Privacy policy
Last updated: 26 October 2026
1. Controller
Monile AB ("Membly"), company reg. no. 559273-6051, Nackagatan 3, 116 41 Stockholm, Sweden, EU VAT SE559273605101, is the controller for the processing of personal data described in this policy. For questions about the processing of personal data, or to exercise your rights, contact us at privacy@membly.app. For members' personal data processed within a specific association, the association is itself the controller. Membly is then the processor — see our data processing agreement (DPA).
2. What data we collect
We process the following categories of personal data: • Identity and contact details: name, email address, telephone number (if provided), profile picture. • Association data: membership status, roles, participation in events, custom fields configured by an administrator and, if the association keeps a residents register, which apartment or property you are linked to. • Communication content: messages in chat, posts in the feed, comments, documents you upload. • Fault reports: if the association uses fault reports, the type of fault, the description, the location (pre-filled with your apartment if the association keeps a residents register) and any photos. The report is sent with your name to the property manager the association has named, and the property manager's replies are kept on the case. • Attendance and activity data: recorded attendance at events, RSVP status, participation in team activities. • Payment metadata: amount, date, status, payment method, transaction ID. Actual card details are handled by Stripe and are never stored with us. • Technical data: IP address, device and browser type, login timestamps, push notification tokens. • Children's personal data: when a guardian adds their child as a member, we process the child's name, date of birth (where relevant to the membership category) and, where applicable, national identity number for LOK subsidy reporting (sports associations).
3. Legal basis for processing
We process your personal data on the following legal bases under Article 6 of the GDPR: • Contract (Art. 6(1)(b)): to provide your account, manage subscription and payments, and deliver the service. • Legitimate interests (Art. 6(1)(f)): for security, fraud prevention, platform operations and product improvement. You have the right to object to this processing. • Legal obligation (Art. 6(1)(c)): for accounting under Chapter 7, Section 2 of the Swedish Accounting Act (1999:1078), which requires transaction records to be retained for seven years after the end of the financial year. • Consent (Art. 6(1)(a)): for non-essential cookies, marketing communications and any processing of special categories of personal data. You may withdraw your consent at any time.
4. Purposes of the processing
We use your personal data in order to: • Provide and improve Membly's services. • Enable communication between members and administrators. • Handle payments, invoices and payouts. • Send transactional messages (account activation, payment confirmations, security notices). • Ensure the security of the platform and prevent abuse. • Meet statutory requirements (accounting, regulatory compliance). We do not use your personal data for automated decisions that produce legal or similarly significant effects on you (Art. 22 GDPR), and we do not profile you.
5. Retention periods
We retain your personal data for as long as it is needed for each purpose: • Account data: for as long as your membership is active. When you delete your account, or request erasure (Art. 17), your personal data is anonymised — the link between you and your membership and payment history is removed, while the data that must be retained for legal reasons (e.g. accounting records) is kept for the statutory period. • Removed members: when an administrator removes a member, sensitive identifiers (national identity number, date of birth) processed for LOK subsidy reporting are automatically erased no later than two (2) years after the removal. • Chat and feed content: for the lifetime of the association; erased when the association is closed. • Payment records and transaction logs: seven (7) years after the end of the financial year, under Chapter 7, Section 2 of the Swedish Accounting Act. • Data exports (GDPR): downloadable export files you request are automatically deleted within a week of being created. • Email dispatch logs: processed rows (sent/failed) containing email content are automatically deleted within 30 days. • Audit logs (security-related events): up to twelve (12) months. • Backups: rotated on a 30-day schedule and overwritten thereafter. • Push notification tokens: removed on logout or when the device is deregistered. • We may also delete accounts that have been inactive for a long period, after giving you prior notice.
6. Recipients and sub-processors
Other members of your association: Other members see your name, your profile picture and your role. They never see your contact details, your national identity number or your payment status. Members without app access are visible only to administrators and leaders. This applies to the member list, your profile and the suggestions shown when someone is mentioned in the chat or the feed. On your profile, other members also see which groups you belong to, the tags the association has given you, when you joined and, if you sit on the board, your position. If you are a member without app access, this covers the whole service, not only what is displayed: your name, contact details and profile picture are not given to other members — apart from your guardians, anyone who has asked the association to become one, and the exceptions below. Three exceptions: • If the association has listed you as a contact person, the name, profile picture and contact details the association has entered there are shown. • If you respond to an event, or your guardian responds on your behalf, your name appears among the responses to that event — even if you have no app access. • What you yourself write in the chat and the feed is visible to the people it is addressed to. Administrators and leaders of your association also see your contact details and, if the association has asked for them, details such as date of birth and gender. Sub-processors: We engage the following sub-processors in order to provide the service. All are bound by data processing agreements and adequate security measures: • Supabase Inc. — database and authentication. Data is stored within the EU (AWS eu-west, Ireland). • Stripe Payments Europe Ltd. — payment processing. Established in Ireland. Stripe is also an independent controller for fraud prevention, identity verification and regulatory compliance under anti-money-laundering legislation. • Vercel Inc. — hosting and frontend delivery. Established in the USA, covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses (SCC). • Resend (Drip Email Inc.) — transactional email. Established in the USA, covered by the EU-US Data Privacy Framework. • Anthropic PBC — AI features (Claude API). Established in the USA, covered by the EU Standard Contractual Clauses (SCC). Anthropic does not use your data for model training. • Voyage AI (MongoDB, Inc.) — AI embeddings (vectorisation of association content) for AI search and the knowledge base (RAG). Established in the USA, covered by the EU Standard Contractual Clauses (SCC). Under the provider's terms, the content is not used to train the provider's models. • Sentry (Functional Software, Inc.) — error reporting and monitoring. Established in the USA, covered by the EU-US Data Privacy Framework and the SCC. Personal data is scrubbed before logging as far as is technically possible. • Upstash, Inc. — rate limiting and technical deduplication of webhooks (Redis). Only short-lived technical keys. Established in the USA, covered by the EU Standard Contractual Clauses (SCC). • Google Ireland Limited (with Google LLC, USA) — address lookup and geocoding (Google Places/Maps) when you fill in addresses in the service. Covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses (SCC). • Cloudflare, Inc. — bot protection (Cloudflare Turnstile) on the signup form, to tell people apart from automated requests. Processes the visitor's IP address, TLS fingerprint and browser signals (User-Agent). Used only for Membly's own processing, not for associations' member data. Cloudflare is also an independent controller of these signals insofar as they are used to improve Cloudflare's bot detection. Established in the USA, covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses (SCC). An up-to-date list of the sub-processors that process personal data on behalf of associations is always available in our data processing agreement (DPA). We notify association administrators at least 30 days in advance of any replacement or addition of a sub-processor.
