Members never become WordPress users, so nothing about them appears in your WordPress user list. What the plugin does keep is small, short-lived, and reachable through the WordPress privacy tools.
What is stored while a member is signed in
On the member's device: a random session token in a cookie. Starting a sign-in also leaves three short-lived cookies that remember which page they came from and whether a sign-in went wrong, so the site can say so once.
On your server, tied to that token: the member's memberarea identifier, display name, the address of their profile picture, and the times they signed in, were last seen and were last confirmed as a member. Their email address is stored only if you ticked that option when setting member login up.
Sessions end by themselves after a day without a visit, and after thirty days at the latest. Signing out deletes the session and the cached answers immediately.
For speed, the plugin also keeps the answers to "may this person see this" for two minutes at a time, and the member's course list for one minute.
To slow down automated sign-in attempts, the plugin counts attempts per internet address for five minutes, storing a shortened one-way fingerprint of the address rather than the address itself.
The privacy policy text
Under Settings, then Privacy, on the Policy Guide tab, WordPress collects suggested wording from your plugins. memberarea Connector adds five paragraphs there: how signing in works, what your site sends to the memberarea, what it stores, how long the cached answers live, and the cookies a sign-in leaves behind. Copy what fits into your own policy.
Export and erase requests
The plugin registers with the WordPress privacy tools, so requests under Tools, then Export Personal Data or Erase Personal Data, include it.
An export returns, for each session found: the memberarea identifier, display name, profile picture address, email address, the sign-in, last-seen and last-confirmed times, and any cached course list and access answers.
An erasure deletes the session and both caches, which signs that member out of your WordPress site.
WordPress looks people up by email address, and this plugin only holds one if you connected the site with email sharing switched on. Without it, a lookup here finds nothing, and both screens show a notice explaining that. The member's data lives in your memberarea, and the request has to be answered there.
A member who is not signed in right now is not known to your WordPress site at all. That is not a gap in the export; there is simply nothing stored.
What uninstalling removes
Deleting the plugin removes the settings, all sessions, all cached answers, and revokes the connection in your memberarea. Access rules on pages are kept on purpose, so that reinstalling does not leave protected pages open.