fellos Privacy Notice

fellos is a membership platform for clubs and associations. It is operated by maClara, LLC, a Virginia limited liability company. See Section 14 for how to contact us.

Where we decide (controller). We decide how data is used for:

• signing up for fellos;
• your organization's fellos account and subscription;
• our emails to organization admins;
• support tickets and the "fellos AI" support chat, whoever uses them; and
• our own websites, fellos.app and signup.fellos.app.

This notice covers that data in full.

Where your organization decides (processor). Each organization's site holds its members' data, including profiles, member records, posts, messages, events, dues and store orders. The organization decides what to collect and why, and we process that data on its behalf. Its site's Terms and Privacy pages govern that relationship. Members should send questions and requests about their member data to the organization. If a member writes to us, we will pass the request on, or ask the member to contact the organization.

Section 7 describes the processing we do for organizations, so that they and their members can see which services we use. Our Data Processing Addendum (DPA) sets the terms of that processing, and organizations accept it when they accept our Terms of Service. We list the service providers we use for it (our subprocessors) at fellos.app/subprocessors. We will tell site admins by email, and update that page, at least 30 days before we add or replace a subprocessor. An organization that objects may cancel its subscription with immediate effect, and we will refund any fees it prepaid for the rest of the period.

When you sign up

Until you verify your email, we hold these details in a temporary signup record.

Your site address is public. Every site's address, custom domains included, is listed in a security certificate. Certificates are published in public Certificate Transparency logs, so anyone can see that your site's address exists.

While you set up your site

• Invitations. You can enter email addresses for co-admins and for up to 200 members. Those addresses belong to your organization's member data (Section 7). We use them only to send the invitations you asked for.
• Website import (optional). If you ask us to, we fetch your club's existing website. We then send its content to our AI provider to suggest a theme and front-page text. The setup wizard asks for your consent first.

When you buy a plan

We create a Stripe customer record with the purchaser's name and email address. You enter card details on Stripe's page; they never reach fellos. We keep your plan, subscription status and billing history.

When someone accepts our Terms of Service while buying or changing a plan, moving to the Free plan included, we record who accepted (their fellos user id), which version of the Terms, and when. We also record the plan, the matching Stripe checkout or subscription if there is one, and whether the checkout opened or the change was made or scheduled, as far as we could confirm at the time. We do not update the record later, for example if a scheduled change is called off. The record holds no IP address or browser details. At checkout, Stripe receives the Terms version and the accepting person's fellos user id as well.

When you use your site as an admin

• Emails from us. We send your site admins service emails: billing, security, domain and member-cap notices. These are part of the service and cannot be turned off while your account is open. Separately, we send tips, a weekly digest, milestone emails and re-engagement emails. Those carry an unsubscribe link. We keep a log of the automated emails we send to admins, so that we don't repeat them.
• Sign-in and security. When you sign in, we record the session. Each session record holds your browser's user agent, your IP address, and an approximate location (country, region and city). We look up the location in a database on our own servers, not through a third-party service. Your account also records when you last signed in and when you were last active.

When you contact support or use the support chat

• Support tickets. We keep the subject, messages and attachments you send, whether you open a ticket in the app or email support@fellos.app. fellos support staff read the thread. A site admin with Admin Mode on can also read every ticket opened on that organization's site.
• Staff "AI suggest". To draft a reply, our staff can send a ticket's subject and its last two visible messages to our AI provider. That includes tickets that arrived by email.
• "fellos AI" chat. The in-app assistant sends your chat to our AI provider to draft answers. We keep the chat transcript and a per-person count of how often you use it.
• Engineering tracker. Our staff may copy details of a ticket into an issue in our private engineering tracker on GitHub.

When you visit fellos.app

• Product analytics (HeyCatch), only after you accept (see Section 5).
• Demo requests. The demo form asks for your name, email, organization, kind of organization, role, member count, whether you have chapters, and a free-text message. We send it as one email to hello@fellos.app, with your address as the reply-to. The mailbox is hosted by Google (Google Workspace). We do not store the request in a database. We use your IP address in memory to limit form submissions to 5 per hour.

When you visit signup.fellos.app

• Product analytics (HeyCatch), only after you accept (see Section 5).

• Signup events we send to HeyCatch from our servers, only if you allowed analytics:

  • when you verify your email (with the starter template you chose, your site address, your signup date, and the link values described above);
  • when your site goes live (with your site address and how many minutes it took);
  • when you invite co-admins or members (counts and yes/no outcomes only); and
  • when you finish setup.

