Privacy Policy

1. Administrative Account Information

We collect and control data about organization administrators who use Sodalo:

• Email address and name
• Organization name and setup details
• Login credentials (passwords are encrypted)
• Account creation date and last login

2. Billing Information

For paid plans, we store:

• Stripe customer ID and subscription status
• Plan type and billing history
• Payment method details (stored by Stripe, not by Sodalo)

Note: Credit card numbers are never stored on Sodalo's servers. All payment processing is handled by Stripe, our PCI-compliant payment processor.

3. Usage Data & Analytics

We collect anonymous usage data to improve the platform:

• Feature usage patterns (which features are used most)
• Page views and navigation flows
• Error logs and performance metrics
• Browser type, device type, and general location (city/state level)

This data is aggregated and anonymized. We use it to identify bugs, improve performance, and prioritize new features.

4. Data Security & Infrastructure

Sodalo implements industry-standard security practices:

• 256-bit SSL/TLS encryption for all data in transit
• Encrypted database storage (AES-256)
• Regular automated backups (stored encrypted)
• Access controls and role-based permissions
• Regular security audits and monitoring
• Two-factor authentication available for admin accounts

Member Data (Controlled by Your Organization)

Your organization controls how long member data is retained. We provide the tools; you make the decisions. Member data remains in your account until:

• You delete a member record manually
• You export and delete your entire organization
• Your organization's account is closed and the 30-day grace period expires

Administrative Account Data

Sodalo retains administrative user accounts according to the following schedule:

• Active accounts: Retained indefinitely while the organization subscription is active
• Canceled accounts: Soft-deleted immediately; hard-deleted after 30 days
• Inactive accounts: Accounts inactive for 2+ years may be archived after notice

Billing & Financial Records

We retain billing records for 7 years to comply with tax and accounting regulations. This includes:

• Invoices and payment receipts
• Subscription history
• Tax documentation

Data Export

All organizations (including free plan users) can export their complete data at any time:

• From your organization dashboard, go to Settings → Data Export
• Click "Download Complete Data Archive"
• You'll receive a ZIP file containing all member data, events, emails, dues records, and documents in JSON format
• Member roster can be exported as CSV from the Members page

There are no limits on how often you can export your data. We recommend exporting backups regularly.

For Organization Administrators

If you have questions about your administrative account, billing data, or how Sodalo processes your organization's data, contact us at:

[email protected]

We respond to privacy requests within 48 hours (24 hours for paid subscribers, typically faster during business hours).

GDPR (General Data Protection Regulation)

For organizations operating in the European Union:

• Your organization is the data controller for member data
• Sodalo acts as a data processor under GDPR Article 28
• Data processing agreement available upon request
• Member data export and deletion tools provided
• 72-hour breach notification commitment

CCPA (California Consumer Privacy Act)

California organizations and residents have the right to:

• Know what personal information is collected
• Request deletion of personal information
• Opt-out of data sales (note: Sodalo does not sell any data)
• Non-discrimination for exercising privacy rights