Privacy Policy

1. Overview

ChurchGains LLC (a DBA of Gaines Pro Holdings LLC - Series Church Gains) (“Company”, “we”, “us”, or “our”), operates the Church Gains application (“Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Church Gains is an AI-powered analytics platform that helps churches analyze data from Planning Center Online. We take your privacy seriously and are committed to being transparent about our data practices.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service. By accessing and using Church Gains, you acknowledge that you have read, understood, and agree to be bound by all the provisions of this Privacy Policy.

2. Information We Collect

We collect information in various ways to provide and improve our Service. The types of information we collect are as follows:

2.1 Account Information

When you sign up for Church Gains, we collect the following account information through Planning Center OAuth authentication:

• Your name
• Your email address
• Your Planning Center user profile information

Important:We do not store passwords. Authentication is handled entirely through Planning Center's OAuth system, and your credentials are never transmitted to our servers.

2.2 Planning Center Data

When you authorize Church Gains to access your church's Planning Center account, we can access and process the following types of data, depending on the permissions you grant:

• People records (names, email addresses, phone numbers, mailing addresses)
• Membership and engagement data (status, attendance history, group memberships)
• Volunteer assignments and historical volunteer data
• Giving data (donation history, giving trends, anonymous giving records)
• Check-in data (service attendance, event attendance, nursery records)
• Ministry-specific data (groups, classes, volunteer schedules)

You control which data we can access through Planning Center's permission scopes. You can modify permissions at any time or revoke Church Gains' access entirely by disconnecting the integration in your account settings.

2.3 Usage Data

We collect information about how you use Church Gains:

• Questions you ask in “Ask Your Data” feature
• Forms and images you upload to “Snap-to-Import” feature
• Reports and data exports you request
• Features you use and frequency of use
• Time spent in the application

2.4 Device and Technical Information

We automatically collect technical information when you access Church Gains:

• IP address and geolocation data
• Browser type and version
• Operating system and device type
• Pages visited and time spent on each page
• Referral source and exit pages
• Error logs and system activity

This information is collected through server logs and analytics services and is used for security, troubleshooting, and service optimization.

2.5 Payment Information

We do not directly collect or store credit card information. All payment processing is handled by Stripe, our third-party payment processor. When you enter payment information, you interact directly with Stripe's secure servers. Church Gains only receives confirmation of successful payment and does not have access to your complete credit card details.

2.6 Communications

When you contact us or subscribe to our communications, we may collect:

• Email address and name
• Message content and attachments
• Communication preferences and subscription status

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

• Authenticating your account and maintaining your session
• Processing your data queries and requests
• Generating analytics, reports, and insights from your Planning Center data
• Providing customer support and responding to your inquiries

3.2 Feature Functionality

• Ask Your Data:Processing natural language questions about your church's data using AI. Your questions and relevant church data are transmitted to Anthropic's Claude AI for analysis. See section 4 for details on how this data is handled.
• Snap-to-Import: Extracting form field data from images you upload to automatically populate records. Images are processed by our AI system.
• AI Weekly Digest: Generating automated reports and insights from your church data each week.

3.3 Service Improvement

• Analyzing usage patterns to improve features and user experience
• Identifying and troubleshooting technical issues
• Developing new features and enhancements
• Training and improving our AI models' accuracy for church-specific data queries (with data anonymization)

3.4 Security and Compliance

• Detecting and preventing fraud, abuse, and security incidents
• Protecting against unauthorized access and data breaches
• Maintaining audit logs for compliance and accountability
• Enforcing our Terms of Service and other legal agreements

3.5 Communication

• Sending transactional emails (account confirmations, password resets, billing notifications)
• Sending service announcements and updates
• Responding to your requests and inquiries
• Sending marketing communications (with your opt-in consent)

3.6 Legal and Business Operations

• Complying with legal obligations and court orders
• Establishing, exercising, or defending legal claims
• Protecting the rights, property, and safety of Church Gains, our users, and the public

We do not sell your personal information to third parties. We do not use your data for advertising purposes or to build marketing profiles about you.

4. AI Processing and Data Transmission

Church Gains uses AI to help you analyze your church data. This section explains how your data is handled during AI processing.

4.1 Ask Your Data Feature

When you ask a natural language question about your church data (e.g., “How many visitors did we have last month?”), the following occurs:

1. You submit your question through the Church Gains interface
2. We identify the relevant data from your Planning Center records
3. Your question and the relevant data context are transmitted to Anthropic's Claude API for analysis
4. Claude processes your question and returns an answer
5. We display the answer to you in the Church Gains interface

Data Privacy for Claude:According to Anthropic's API terms, data transmitted to Claude for processing is not used for training or shared with other parties. Data is sent only to answer your request; Anthropic may keep request logs for a limited period for abuse monitoring under its own policies. Anthropic does not build profiles on your data.

4.2 Snap-to-Import Feature

When you upload images of forms to extract field data:

1. You upload an image to Church Gains
2. The image is transmitted to our AI system for field extraction
3. Extracted data is returned to you for review and approval before importing into Planning Center
4. Images are deleted from our servers after extraction and are not retained

4.3 Data Security During Transmission

• All data transmitted to third-party AI services is encrypted in transit using TLS 1.2 or higher
• We minimize the data sent to AI services—only the information necessary to answer your question
• We do not transmit Planning Center API keys or authentication credentials to AI services
• Personally identifiable information (like individual names or phone numbers) is masked when possible

4.4 iOS App

• When you photograph a card or form in the Church Gains iOS app, the text is read on your device using Apple's on-device text recognition. The photo is not uploaded to Church Gains.
• Only the fields you review and choose to submit are sent to our servers, and from there to Planning Center.
• Questions you ask in the app are sent to our servers and handled and stored the same way as questions asked on the web (see 4.1 and Section 8).

5. Third-Party Service Providers

We use third-party service providers to deliver Church Gains and support our operations. These providers are contractually bound to protect your data and use it only for the purposes we authorize. Below are the key services we use:

5.1 Anthropic (AI Processing)

• Location: San Francisco, California, USA
• Purpose: Processing natural language queries about your church data through Claude API
• Data Sharing: Questions and relevant church context data required to answer your queries
• Data Retention: Anthropic may keep request logs for a limited period for abuse monitoring under its own policies
• Privacy: Anthropic does not use API data for model training

5.2 Planning Center Online (Church Data Platform)

• Location: Carlsbad, California, USA
• Purpose: Source of your church data; we access their API with your authorization
• Data Sharing: We retrieve data through their API and request data on-demand; we do not cache all church records permanently
• Data Retention: See section 6 for details on how we store Planning Center data

5.3 Supabase (Database and Backend)

• Location: San Francisco, California, USA
• Purpose: Hosting our database, storing your account data, OAuth tokens, and audit logs
• Data Stored: Encrypted OAuth tokens, account information, pending form submissions, audit logs
• Security: Data encrypted at rest; row-level security policies enforce tenant isolation by organization ID

5.4 Vercel (Application Hosting)

• Location: San Francisco, California, USA
• Purpose: Hosting the Church Gains web application and running serverless functions
• Data Access: May receive request logs and error tracking data

5.5 Stripe (Payment Processing)

• Location: San Francisco, California, USA
• Purpose: Processing subscription payments and managing billing
• Data Handling: Stripe handles all credit card information directly; we do not store card details
• Privacy: See Stripe's privacy policy for details on their payment processing practices

5.6 Resend (Email Service)

• Location: San Francisco, California, USA
• Purpose: Sending transactional emails (confirmations, notifications, receipts)
• Data Shared: Your email address and message content for emails we send on your behalf

5.7 Data Processor Agreements

We have Data Processor Agreements (or equivalent contractual protections) in place with all service providers that process personal data on our behalf. These agreements require providers to maintain appropriate security measures and limit their use of data to our specified purposes.

6. Data Storage and Security

6.1 How We Store Your Data

• OAuth Tokens: Encrypted at rest in Supabase using AES-256 encryption. Tokens are row-level secured by organization ID.
• Account Information: Your name, email, and account settings stored securely in Supabase
• Planning Center Data: We do not permanently cache your full Planning Center records. Data is retrieved on-demand from the Planning Center API when you request it.
• Pending Form Submissions: Form data awaiting import is temporarily stored in Supabase, then deleted after successful import or after 30 days
• Query Logs: Questions asked in “Ask Your Data” are logged for 90 days to help us improve accuracy, then anonymized
• Audit Logs: All data mutations (inserts, updates, deletes) are recorded in an insert-only, tamper-resistant audit log retained for 2 years

6.2 Security Measures

We implement multiple layers of security to protect your data:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Encryption at Rest: Sensitive data including OAuth tokens is encrypted at rest using AES-256
• Row-Level Security: Database queries are filtered by organization ID to ensure data isolation between customers
• Server-Only Token Handling: Planning Center and Stripe API keys are never exposed to the client browser
• Secure Session Management: Session cookies are marked httpOnly and secure, preventing JavaScript access and transmission over unencrypted connections
• Access Control: Only authorized employees can access production data, and access is logged
• Regular Security Testing: We conduct regular security audits and penetration testing

6.3 Data Breach Response

In the unlikely event of a security breach that affects your personal information, we will:

1. Notify you as soon as reasonably possible
2. Provide details about what happened and what data may have been affected
3. Explain the steps we're taking to secure your account and prevent future breaches
4. Provide resources and support to help protect you from potential harm

Notifications will be sent to the email address associated with your account.

7. Children's Privacy

Church Gains is designed for use by authorized church staff and volunteers, not children. We do not knowingly collect personal information directly from children under age 13.

However, Church Gains processes children's records as part of Planning Center data (such as check-in records, nursery attendance, and volunteer assignments for children's ministry). This data is:

• Only accessible to authorized church staff accounts: Only users who have been granted Planning Center access can see this data within Church Gains
• Subject to the church's responsibility: Your church is responsible for obtaining parental consent for children's data in Planning Center, consistent with COPPA and other applicable laws
• Protected by the same security measures: Children's data receives the same encryption and access controls as all other data

If a parent or guardian believes Church Gains has collected personal information from a child under 13 directly (not through Planning Center), please contact us immediately at privacy@churchgains.com.

8. Data Retention

We retain your data only as long as necessary to provide our Service and comply with legal obligations. Our retention practices are as follows:

8.1 Active Account Data

• Account Information: Retained while your account is active. Deleted within 30 days of account termination.
• OAuth Tokens: Retained while your account is active. Deleted within 30 days of account termination or when you disconnect the integration.
• Planning Center Data Cache: Real-time API access; not permanently retained. Only temporary pending form submissions are stored (up to 30 days).

8.2 Usage Data

• Ask Your Data Queries: Retained for 90 days for service quality improvement, then anonymized. Anonymized data is retained indefinitely for aggregate analytics.
• Snap-to-Import Images: Deleted immediately after extraction; not permanently retained.

8.3 Technical and Audit Data

• Server Logs: Retained for 30 days for security and troubleshooting purposes.
• Audit Logs: Retained for 2 years for compliance, security, and accountability purposes.

8.4 Legal Hold

If we receive a legal demand (court order, subpoena, law enforcement request) to preserve data, we will retain that data as required by law, even if it would normally be deleted.

9. Your Privacy Rights and Choices

Depending on where you reside, you may have certain legal rights regarding your personal information. We are committed to honoring these rights.

9.1 All Users

All users have the following rights:

• Right to Access: You can request a copy of all personal information we hold about you.
• Right to Correction: You can request correction of inaccurate or incomplete information.
• Right to Deletion: You can request deletion of your account and associated data.
• Right to Data Portability: You can request your data in a portable, machine-readable format.
• Right to Withdraw Consent: If we process data based on your consent, you can withdraw that consent at any time.
• Right to Disconnect: You can revoke Church Gains' access to Planning Center at any time, which terminates our ability to access or process your church data.

9.2 California Residents (CCPA Rights)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request what personal information we collect, the sources, our purposes for use, and the categories of third parties we share data with.
• Right to Delete: You can request deletion of personal information we have collected from you (with certain legal exceptions).
• Right to Opt-Out of Sale: You can request that we do not sell your personal information. We do not sell your personal information, and we do not use it for targeted advertising. This right is therefore not applicable.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA right.
• Right to Limit Use: You can request that we limit our use of sensitive personal information.

Note: Some information (like OAuth tokens) may be necessary for service delivery. If you request deletion, your account may be terminated.

9.3 European Residents (GDPR Rights)

If you reside in the European Union, UK, or other jurisdictions with similar data protection laws, you have the following rights:

• Right to Access: Request a copy of your personal data in a portable format.
• Right to Erasure: Request deletion of your data (right to be forgotten).
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Object: Object to specific processing (e.g., automated decision-making, profiling).
• Right to Data Portability: Receive your data in a portable, machine-readable format.
• Right to Lodge a Complaint: Contact your local data protection authority if you believe we have violated your rights.

9.4 How to Exercise Your Rights

To exercise any of these rights, please submit a request to:

Email: privacy@churchgains.com

Please include the following in your request:

• Your name and email address associated with your Church Gains account
• A clear description of the right you are exercising
• Any relevant account or transaction information

We will verify your identity before processing your request to ensure we are disclosing or deleting data only for the correct individual. We will respond to your request within 30 days (45 days for GDPR requests) or notify you if an extension is necessary.

9.5 Cookies and Tracking

Session Cookies: Church Gains uses session cookies to maintain your authenticated session. These are necessary for the Service to function. Session cookies are marked httpOnly and secure.

Tracking Cookies: We do not use third-party tracking cookies, advertising cookies, or retargeting pixels.

Analytics: We may use analytics services to understand how users interact with Church Gains. You can opt out of analytics by contacting privacy@churchgains.com.

For detailed information about cookies, see our Cookie Policy.

9.6 Marketing Communications

We may send you marketing emails about new features, tips, and offers. You can opt out by:

• Clicking the “Unsubscribe” link in any marketing email
• Contacting privacy@churchgains.com with your request
• Adjusting communication preferences in your account settings

Transactional emails: We will continue to send you transactional emails (like billing confirmations and account alerts) even if you opt out of marketing communications, as these are necessary for your account.

10. International Data Transfers

Church Gains is operated in the United States. If you reside outside the United States, your data will be transferred to and processed in the United States.

By using Church Gains, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules. These countries include the United States, where our servers and service providers are located.

For European Users: We rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards to ensure your data is protected when transferred internationally. You have the right to request details on the transfer mechanisms we use. Contact privacy@churchgains.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The “Effective” date at the top of this page indicates when the policy was last revised.

Material Changes: If we make material changes to how we process your data or to your privacy rights, we will notify you by email at least 30 days before the changes take effect. Your continued use of Church Gains after the new policy becomes effective constitutes your acceptance of the revised Privacy Policy.

Minor Changes: We may make minor updates (such as correcting typos or clarifying language) without notice.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:

• Email: privacy@churchgains.com
• Company: ChurchGains LLC
• Address: Delaware, USA

We are committed to transparency and will respond to your inquiries promptly. For privacy concerns or complaints, you may also contact your local data protection authority.

13. Summary of Key Privacy Commitments

To summarize, here are Church Gains' core privacy principles:

• We do not sell your data. Your personal information is never sold to third parties for any reason.
• We encrypt your data. OAuth tokens and sensitive information are encrypted both in transit and at rest.
• We minimize data retention. Planning Center data is accessed in real-time and not permanently cached. AI query logs are retained only 90 days.
• We respect your choices. You control which Planning Center permissions you grant, and you can disconnect at any time.
• We are transparent. This policy explains exactly how we collect, use, and protect your data.
• We protect your rights. We comply with CCPA, GDPR, and other privacy laws, and we honor all data subject requests.