Privacy Policy
Privacy Policy
Effective date: [EFFECTIVE DATE] Last updated: [DATE]
1. Who this policy covers
Sympodial is operated by [LEGAL ENTITY NAME], a [STATE/COUNTRY] [ENTITY TYPE] ("Sympodial", "we", "us"). Sympodial is software that member-based organizations, such as clubs and associations, use to run their membership, events, documents, communications, and payments.
Two different relationships are described in this policy, and the distinction matters because our obligations differ:
• Organizations. The clubs and associations that subscribe to Sympodial. For data about an Organization and its administrators, we act as a controller: we decide why and how it is processed.
• Members. The individuals who belong to those Organizations. For data about Members, we act as a processor (a "service provider" under California law) on behalf of the Organization. The Organization decides what is collected, why, and for how long. We process it on their documented instructions.
If you are a Member and want to know why your club holds particular information about you, or you want it corrected or deleted, your club is the right first point of contact. We will assist them, and we will respond directly where the law requires us to. See section 9.
2. Information we collect
2.1 Organization and administrator information
Provided by the Organization when subscribing and configuring the service: organization name, subdomain, mailing address, billing contact, administrator names and email addresses, authentication identifiers, and configuration such as membership types, dues amounts, roles, and branding.
2.2 Member information
Provided by the Organization (including by bulk roster import) or by the Member directly through signup, profile editing, or event registration. Typically:
• Name, email address, and authentication identifiers
• Postal address and telephone number, where the Organization collects them
• Membership type, status, join date, and renewal date
• Family or household relationships between Members, including primary, secondary, and dependent relationships
• Dues and payment history, including amounts, dates, and outcomes
• Event registrations, attendance, and any registration responses
• Documents the Member uploads or that the Organization makes available to them
• Any additional fields the Organization chooses to define. Because these custom fields are defined by each Organization, we do not control and cannot enumerate in advance what they contain. See section 4.
2.3 Payment information
Payments are processed by Stripe. Card numbers, bank account numbers, and similar payment credentials are transmitted directly to Stripe and are **not stored on Sympodial's systems**. We retain transaction records: amount, currency, timestamp, outcome, last four digits and card brand where Stripe provides them, refunds, and the identifiers needed to reconcile a payment.
2.4 Technical information
Collected automatically when the service is used: IP address, browser and device type, pages requested, timestamps, referring page, and error diagnostics. Used for security, abuse prevention, debugging, and service reliability.
2.5 Communications
Email we send on an Organization's behalf, including delivery, bounce, and complaint events reported by our email provider. Support correspondence you send us.
3. Children and dependent members
This section deserves particular attention, because member organizations frequently record family memberships that include children.
• **We do not knowingly collect personal information directly from children under 13.** Sympodial accounts are intended to be created by adults.
• Where an Organization records a dependent or family Member who is a child, that information is provided to us **by the Organization or by the child's parent or guardian**, not collected by us from the child.
• The Organization is responsible for obtaining any consent required by law before providing us with information about a child, and for ensuring it has a lawful basis for doing so. This obligation is also stated in the Terms of Service.
• We process children's information only as needed to provide the service to the Organization, and we do not use it for advertising or profiling. We do not sell it. We do not share it except with the subprocessors listed in section 6.
• A parent or guardian who wishes to review, correct, or delete information about their child should contact the Organization. They may also contact us at [PRIVACY CONTACT EMAIL] and we will assist the Organization in responding.
4. Sensitive information
We do not ask for sensitive categories of personal information, such as health information, government identifiers, precise geolocation, biometric data, or information revealing race, religion, political opinions, or sexual orientation.
However, custom member fields are defined by each Organization, and an Organization could configure one that collects such information. Organizations are contractually responsible for the lawfulness of the fields they define. If an Organization intends to collect sensitive categories, it must have its own lawful basis and should tell us, because additional safeguards and agreements may be required.
5. How we use information
As a processor for Member data, we use it only to provide the service to the Organization: authenticating Members, maintaining the roster, processing dues and event payments, sending transactional email such as magic-link sign-in and renewal reminders, storing and serving documents, and displaying the Organization's site.
