MemberRoute

Privacy Policy

Last updated October 22, 2026

MemberRoute is operated by Plainwork Software, a sole proprietorship based in New Jersey, USA (“we”, “us”). This policy explains what personal information we handle, why, who we share it with, and the choices you have.

Our two roles

  • For businesses that use MemberRoute and for visitors to memberroute.co, we decide how information is used (we are the “controller”).
  • For members - the customers of those businesses - we process information on the business’s behalf and follow its instructions (we are its “service provider” or “processor”). The business is responsible for its own privacy practices; if you are a member, please contact the business first.

What we collect

  • Business users: name, email, a hashed password, two-step verification secrets (encrypted), role, and the business’s details such as name, address, phone, support email and time zone.
  • Billing for your MemberRoute plan: subscription and invoice status from Stripe. Card numbers are entered on Stripe’s pages and never reach us.
  • Members (on behalf of businesses): name, email, optional phone, the covered item (for example a vehicle description, property address or pet name), service addresses for on-site visits, membership, service-use, booking and payment-status records, language preference, and records of consent to membership terms and to card-on-file charges.
  • Consent and security records: the text agreed to, the time, and a one-way hash of the IP address used.
  • Enterprise inquiries: the name, email, company, phone and message you send us.
  • Messages (on behalf of businesses): messages a member sends to a business and the business’s replies, the staff team thread, who sent each message and when.
  • Text reminders (on behalf of businesses): the mobile number a member gives, the consent wording and time, opt-outs, and a log of each reminder sent or received (number, text, time, delivery status).
  • Push notifications: the subscription record your browser or phone creates (an endpoint URL and encryption keys), which identifies the device but not you, and the time it was last used.
  • Branding files a business uploads, such as logos and fonts.
  • Technical information needed to run and protect the Service, such as IP addresses (processed by our hosting provider and stored by us only as one-way hashes for rate limiting), browser type and error logs.

Cookies

We use only cookies that are needed for the Service to work: sign-in cookies for business users and members, security cookies that protect forms and checkout, and a cookie that remembers a member’s language choice. We do not use advertising or cross-site tracking cookies, and we do not use third-party analytics.

How we use information

To provide and secure the Service: create accounts, run memberships, bill through Stripe, track included services and bookings, send transactional emails, push notifications and texts (receipts, reminders, sign-in links and required notices), deliver messages between members and businesses and within a business’s team, prevent fraud and abuse, provide support, keep audit records, and meet legal obligations. We do not read conversations as a matter of course; we may review one when it is reported, flagged by automated abuse checks, or required by law, and we report apparent child exploitation to NCMEC as US law requires. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising or profiling that has legal effects.

Who we share it with

We share information only as needed to run the Service, with these providers acting on our behalf:

  • Cloudflare - hosting, database, security and network services;
  • Stripe - payments, subscriptions and business verification (Stripe also acts under its own privacy policy for payment data);
  • Resend - delivery of transactional email.

Member information is available to the business the member joined, and to that business’s team according to their roles. We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a sale or reorganization of our business (in which case this policy continues to apply).

How long we keep it

Messages and the text-reminder log are kept as part of the business’s records while its account is open, and are deleted with the rest of its data afterwards. Push subscriptions are removed when the member turns them off or the device stops accepting them.

We keep account and membership information while the business’s account is open. After an account is closed, we delete or anonymize it within 90 days of a request, except records we must keep for legal, tax, dispute or fraud-prevention reasons, such as consent records, invoices and audit logs. The contents of emails that contain sign-in or password-reset links are deleted from our systems once they are sent. Automatic database backups roll off after 30 days.

Security

Data is encrypted in transit and at rest, access is role-based with audit logs, and privileged users must use two-step verification. See our Security page for details. If a breach affects your personal information, we will notify the affected business and, where required, you and the authorities.

Your choices and rights

  • Business users can view, correct and export their data in the app, and can ask us to delete their account.
  • Members can download their data from the member portal and can ask the business to correct or delete it. If you contact us about a business’s member data, we will pass your request to that business and help it respond.
  • Depending on where you live - including New Jersey, California, Colorado, Connecticut, Virginia and other US states with privacy laws - you may have the right to know what we hold about you, get a copy, correct it, delete it, and opt out of sale, targeted advertising or profiling (we don’t do those). You can appeal if we decline a request.

To make a request, email the support address below. We will verify your identity before acting, respond within the time the law requires (usually 45 days), and never treat you differently for using your rights. An authorized agent can make a request for you with your written permission.

Children

MemberRoute is not directed to children, and we do not knowingly collect personal information directly from children under 16.

Where information is processed

We are based in the United States. Our providers may process information in the US and in other countries where they operate, with appropriate safeguards.

Changes to this policy

If we make material changes, we will update the date above and email business account owners before the changes take effect.

Contact

Plainwork Software (MemberRoute) · support@memberroute.co