Privacy Policy

1. Our Privacy Commitment

At ChurchConnect, your privacy and data security are our highest priorities. We understand that you are entrusting us with sensitive information about your church members and operations. This Privacy Policy explains how we collect, use, protect, and handle your information.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (encrypted and hashed)
• Church or association name
• Contact name and phone number
• Church location information (if provided)

2.2 Church Member Data

When you add members to your church directory, you may choose to store:

• Names, addresses, phone numbers, email addresses
• Dates of birth, anniversaries
• Family relationships
• Membership status and roles
• Attendance records
• Donation history
• Group memberships and volunteer assignments
• Custom fields you create

2.3 Financial Information

Payment Processing: We use Stripe for payment processing. We do not store credit card numbers or banking information on our servers. Stripe maintains PCI-DSS compliance and handles all payment data securely.

Financial Records: You may choose to store donation records and expense information within the platform for your church's financial tracking purposes.

2.4 Communication Data

When you send emails or SMS messages through ChurchConnect:

• Message content and recipients
• Delivery status and tracking information
• Email account credentials (encrypted) for SMTP sending

2.5 Usage Information

We automatically collect certain technical information:

• IP address and device information
• Browser type and version
• Pages visited and features used
• Login timestamps
• Error logs and performance metrics

3. How We Use Your Information

3.1 To Provide the Service

• Create and manage your account
• Store and organize your church data
• Send communications on your behalf
• Process payments and subscriptions
• Generate reports and documents
• Sync data with WordPress (if you enable this feature)

3.2 To Improve the Service

• Analyze usage patterns to improve features
• Fix bugs and technical issues
• Develop new features based on user needs
• Monitor system performance and security

3.3 To Communicate with You

• Send service-related notifications (password resets, billing updates)
• Respond to support requests
• Send important product updates or security alerts
• Occasional feature announcements (you can opt out)

3.4 What We DO NOT Do

4. How We Protect Your Information

4.1 Technical Security Measures

• Encryption: All data transmitted to and from ChurchConnect is encrypted using TLS/SSL
• Database Security: Data is stored on Supabase with enterprise-grade security
• Password Protection: Passwords are hashed using industry-standard algorithms
• Access Controls: Row-level security ensures users only access their own data
• Regular Backups: Automatic daily backups protect against data loss
• Security Monitoring: Continuous monitoring for suspicious activity

4.2 Administrative Security

• Limited employee access on a need-to-know basis
• Confidentiality agreements for all team members
• Regular security training and audits
• Incident response procedures in place

4.3 Your Role in Security

You can help keep your account secure by:

• Using a strong, unique password
• Not sharing your login credentials
• Logging out on shared devices
• Promptly reporting any suspicious activity

5. Data Sharing and Third Parties

5.1 Service Providers

We use trusted third-party services to operate ChurchConnect. These providers have access to certain data only to perform services on our behalf:

• Supabase: Database hosting and authentication
• Stripe: Payment processing
• Twilio (optional): SMS messaging if you enable this feature
• Email providers: Your own SMTP server for sending emails

All third-party providers are contractually required to protect your data and may not use it for any other purpose.

5.2 WordPress Integration

If you install our WordPress plugin, certain data (events, sermons, member directory) may be displayed publicly on your website. You control what data is synced and made public through the plugin settings.

5.3 Legal Requirements

We may disclose your information if required by law, such as:

• In response to a valid subpoena or court order
• To comply with legal obligations
• To protect our rights or the safety of others
• To prevent fraud or abuse

6. Your Data Rights

6.1 Access and Control

You have the right to:

• Access: View all data stored in your account at any time
• Edit: Update or correct any information
• Export: Download your data in common formats (CSV, Excel)
• Delete: Remove individual records or your entire account

6.2 Data Retention

Active Accounts: We retain your data for as long as your account is active.

Deleted Accounts: When you delete your account, you have 30 days to export your data. After 30 days, all data is permanently deleted from our systems. We may retain some information for legal or accounting purposes (e.g., payment records) as required by law.

Backups: Deleted data may persist in backups for up to 90 days before being purged.

6.3 Association Data

If your church is part of an association bulk account, the association administrator can view your church name, contact information, and activation status. They cannot access your member data, financial records, or communications.

7. Cookies and Tracking

7.1 Essential Cookies

We use cookies and similar technologies to keep you logged in, remember your preferences, and secure your account. These are essential for the Service to function.

7.2 Analytics

We use anonymized analytics to understand how users interact with ChurchConnect. This helps us improve the platform. We do not track individual users across websites.

7.3 Your Choices

You can configure your browser to reject cookies, but this may limit your ability to use certain features.

8. Children's Privacy

ChurchConnect is not intended for use by children under 13. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Note: Churches may store information about children as part of their member directory (with parental consent). This data is controlled by the church, not by ChurchConnect.

9. International Users

ChurchConnect is operated in the United States. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States.

GDPR Compliance: For users in the European Union, we provide GDPR-compliant data handling including the right to access, rectify, delete, and port your data. Contact us to exercise these rights.

10. Data Breach Notification

In the unlikely event of a data breach that affects your information, we will notify you via email within 72 hours of discovering the breach. We will also provide information about what data was affected and what steps we are taking to address the situation.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or through a prominent notice in the platform. Your continued use of ChurchConnect after such changes constitutes acceptance of the updated policy.

12. Contact Us About Privacy

If you have questions about this Privacy Policy or how we handle your data, please contact us:

We typically respond to privacy inquiries within 2 business days.