As a controller for Organization and technical data, we use it to:
• Provide, maintain, secure, and improve the service
• Bill Organizations and collect fees
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Provide support and send service and administrative notices
• Comply with legal obligations
**We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use Member data to train machine learning models.**
6. Who we share information with
We share personal information only with the following categories of recipients:
Subprocessors. Vendors who process data on our behalf under contract:
| Subprocessor | Purpose | Data involved | |---|---|---| | Stripe, Inc. | Payment processing and payment facilitation | Payment credentials, transaction data, payer name and email | | Amazon Web Services (SES) | Transactional and bulk email delivery | Recipient email address, message content, delivery events | | Amazon Web Services (S3) | Document and file storage | Uploaded documents and file metadata | | [HOSTING / INFRASTRUCTURE PROVIDER] | Application and database hosting | All service data | | [ERROR MONITORING PROVIDER] | Error and performance monitoring | Technical and diagnostic data, which may incidentally include identifiers |
The Organization. Member data is visible to the administrators of the Organization the Member belongs to, according to the permissions that Organization configures.
Other Members, where the Organization has configured a member directory or similar feature to make certain fields visible to fellow Members. What is visible is the Organization's decision.
Legal and safety. Where we reasonably believe disclosure is required by law, legal process, or to protect the rights, property, or safety of any person. Where we are permitted to do so, we will notify the affected Organization before disclosing Member data.
Business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply.
7. Where information is stored and processed
Personal information is stored and processed in [PRIMARY DATA LOCATION].
8. How long we keep information
• Member data is retained for as long as the Organization's account is active and the Organization instructs us to keep it. On termination, see the Terms of Service for the export window, after which we delete or anonymize Member data within [RETENTION PERIOD, e.g. 30 days], except as described below.
• Financial and transaction records are retained for [FINANCIAL RETENTION PERIOD] to meet tax, accounting, and anti-fraud obligations.
• Backups are retained on a rolling basis and are overwritten within [BACKUP RETENTION PERIOD]. Deletion requests are applied to live systems immediately and propagate through backup expiry rather than by editing backups.
• Technical logs are retained for [LOG RETENTION PERIOD].
9. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information, to object to certain processing, and to withdraw consent.
If you are a Member, contact your Organization first. They control your membership record and can usually action a request immediately. If you contact us directly, we will forward your request to the Organization and support them in responding, and we will respond directly to you where the law requires it.
If you are an Organization or administrator, contact us at [PRIVACY CONTACT EMAIL].
We will not discriminate against you for exercising these rights. We may need to verify your identity before acting, and we will explain what we need if so.
Marketing email. Every bulk or newsletter email sent through Sympodial includes an unsubscribe link. Unsubscribing stops marketing email but does not stop transactional email such as sign-in links, receipts, and renewal notices, which are necessary to provide the service.
10. Security
We maintain administrative, technical, and physical safeguards appropriate to the risk, including:
• Encryption of data in transit using TLS
• Row-level security enforced in the database, so that each Organization's data is isolated at the storage layer rather than only by application logic
• Role-based access controls that Organizations configure for their own administrators and members
• Access to production systems limited to personnel who need it
• Automated tests that run on every release and verify that one Organization cannot read or write another Organization's records
No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting personal information, we will notify affected Organizations without undue delay and cooperate with them in meeting their own notification obligations.
11. Cookies and similar technologies
We use cookies that are strictly necessary to operate the service, principally to keep you signed in and to protect against cross-site request forgery. We use [ANALYTICS: NONE / PROVIDER] for usage analytics.
12. Changes to this policy
We may update this policy. If we make a material change, we will notify Organizations by email or in-product notice before it takes effect, and update the "Last updated" date above. Continued use after the effective date constitutes acceptance.
13. Contact
[LEGAL ENTITY NAME] [MAILING ADDRESS] [PRIVACY CONTACT EMAIL]
---
Before legal review
Questions a reviewer needs answered. None of these should be guessed at:
• Legal entity: exact name, type, and state or country of formation.
• Jurisdictions served at launch. Specifically whether EU, UK, or Swiss Organizations or Members are in scope. Saying "US only for the pilot" materially simplifies sections 7, 9, 11, and 13.
• Controller/processor characterization. This draft treats Sympodial as a processor for Member data and a controller for Organization data. Confirm that holds, and confirm the corresponding characterization under CCPA/CPRA as a "service provider" rather than a "third party", which requires specific contract language in the Terms or a separate DPA.
• Whether a Data Processing Addendum is needed, and whether it should be incorporated by reference into the Terms of Service or executed separately.
• Children's data. Whether COPPA applies given the actual composition of pilot and prospective Organizations. This is the highest-risk open item in this document, and the pilot's roster will answer part of it.
• Retention periods in section 8, which should be set deliberately rather than by default, and should align with the tax and financial record-keeping rules that apply to the entity.
• Breach notification commitment in section 10.
• Complete subprocessor list in section 6, and whether to commit to advance notice of changes.
• State-specific disclosures. California, Virginia, Colorado, Connecticut, Texas, and others have distinct requirements and some require specific headings or "Do Not Sell or Share" links. Confirm which apply.