Tax & law
Your member list and GDPR, in practice
What you can do without extra consent, and the three cases where you need it.
Managing a paid membership justifies processing personal data: it's the performance of a contract. Many creators ask for consent they don't need, and forget the one that's missing.
| Use | Legal basis | Consent required |
|---|---|---|
| Sending paid posts | Contract | No |
| Billing, chasing an unpaid invoice | Contract | No |
| Keeping invoices for 7 to 10 years | Legal obligation | No |
| General newsletter | Legitimate interest or consent | Depends on the country |
| Publishing the name in credits | Consent | Yes |
| Sharing with a third party | Consent | Yes |
The right to erasure has one useful limit: your accounting obligations take precedence. A member who requests deletion of their data gets their profile erased, not their invoices.