  Each event is labelled with your fellos user id (a random id, not your name or email). We send no personal names and no email addresses. Your site address often includes your organization's name.

Where the data comes from

We get most data from you. We get some from others: co-admin email addresses from the founder who invites them.

• Contract. Creating and running your account and subscription, sending the invitations you ask for, and providing support.
• Steps before a contract. Replying to a demo request (together with our legitimate interest in replying).
• Legitimate interests.
  • Keeping the service secure: session records, IP addresses and approximate location, and rate limits.
  • Keeping billing records.
  • Sending service emails, and the admin emails you can unsubscribe from.
  • Copying ticket details into our engineering tracker to fix what you report.
  • Learning how organizations find fellos, from the signup link values and your answer to "Where you heard about fellos".
  • Improving fellos: working out which features are used, and finding and fixing faults, from support tickets and the analytics you allow.
• Consent. Analytics cookies, signup events sent to HeyCatch, and the website import. You can withdraw consent at any time.
• Legal obligation. Tax and accounting records.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

fellos.app and signup.fellos.app

• Nothing for analytics loads until you accept. Our cookie banner has one optional category, "Analytics". HeyCatch loads only after you accept it. Before you choose, and after you reject, it does not load and sends nothing.
• No Google or advertising tags. Neither site loads Google Analytics, Google Ads or any other advertising tag.
• HeyCatch (product analytics). It keeps a random visitor id in a first-party cookie and in local storage for up to a year. If you reject or withdraw consent later, we clear its data from your browser.
• One choice for both sites. We save your choice in a fellos_consent cookie on .fellos.app for one year, with the time you made it. A choice made on either site applies on the other, and we don't ask you again. If you make different choices on the two sites, the newer one applies.
• Global Privacy Control. If your browser sends a GPC signal, we treat it as a rejection on both sites. It overrides every other setting.
• Linking your visits. When you verify your email, or later during setup if you allow analytics then, HeyCatch connects your earlier visits to fellos.app and signup.fellos.app with your new account. It uses only your fellos user id, never your email or name.
• To change your choice, use Cookie settings on either site.

Cookies on organizations' sites

Organizations' sites load no fellos analytics or advertising tags. Each organization configures its own cookie banner. Which kind of banner a visitor sees depends on their country, which we work out from their IP address on our own servers. If we can't tell the country, the visitor gets the banner that asks for consent before any optional cookie is set.

The fellos_consent cookie and the HeyCatch visitor cookie are set for all of fellos.app, so your browser also sends them to organizations' sites at <name>.fellos.app. Those sites do not use them for analytics or advertising.

"Do Not Track"

Our sites do not respond to browser "Do Not Track" signals. We honor Global Privacy Control on fellos.app and signup.fellos.app, as described above.

Cookie list

fellos also keeps short-lived sign-in security cookies, and some settings in local or session storage (such as drafts, including the signup form's draft on signup.fellos.app).

Consent records for organizations

Each organization configures its own cookie banner. When someone makes a choice on that banner, we keep a consent record for the organization. The record holds the choice, the region, whether a GPC signal was sent, the browser's user agent, and a hashed (pseudonymized) form of the IP address. For a signed-in member it also holds their user id; otherwise it holds a random anonymous id. The hash is short and unsalted, so it could be matched back to an IP address with effort. Treat it as personal data.

We do not sell personal data. We never use organizations' member data for advertising, and we do not use one organization's members to advertise to anyone.

We use these service providers for the data we control:

We may also disclose data:

• when the law requires it, or to protect rights, property or safety; and
• to a buyer or successor if our business is sold or merged. We will require the buyer to handle personal data in line with this notice, or tell you before that changes.

On each organization's instructions, fellos stores:

• member profiles and history;
• secondary members, such as spouses;
• workflow requests;
• election records;
• posts, comments, reactions and documents, with their revisions;
• direct messages;
• event RSVPs, tickets and check-ins;
• dues and store orders;
• sign-in methods;
• session records; and
• an audit log of admin actions.

The audit log records who acted, what changed, and the IP address.

Election ballots. fellos stores each ballot together with the voter's identity, to stop anyone voting twice and to show members their own ballot. The product shows a member's choices only to that member. Everyone else, election conductors and site admins included, sees only totals. Staff with database access could technically see individual ballots. We never look at them, except where the law requires us to.

