Privacy Policy

1. Who we are

ChurchAlpha Inc. ("ChurchAlpha", "we", "us", "our") operates the church management platform available at www.churchalpha.com and app.churchalpha.com. We are the data controller for the information described in this policy.

Contact: privacy@churchalpha.com

2. What we collect

Account data: Name, email address, role, and church affiliation provided at sign-up.

Church data: Member records, giving history, event attendance, volunteer schedules, sermon notes, prayer requests, and any other content your church enters into ChurchAlpha. This data belongs to your church — we are processors, not owners.

Usage data: Pages visited, features used, timestamps, and browser/device type. Used to improve the product.

Payment data: Billing name, last 4 card digits, and invoice history. Raw card numbers are never stored — all payment processing is handled by Stripe.

Communications: Emails or messages you send to our support team.

Website live chat: When you use the chat on our website, we collect:

• ·Your messages, and any name, email address or phone number you choose to share.
• ·Images you upload, such as screenshots. We remove hidden photo data (like GPS location) and store images privately; only you and our team can view them.
• ·Your IP address, which we delete after 90 days.
• ·Your approximate location (city, state and country), estimated from your IP address.
• ·Device details: device type, operating system, browser, screen size and language.
• ·How you arrived (for example a search engine, social media or a link) and the pages you visit after starting a chat.

We use this to answer your questions, follow up on your enquiry, and see which pages lead people to ask for help. Chat replies may be written by an AI assistant, and a member of our team may join the conversation.

3. How we use it

• ·To provide and operate the ChurchAlpha platform.
• ·To process subscription payments via Stripe.
• ·To send transactional emails (receipts, password resets, account alerts).
• ·To provide customer support.
• ·To improve the platform through anonymised usage analytics.
• ·To comply with legal obligations.

We do not use your data for advertising. We do not use church member data to train AI or machine learning models.

4. Who we share data with

We share data only with the following sub-processors, each bound by a Data Processing Agreement:

• ·Stripe — payment processing. Bound by PCI DSS Level 1.
• ·Supabase — database and file storage. Bound by SOC 2 and GDPR.
• ·Clerk — authentication and session management. Bound by SOC 2 Type II.
• ·Vercel — web hosting and CDN. Bound by SOC 2 Type II.
• ·Anthropic — AI features, including AI-written replies in our website chat. Anthropic does not use this data to train its models.
• ·Resend — transactional and team alert emails.
• ·Neon — database for our cookieless website analytics (pages visited, referrer, country, device type).

We do not sell data to third parties. We do not share member data with advertisers, data brokers, or other churches. We will share data with law enforcement only when required by valid legal process.

5. Data retention

We retain your data for as long as your account is active. If you cancel your account, all data is permanently deleted within 30 days. Backups containing your data are purged on a rolling 30-day cycle.

Payment records may be retained for up to 7 years to comply with tax and accounting obligations.

Website chat conversations and images are kept for as long as we need them to follow up on your enquiry. IP addresses from chats are deleted after 90 days. You can ask us to delete a chat, or an image you sent, at any time by emailing privacy@churchalpha.com.

6. Your rights

You have the right to:

• ·Access — request a full copy of all data we hold about you.
• ·Correction — update or correct inaccurate data.
• ·Deletion — request permanent deletion of your account and all associated data.
• ·Portability — export all church data in CSV or JSON format at any time from Settings.
• ·Objection — object to certain types of processing.
• ·Restriction — request that we restrict processing in certain circumstances.

To exercise any of these rights, email privacy@churchalpha.com. We respond within 30 days.

7. Cookies

We use strictly necessary cookies for authentication and session management. We use analytics cookies (anonymised) to understand how the platform is used. We do not use advertising cookies.

You can disable non-essential cookies in your browser settings at any time.

Our website chat uses your browser's local storage (not cookies) to remember your conversation as you move between pages, whether you have muted chat sounds, and whether you have already seen a chat invitation during your visit.

8. GDPR & CCPA

For EU users (GDPR): ChurchAlpha acts as a data processor for the church (data controller). A Data Processing Agreement is available on request at privacy@churchalpha.com. Our lawful basis for processing is contract performance and legitimate interests.

For California users (CCPA): We do not sell personal information. California residents have the right to know, delete, and opt out of the sale of personal information. Contact us at privacy@churchalpha.com to exercise these rights.

9. Security

We use AES-256 encryption at rest, TLS 1.3 in transit, role-based access control, and row-level security to protect your data. For full details see our Security page.

10. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Continued use of ChurchAlpha after an update constitutes acceptance of the updated policy.

11. Contact

For privacy questions, data requests, or to report a concern:

Email: privacy@churchalpha.com

Response time: Within 30 days for data requests, within 2 business days for general enquiries.