Members never become WordPress users, so nothing about them appears in your WordPress user list. What the plugin does keep is small, short-lived, and reachable through the WordPress privacy tools.
What is stored while a member is signed in
On the member's device: a random session token in a cookie. Starting a sign-in also leaves three short-lived cookies that remember which page they came from and whether a sign-in went wrong, so the site can say so once. They last a quarter of an hour at most.
On your server, tied to that token: the member's memberarea identifier, display name, the address of their profile picture, and the times they signed in, were last seen and were last confirmed as a member. Their email address is stored only if you ticked Also share the member email address with this site when setting member login up.
Sessions end by themselves after a day without a visit, and after thirty days at the latest. Signing out deletes the session and the cached answers immediately.
For speed, the plugin also keeps the answers to "may this person see this" for two minutes at a time, and the member's course list for one minute. The lists the editor shows (products, courses, groups and badges) are kept for one minute and the course catalogue for five; neither holds anything about a member.
To slow down automated sign-in attempts, the plugin counts attempts per internet address for five minutes, storing a shortened one-way fingerprint of the address rather than the address itself.
What else is stored
Apart from members, the plugin keeps its settings (the memberarea domain and the
API key), the secret of the sign-in connection, and the last error it ran into.
Before an error is stored, the API key, the connection secret and anything that
looks like a memberarea key are replaced with [redacted], so the status panel
or a support screenshot never shows a credential.
The privacy policy text
Under Settings, then Privacy, on the Policy Guide tab, WordPress collects suggested wording from your plugins. MemberArea Connector adds five paragraphs there: how signing in works, what your site sends to the memberarea, what it stores, how long the cached answers live, and the cookies a sign-in leaves behind. Copy what fits into your own policy.
Export and erase requests
The plugin registers with the WordPress privacy tools, so requests under Tools, then Export Personal Data or Erase Personal Data, include it.
An export returns, for each session found: the memberarea identifier, display name, profile picture address, email address, the sign-in, last-seen and last-confirmed times, and any cached course list and access answers.
An erasure deletes the session and both caches, which signs that member out of your WordPress site.
WordPress looks people up by email address, and this plugin only holds one if you connected the site with email sharing switched on. Without it, a lookup here finds nothing, and both screens show a notice explaining that. The member's data lives in your memberarea, and the request has to be answered there.
A member who is not signed in right now is not known to your WordPress site at all. That is not a gap in the export; there is simply nothing stored.
What uninstalling removes
Deleting the plugin removes the settings, all sessions and all cached answers. It also revokes the connection in your memberarea, together with every member's consent for this site, but only while the saved API key is still valid and has Manage under WordPress. On a network, this happens only for the site the uninstall runs on. If you replaced or removed the key, save a working one before you delete the plugin; otherwise the connection stays on the memberarea side.
Access rules on pages are kept on purpose, so that reinstalling does not leave protected pages open.