Staff access. Our staff can see your organization's member list, billing and support tickets in our admin tools, and a small number of engineers have database access. We look at your data only to give support you ask for, fix problems, keep the service secure, or meet a legal obligation.

Link previews. When a member posts a link, our server fetches the page to build a preview.

We use these providers on the organization's behalf:

Payments from members are not on this list. When a member pays dues, buys a ticket or orders from a store, the payment goes through the organization's own Stripe account, which the organization connects to fellos. Stripe is the organization's provider, not ours: the organization is the merchant, and fellos is not a party to the payment. fellos sends that Stripe account the paying member's email address and ids that link the payment to the member and the item. For store orders it also sends the member's name and, where their profile has them, phone number and home address (as billing and shipping address).

Social sign-in is not on this list either. Sign-in with Google, GitHub or Apple uses sign-in apps the organization registers with those providers itself. They are the organization's providers, not ours.

Under contract with fellos, WATTER, Inc., which provides OTTO, keeps none of the content it receives and does not train on it. This covers every AI feature in this notice: search indexing, Ask AI, Summarize, the weekly digest, summary updates, the page helpers, the "fellos AI" support chat, staff "AI suggest" and the website import. That is a contractual commitment, not an audited one.

Group summaries can be turned off. A site cannot turn off the weekly digest summary, but each member can unsubscribe from the weekly digest. Search indexing and Ask AI cannot be turned off.

We are based in the United States, and we store all data in the United States, with Amazon Web Services in US East (Northern Virginia). Our subprocessor list at fellos.app/subprocessors shows where each service provider processes data. If you are outside the US, your data will be transferred there.

For personal data transferred from the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum. For organizations' data, both are incorporated in our DPA. We are not certified under the EU-US Data Privacy Framework.

When a site is paused, closed or ended

Section 13 of our Terms of Service and Section 11 of our Data Processing Addendum repeat this table word for word. To close a site and have its data deleted, a site admin can write to support@fellos.app from their own address.

• We store passwords only in scrambled form (bcrypt hashes).
• Every fellos site is served over HTTPS only.
• The passwords and keys fellos uses to connect to other services are stored encrypted.
• Organizations can require their admins, or all members, to set up a passkey.
• Card details go to Stripe and never reach fellos.

No system is perfectly secure. We hold no security certification, such as SOC 2 or ISO 27001.

If a personal data breach affects data we hold, we will tell the affected organizations' site admins without undue delay, and within 72 hours of becoming aware of it. Where the law requires, we will also tell the regulator.

Depending on where you live, you may have the right to:

• access your data, or get a copy of it;
• receive your data in a portable format;
• correct it;
• have it deleted;
• object to or restrict our use of it;
• withdraw consent;
• appoint an authorized agent to act for you (California);
• appeal our decision on your request, by replying to it (some US states); and
• complain to your data-protection authority.

To use these rights, write to privacy@fellos.app. We confirm your identity by asking you to reply from the email address on the account. We will respond within 30 days, or within 45 days for requests under US state privacy laws. We will not treat you differently for using your rights.

• Members of an organization: send requests about your member data to your organization. We will help it respond. If you write to us, we will pass the request to its admins. Requests about your own support tickets or "fellos AI" chats come to us.
• Cookies: use Cookie settings on fellos.app or signup.fellos.app, or send a Global Privacy Control signal.
• Emails: use the unsubscribe link in tips, digests and other non-essential admin emails. Service emails (billing, security, domain and member-cap notices) are part of the service and cannot be turned off while your account is open.
• California and other US states: fellos does not sell personal data. We honor Global Privacy Control signals on fellos.app and signup.fellos.app. We offer the same rights to access, correct and delete your data to everyone, wherever they live. Your account password is sensitive personal information. We use it only to sign you in.

Founders and site admins must be at least 18. fellos is not directed to children. We do not knowingly collect personal data from children for our own purposes: under 13 in the United States, and under the age set by local law, up to 16, in parts of the EU. If we learn that we have, we will delete it.

Organizations may add minors to their sites, for example in a youth auxiliary or as secondary members. The organization is responsible for getting any parental consent the law requires. If you believe we hold a child's data in error, write to privacy@fellos.app.

We will update this notice when our practices change, and change the date at the top. For a material change, we will email organization admins at least 30 days before it takes effect.

maClara, LLC (fellos), a Virginia limited liability company

Our subprocessor list is at fellos.app/subprocessors. Our Data Processing Addendum, which organizations accept with our Terms of Service, sets the terms on which we process their members' data.