7. Transfers to third countries
Some of our sub-processors are established outside the EU/EEA (mainly in the USA). For these transfers we rely on: • The EU-US Data Privacy Framework — for providers certified under the framework (Vercel, Resend, Sentry, Cloudflare). • The EU Standard Contractual Clauses (Commission Decision 2021/914) — for other transfers, including Anthropic. Module 3 (processor-to-processor) applies. • Supplementary technical and organisational measures (encryption in transit and at rest, access controls) where appropriate in line with the EDPB's recommendations. You may request a copy of the applicable safeguards by contacting privacy@membly.app.
8. Children's personal data
Under Chapter 2, Section 4 of the Swedish Data Protection Act (2018:218), Sweden has set the age of digital consent at 13 (Article 8 GDPR allows member states to lower it from 16). • Members aged 13 or older can themselves consent to processing that is based on consent. • For members under 13, processing takes place via a guardian. Membly provides a dedicated guardian flow in which the parent creates an account for the child and retains control. • For minors in sports associations we minimise data collection. • Membly does not process special categories of personal data (Art. 9 GDPR) about minors for its own purposes. Where an association has a political, philosophical, religious or trade-union aim, membership itself can be such data. The association then processes it as controller, and Membly as the association's processor under the data processing agreement. • We do not profile minors and do not send marketing material to children. • National identity numbers are processed only where required for LOK subsidy reporting and are handled under a dedicated encryption routine.
9. Your rights under the GDPR
You have the following rights under Articles 15–22 of the GDPR: • Right of access (Art. 15): you can request a copy of the personal data we process about you. • Right to rectification (Art. 16): you can correct inaccurate or incomplete data directly in your account or by contacting us. • Right to erasure (Art. 17, the "right to be forgotten"): you can request erasure of your data. Some data we must retain because of legal obligations (e.g. accounting data). • Right to restriction of processing (Art. 18). • Right to data portability (Art. 20): you can export your data in a structured, commonly used format. Use Account → Export my data (corresponding to the API call POST /api/v1/profiles/me/export). • Right to object to processing (Art. 21), in particular to processing based on legitimate interests. • Right not to be subject to automated decision-making (Art. 22). To exercise your rights, contact privacy@membly.app. We respond within one month in accordance with Art. 12(3) GDPR.
10. Right to lodge a complaint with a supervisory authority
If you consider that our processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): Integritetsskyddsmyndigheten Box 8114 104 20 Stockholm, Sweden imy@imy.se www.imy.se We would appreciate it if you contacted us first at privacy@membly.app so that we have the opportunity to put any problems right.
11. Cookies and similar technologies
We use only strictly necessary cookies for the service to work (login sessions, security) together with functional local storage for your preferences (language, dark mode). We use no advertising cookies and no third-party analytics tools such as Google Analytics or Meta Pixel. Full information is available in our cookie policy.
12. The role and responsibilities of association administrators
When you as an administrator create an association in Membly, the association is the controller of the members' data. Membly is the processor and processes the data on the association's instructions in accordance with Article 28 of the GDPR. On registering an association, the administrator accepts Membly's data processing agreement (DPA) on the association's behalf. The association administrator is responsible for informing its members how their data is processed, for obtaining any necessary consents, and for handling the members' rights (access, rectification, erasure). Membly assists the association with technical tools for managing these obligations (member list, export, erasure on request).
13. Changes and contact
We may update this privacy policy. Material changes are notified by email to association administrators and by a notice in the app at least 30 days before the changes take effect. Minor linguistic or clarifying changes are published immediately with an updated "last updated" date. Contact: Monile AB ("Membly") Company reg. no. 559273-6051 Nackagatan 3, 116 41 Stockholm, Sweden Email: privacy@membly.app
Language versions
This document was drafted in Swedish. The English translation is provided for convenience only. In the event of any discrepancy between the versions, the Swedish version governs.