to work, such as remembering your cookie choice, does not need consent.

4.4 Marketing cookies. If you accept marketing cookies, our website loads HubSpot's tracking code. It sets cookies that recognize your browser between visits and record the pages you view, so that if you later fill in one of our forms, such as a demo request or the newsletter sign-up, those visits are linked to your contact record in HubSpot. We use this only for Melora's own sales and marketing, never for advertising.

5. Service providers we use

5.1 These providers process personal information for us under their data processing terms, which limit their use of it to providing their service to us:

5.2 Some pages also load content directly from other companies, which receive your IP address and browser information when the page loads: videos embedded from YouTube or Vimeo, photographs from Unsplash, and maps from Google Maps on event pages. When you pick a demo time, the Calendly scheduling link carries your name and email address to Calendly. When a member looks up their representatives, the address they enter is sent to the US Census Bureau geocoder to find its location, and that location is sent to Open States (Plural Policy) to find their legislators. The address and the results are kept for 30 days. Melora Connect does not send text messages yet; if it starts, we will add the provider here first.

6. Other sharing

• Within an Organization. Organization staff can see member information according to the roles the Organization sets. Members of the same Organization can see the directory listings of members who choose to be listed, and can message each other. Each member chooses who can message them: anyone in their organization, only their connections, or Organization staff only. A conversation can be read by the people in it.
• At the Organization's direction. An Organization can connect its own systems to Melora Connect with API keys, which read and change member, event and dues records, and can have Melora send updates to web addresses it chooses. Updates include member contact details only if the Organization turns that on. When an Organization connects its own HubSpot account, Melora sends that Organization's member records to it, one way: name, email, phone, company, job title, city, state, ZIP code, website, a Melora member ID and membership details (status, tier, category, join date and renewal date). An Organization can also have Melora post alerts to its own Slack or Microsoft Teams channels about new membership applications, failed payments, sold-out events and a weekly summary. An alert contains the membership type, invoice number or event name, amounts and counts where they apply, and a link to Melora Connect, and never a member's name, email or phone. The Organization is responsible for those systems.
• Zoom. When Zoom is turned on for an Organization and it connects its own Zoom account, Melora creates, changes and deletes the Zoom meetings the Organization's staff ask for on events and committee meetings, sending Zoom each meeting's title and time, and keeps the meeting's ID, join link and passcode with the event. To give each member who is going their own join link, Melora registers the member's name and email address with the meeting and keeps the link Zoom returns. After an event, Melora reads the meeting's participant list from Zoom to check in the registered people who joined; participants' email addresses are used only for that match and are not stored. Melora does not read the Organization's other meetings, recordings or chats. Melora keeps the connected Zoom user's ID and email address and the Zoom sign-in tokens. The tokens are encrypted and can be read only by the Service's servers; old tokens are deleted each time Zoom renews them, and all of them when the Organization disconnects Zoom or removes the Melora app from its Zoom account. The Organization's Zoom account is its own system, and its agreement with Zoom applies to it.
• Melora staff. Authorized Melora staff can access an Organization's data, mainly to provide support, and also to operate and secure the Service and to meet legal requirements. Access to an Organization's member, payment or other records must be approved by one of a small number of designated approvers at Melora and is limited to that one Organization for a set time of no more than one week. Every request, decision and revocation is recorded, along with each time a staff member opens that Organization's records or signs in to it as an administrator. Help requests sent to Melora are handled by our support team without this approval.
• Public pages. Organization public pages, such as event pages and fundraiser pages, are visible to anyone. Articles an Organization chooses to share are shown, with the author's name, to other organizations' members and, if it chooses, on our public articles page. A member's public card link shows their name, title, company, industry, membership and whether it is current, and shows contact details only if the member turns them on; the member can reset the link. Report share links show only totals, expire after 7, 30 or 90 days, and can be revoked.
• Melora's customer relationship system. When someone signs up through an Organization's public event page, applies to work with Melora as a vendor, asks for a demo, or contacts Melora through a form, we record their name, email, phone and the event or service involved in HubSpot, which Melora uses to follow up with them. A demo request is also stored in Melora's own database, so it reaches the right person on our sales team even if HubSpot is unavailable. Sign-ups from demo accounts are never sent. You can ask us to stop contacting you or to delete this record at any time at support@meloraconnect.com, and every marketing email includes an unsubscribe link.
• Legal reasons. When the law requires it, or to protect people, the Service or our rights.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may transfer to the new owner under this policy. We will tell affected customers.

