Data Handling
This page is published by Web Power and Light (WPAL), the software creator. A note on names: the membership plugin documented here is sold as Torii and as Memberium Universal (formerly Memberium for HighLevel). They are the same software, and everything in this document applies equally to both names.
The page covers what happens to data when you run Torii / Memberium on your own server: what leaves your site, where it goes, who can see it, and where the companies involved are established. It is written for compliance reviews, including UK and EU GDPR record-keeping. Everything here describes the plugin and WPAL's own operations. Where your license was obtained through Castle Mountain, they remain your point of contact and supplier of record, and this page links to their published policies rather than speaking for them.
The short version
- No personal data about your members is ever sent to WPAL. Member records (names, email addresses, tags, custom fields, whatever your members' data contains, health information included) live in your WordPress database and your CRM. The plugin moves member data only between your site and the destinations you configure, never to WPAL.
- On its own, the plugin makes exactly two kinds of outbound call: a license check and an update check. Both travel over encrypted HTTPS connections to servers operated by Web Power and Light in New York, United States, and neither can be turned off while the plugin is licensed, because both are part of how licensing works.
- The plugin sends no usage statistics and no error reports. There is no telemetry in the plugin.
- WPAL staff have no standing access to your site, your database, or your members' data. WPAL sees only what you send, or accesses your site if you create a login and give it to us.
- WPAL does not monitor customer systems.
- For compliance record-keeping, the accurate classification of WPAL is software supplier rather than data processor. The sections below are the evidence for that.
Who is who
Two companies are involved, depending on where your license came from:
- Web Power and Light, the software creator, established in Pennsylvania, United States. Sells Torii and Memberium Universal, and operates the license and update servers (both in New York, US). Contact: support@webpowerandlight.com · webpowerandlight.com
- Castle Mountain Limited (DBA MMMastery / Memberium), 1459 S 2050 E, Spanish Fork, UT 84660, United States. Licensed the software as Memberium for HighLevel until the license ended in September 2026, and remains the point of contact and vendor of record for customers licensed through them. Contact: support@memberium.com · Terms · Privacy policy
If your license was issued through Castle Mountain, they remain your point of contact and are responsible for notifying you of updates and security announcements.
What leaves your site
Two automated calls leave your site on the plugin's own initiative, both over encrypted HTTPS connections. A review of the plugin source confirms these are the only outbound calls it makes: no telemetry, no error reporting, no usage statistics, no feature that contacts any other external service. The CRM and webhook traffic described below is different; it leaves only at your direction.
License check
The plugin contacts the license server to verify your license is active. This happens on a regular schedule and when you activate. The check sends the following system information for license compliance:
| Field | What it is |
|---|---|
| Total user count | An integer number of user accounts on this site, never the accounts themselves |
| Site admin email | The site's administrative email address |
| CRM ID | The account ID your CRM provider assigns your account (how the CRM SaaS identifies you). Not personal data. |
| WP environment type | Production, staging, or development |
| Site URL | Your site's public URL |
| Site IP address | Your server's public IP address |
| PHP version | Server PHP version |
| Plugin SKU | Which edition you run (Memberium for Keap, ActiveCampaign, Universal, etc.) |
None of this can be disabled. The license server is operated by Web Power and Light and located in New York, United States. Data sent to it is retained for as long as the license record is active, and for 12 months after the license ends.
Update check
The plugin checks for available updates. The update check sends:
| Field | What it is |
|---|---|
| Site admin email | The site's administrative email address |
| Domain | Your site's host name |
| WP environment type | Production, staging, or development |
| PHP version | Server PHP version |
| Total user count | Number of user accounts, an integer count only |
| Plugin version | Installed version |
| WordPress version | Installed version |
The update server is operated by Web Power and Light and located in New York, United States. Like the license check, it cannot be disabled, and the same retention rule applies.
Data that leaves at your direction
Separately from those two calls, the plugin's core job is moving member data between your site and the services you connect it to: contact records, tags, and field values flow to your CRM account over the CRM's own API, using credentials you configure. Outgoing webhooks you set up can point at your CRM or any other service you choose. Those transmissions go to destinations you pick; we are never a party to them, and they are governed by your agreements with those services, not by us.
What never leaves
Everything else stays on your server: your members' names, email addresses, passwords, tags, custom field values (health data included), order history, and content access records. Your CRM holds its own copy of contact data under your CRM account, as it would without this plugin; that relationship is between you and your CRM.
Support access
WPAL staff can only access your site when you explicitly grant access, typically by creating a temporary administrator login and sending it to us. There is no remote-entry mechanism, no backdoor, and no way for WPAL to reach your site, database, or members without credentials you issue.
We recommend treating any support login like any privileged credential: create it for the support window and delete it immediately after the work is done rather than waiting for the ticket to close. Delete the account itself, not just the password, because a changed password can be remotely reset by email, while a deleted login closes that door. If you prefer, session logging plugins can record what an admin session did while we were signed in.
When you raise a support ticket, you choose what to send. WPAL sees only what you paste into the ticket or attach to it.
How a ticket is handled depends on where your license came from:
- Web Power and Light tickets run through support.webpowerandlight.com, which provides a secure, zero-knowledge mechanism for sensitive information including logins, email addresses of affected members: a login you share with us is never sent in plaintext, and it can be immediately expunged separately from the ticket history once the ticket closes.
- Castle Mountain tickets run through Zendesk, under Castle Mountain's own data handling practices.
Monitoring and security incidents
WPAL does not monitor customer systems: no uptime checks, no traffic inspection, no telemetry to alert us to conditions on your server.
If WPAL becomes aware of a security issue affecting the plugin itself, WPAL ships a fix as a plugin update, notifies direct Torii customers by email, and passes the announcement to Castle Mountain, who are responsible for notifying customers licensed through them. Keep your site set to auto-update, or update promptly when notified, since the update is the fix.
If a security incident affects the license or update infrastructure itself, WPAL notifies affected license holders by email where it holds their contact details, and notifies Castle Mountain so they can alert customers licensed through them. And because the system information described above includes a small amount of personal data (the site admin email address), a breach involving it would additionally be reported to the UK Information Commissioner's Office under WPAL's own controller obligations, and to the individuals affected where required.
Data processing agreements
Web Power and Light does not offer an Article 28 data processing agreement, because it is not a data processor: the plugin transmits no personal data about your members to WPAL, and WPAL staff access customer systems only when a customer issues credentials. Of the fields in the tables above, only the site admin email address could qualify as personal data under UK GDPR, and it identifies a member of your staff, not one of your members. For compliance record-keeping, the accurate classification of WPAL is software supplier rather than data processor.
If your license was obtained through Castle Mountain, your supplier relationship remains with them, and their data handling is their own to document: see their privacy policy. The statements on this page describe the plugin and WPAL's operations, and are not made on Castle Mountain's behalf.