7. Storage, security and transfers

7.1 Our database and files are stored in Canada, with Supabase on Amazon Web Services in Montreal. Cloudflare serves the application from its global network and stores our encrypted backups, and other providers, including Stripe, Resend and HubSpot, process data in the United States. If you are outside these countries, your information is transferred to them. Where the law requires, these transfers rely on appropriate safeguards, such as the Standard Contractual Clauses in our providers' data processing terms.

7.2 Our Security page describes how we protect data.

8. Data retention

8.1 We keep information while the account it belongs to is active. Organizations keep their own member records under their own retention settings:

• Organizations can choose when records of inactive members, lapsed members and old payments are anonymized. When a member record is anonymized, the member's name, contact details, address, photo, profile, custom answers and documents are removed, and the record stays only as an anonymous entry so the Organization's totals stay correct. Old payment records are only marked: the payer's name stays on them for tax and accounting.
• A member can ask their Organization to erase their personal data. The Organization's staff erase it in Melora: the member's name, contact details, address, profile, photo, ID scan, documents, custom answers, billing details and application details are removed, and the record is unlinked from any account and kept only as an anonymous entry so the Organization's totals stay correct. Invoices, payments and refunds are kept for as long as tax and accounting law requires (typically seven years), and the audit log keeps a record that the erasure happened, without personal data. A member can also ask us at privacy@meloraconnect.com and we will pass the request to their Organization.
• If an Organization cancels its account, we keep its data for 90 days, available for export, and then delete it automatically. If its account owner asks us to delete the data sooner, we delete it within 30 days of the request; this faster deletion happens only on request. Both are set out in the Terms of Service.
• When your own account is deleted, your sign-in account and profile are deleted straight away. Your Organization keeps its own member record about you, and you can ask it to delete that record.
• Payment and tax records are kept as long as the law requires.
• Rejected Vendor applications are deleted on request.
• Demo requests are kept in our own database for 24 months after you send them, so our sales team can follow up and we can confirm every request was answered. After that they are deleted. The contact record in HubSpot is kept while we have a business relationship with you, and you can ask us to delete it at privacy@meloraconnect.com.
• Backups are encrypted and deleted after 30 days, so deleted information leaves our backups within 30 days.

9. Your rights and choices

9.1 Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict some processing, and to withdraw consent.

9.2 What you can do yourself. Members can download a copy of their data, and delete their own account, from the member portal. Deleting your account removes your sign-in account and profile; your Organization keeps its own member record about you, as described in Section 8. Vendors can delete their account from their account settings, or ask us to by emailing privacy@meloraconnect.com. Anyone can unsubscribe from marketing emails using the link in the email.

9.3 Requests. If you are a member, contact your Organization first, because it controls your member data. You can also email privacy@meloraconnect.com and we will pass your request to the Organization or answer it ourselves where we control the data. We aim to answer within 30 days, or sooner where the law requires. We may need to verify your identity.

9.4 If you are in the EU, the UK or another place with a data protection authority, you can complain to it.

10. Children

10.1 Melora Connect is not directed to children under 13, and we do not knowingly collect their information for our own purposes. If an Organization's programs involve minors, the Organization is responsible for any consent the law requires. If you believe we hold a child's information in error, contact us and we will delete it.

11. US state privacy rights

11.1 Residents of California and other US states with privacy laws have rights to know what personal information we collect and why, to request deletion or correction, and not to be treated differently for using these rights. We do not sell personal information or share it for targeted advertising. To use these rights, follow Section 9.

12. Changes to this policy

12.1 Minor changes take effect when published with a new "Last updated" date. For material changes, such as new kinds of data, new uses or new providers that receive personal data, we will email account owners at least 15 days before the change takes effect.

12.2 When we start using a new analytics provider, we will add it to Section 5, as described in Section 4.3.

13. Contact

• Privacy requests: privacy@meloraconnect.com
• Support: support@meloraconnect.com or (240) 896-1404
• By post: Melora Connect, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA