Privacy Policy

This Privacy Policy explains how [Company legal name] ("Shepherd's View," "we," "us") collects, uses, discloses and protects information through Shepherd's View: the website at shepherdsview.app, the church websites, member apps and dashboards we host for churches, and related services (together, the "Service").

Please read the sections on what your church can see and access by Shepherd's View personnel carefully. They describe how information you put into the Service is shared, including religious, pastoral and health-related information.

1. Who we are

Shepherd's View is operated by [Company legal name], [Mailing address]. You can reach us about privacy at [privacy email].

Shepherd's View provides software to churches and ministries (each a "Church"). Each Church has its own website, member area and dashboard on the Service. In this policy, "Members" are people with an account at a Church; "Church Staff" are Members a Church has given an editor, pastor or administrator role; and "Visitors" are people using a Church's website or our website without signing in.

2. Our two roles

When we act for a Church. Most information on the Service is collected for a Church: its members' accounts and profiles, prayer requests, Lamp conversations, attendance, giving, connect cards, newsletters and texts, and its website content. For that information, the Church decides what to collect and how to use it, and we process it to provide the Service to the Church, under our agreement with the Church, and as this policy describes. The Church's own privacy policy (often at /privacy on the Church's website) also applies, and the Church is responsible for its own practices. If you have questions about how a Church uses your information, or want to exercise a right over it, please contact that Church first. We will help the Church respond.

When we act for ourselves. We decide how to use information about: people who visit shepherdsview.app, request our demo, or sign a Church up; the people who manage a Church's account and billing; our own personnel; and information we use to secure, operate, support, improve and protect the Service (see section 8).

Each Church is separate. A Member's account belongs to one Church; the same email address at two Churches is two separate accounts, and one Church cannot see another Church's information.

3. Information we collect

We collect the information described below. Which of it applies to you depends on how you use the Service and on the features your Church turns on.

3.1 Churches and the people who sign them up

• Sign-up and account information: church name, the web address you choose, the account owner's name, email address and password, the IP address used to sign up, and the date.
• Account and billing information: plan, trial and subscription status, custom domains, billing contact, and records of payments, failed payments and renewals received from our payment processor. Card details are entered on Stripe's pages and are not received or stored by us.
• Communications: messages you send us, and records of service emails we send to account owners and administrators.

3.2 Demo requests

Before opening our live demo, we ask for your first and last name, email address, church name, your role, your church's approximate attendance, an optional phone number, and whether you would like occasional product news. We record the IP address used. While you use your demo copy, we record which parts of the product you look at, how many pages you open, when you were last active, whether you used the emailed link, and whether you later sign up a church. Demo copies are erased after about 24 hours; the lead record is kept as described in section 13.

3.3 Member accounts

• Account information: name, email address, password (stored only as a one-way hash), the invite code used to join, your role at the Church, approval date, language and Bible-translation preferences, whether you confirmed you are 13 or older (where the Church requires it), and two-factor sign-in settings.
• Directory and profile: photo, phone number, address, birthday, household, and your choices about which of these other Members may see.
• About me: how you prefer to be contacted, your wedding anniversary, interests, skills, when you are available to serve, what you would like to grow in spiritually, things you would like help with (for example, meals, rides, financial help or talking with a pastor), ongoing prayer needs, and whom you choose to share this with.
• Family: the names, relationships and birthdays of people in your household, which may include children.
• Life events: news you share or Church Staff record, such as a new baby, wedding, hospital stay, illness or surgery, the loss of a loved one, a difficult time, a new or lost job, a move, graduation, retirement or baptism, with an optional note.
• Monthly check-in: your answer to "How are you doing?" (doing well, could use prayer, struggling, or would like someone to contact you).
• Prayer: prayer requests you post, the visibility you choose, answered-prayer notes, and when you indicate you prayed for someone's request.
• Lamp: questions you ask Lamp, the answers shown, saved verses, and how many questions you ask each day (see section 7).
• Groups, attendance and serving: small groups and ministries you join or ask to join (with any message you include); services and group meetings you or your family attend, whether you checked in on your phone or were added by Church Staff or a group leader; volunteer opportunities you sign up for; and event RSVPs.
• Notifications and texts: if you turn on push notifications, the push address your browser provides and your notification categories; if you sign up for texts, your phone number, your opt-in and confirmation, opt-outs, and messages you send.

3.4 Information Visitors give a Church

• Connect cards: name, email, phone, date of first visit, how you heard about the Church, what you are interested in, how you would like to be contacted, an optional prayer request, and whether you agreed to receive texts.
• Contact forms and newsletter sign-ups: name, email address and your message; newsletter subscription and unsubscribe records.
• Giving: if a Church uses the Service's built-in giving, your name, email address, the amount, fund, frequency, whether you covered the processing fee, and payment status and references. Payments are processed by Stripe on the Church's own Stripe account, and your card or bank details go to Stripe, not to us. If a Church links to or embeds another giving provider, that provider collects your information under its own policy.

3.5 Church content

Churches add pages, sermons, audio, video links, events, articles, images, documents, menus, settings, their statement of faith and similar content. Church Staff may also import content from a Church's existing website. Uploaded images are re-encoded, which removes location and other embedded metadata.

4. Information collected automatically

• Member-area activity. When you are signed in and use the member area of a Church's site, we record each page you open there (the page address, without search terms or other query details) and the time. This activity is associated with your account and is visible to authorized Church Staff, as described in section 10. We also record your most recent sign-in and the most recent day you used the member area or dashboard.
• Public-site statistics. On Church websites we count page views, the pages viewed, and where visitors came from (for example, a search engine or social network). To count visitors without cookies, we compute a one-way code from the visitor's IP address, browser information and a secret that changes daily; the code is kept for two days and the IP address is not stored for this purpose. Visits are not counted when your browser sends a Global Privacy Control or Do Not Track signal, and Church Staff's own visits are not counted. These statistics are shown to the Church only as totals.
• Device, network and log information. Our servers and our infrastructure provider receive standard information with each request, such as IP address, browser and device type (user agent), the page requested, referring page, and date and time. We use IP addresses for security, rate limiting and abuse prevention, and record them in certain records: sign-up requests, demo requests, a Church's audit log of sensitive actions, and our internal log of actions by Shepherd's View personnel.
• Security and bot checks. Our sign-up and demo forms use Cloudflare Turnstile, which collects signals from your browser to tell people from automated programs.

We do not collect precise geolocation, and we do not access your device's camera or microphone.

5. Cookies and similar technologies

The Service uses a small number of first-party cookies and browser storage items that it needs to work:

We do not use advertising cookies, and the Service does not include third-party analytics or advertising tags such as Google Analytics or social-media pixels.

Third-party content. Some pages load content from other companies, and those companies receive your IP address and browser information when they do, and may set their own cookies under their own policies:

• Fonts are loaded from Google Fonts on our pages and Church pages.
• Church pages may include maps from Google Maps, and videos from YouTube (using its privacy-enhanced mode), Vimeo (with its "do not track" option) or Facebook, when the Church adds them.
• A Church may link to or embed another company's giving page.
• Push notifications are delivered through your browser maker's push service (for example, Google, Apple, Mozilla or Microsoft).

6. Information we derive

To help Church Staff care for their people, the Service derives information from what Members and Visitors provide and do. For example, it may:

• sort Lamp questions into themes (such as anxiety, grief or marriage), and flag messages that may indicate a crisis;
• identify prayer requests and life events that appear to mention a hospital stay or illness, using automated word matching;
• identify regular attenders who have not attended, been to their group or used the member area for 30 days or more, and volunteers who have stopped serving;
• list people who asked to speak with a pastor, said they are struggling, asked for help, or are looking for a small group;
• show upcoming birthdays and anniversaries (unless you turn off "celebrate with me"), new babies, hospitalizations and first-time visitors;
• suggest groups to you based on your interests, and suggest you to Church Staff for volunteer opportunities based on your skills and availability; and
• summarize monthly check-in answers as percentages.

These results are shown to authorized Church Staff (generally pastors) and are not used for any decision that produces legal or similarly significant effects. They are generated automatically and may be incomplete or wrong.

7. Lamp and AI

Lamp is a scripture guide in the member app. How it handles your questions depends on settings your Church chooses:

• Answering. By default, Lamp answers using a built-in scripture search that does not use artificial intelligence. If your Church turns on AI answers, the text of your question is sent to a large language model to write a short reply and suggest passages. The model receives your question, your Church's name, the name your Church gives Lamp, your Church's statement of faith, and candidate Bible passages. It does not receive your name, email address or other account details, although anything you write in your question is included.
• AI providers. AI answers are generated through Amazon Bedrock, operated by Amazon Web Services, in a region permitted by us and chosen by your Church, under AWS's service terms. If we allow it and your Church chooses, the model may instead run on a server operated by your Church or its vendor, in which case your Church is responsible for that server.
• What your Church can see. A notice under the Lamp question box tells you how your Church handles questions. Your Church chooses whether pastors see each question with your name, see questions without names, or see only theme counts. Where questions are kept, they are kept with the answer shown and any follow-up notes pastors add, until your Church's retention setting removes them or they are deleted.
• Safety. If Lamp detects that a message may indicate danger or crisis, it shows emergency resources and, if your Church turns this on, emails its pastors that a crisis message was received. The email does not include the message.

We do not use Lamp questions or other Church information to train AI models.

8. How we use information

We use information to:

• provide the Service to Churches and their Members and Visitors, including the features described above;
• create and manage accounts, authenticate users and keep sessions secure;
• deliver emails, push notifications and text messages that Churches send or that the Service sends automatically (for example, sign-in, approval, giving and reminder messages);
• process subscriptions, payments and gifts through our payment processor;
• provide support, including by accessing a Church's account as described in section 11;
• monitor, secure and protect the Service, prevent fraud, abuse and spam, enforce our Terms of Service, and investigate and fix errors;
• understand how the Service is used and improve it, generally using aggregated information;
• communicate with Churches about their accounts, the Service and changes to it, and, if you asked for it, send product news (you can unsubscribe at any time);
• follow up with people who requested our demo; and
• comply with law and legal process, and protect the rights, property and safety of our users, the public and Shepherd's View.

9. How information is disclosed

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

• To your Church, as described in section 10.
• To other Members of your Church, where a feature is designed to show it: the directory shows the details you choose to share; prayer requests are shown according to the visibility you choose; members of a group can see who else is in it; group leaders can see who asked to join and who attended.
• To Shepherd's View personnel, as described in section 11.
• To service providers who host, store, transmit or process information for us, listed in section 12, under contracts or terms that limit their use of it.
• At your direction or your Church's direction, for example when your Church sends a newsletter or text, sends domain setup steps to the person who manages its domain, connects its own Stripe account, or downloads a copy of its data.
• For legal reasons, if we believe in good faith that disclosure is required by law, subpoena, court order or other legal process, or is necessary to protect the safety of any person, to address fraud, security or technical issues, or to protect our rights or property. Where permitted and practical, we will tell the affected Church before disclosing its information in response to legal process.
• In a business transaction, such as a merger, acquisition, financing, reorganization or sale of assets, subject to standard confidentiality protections, in which case information would remain subject to this policy unless you are notified otherwise.
• To providers of third-party content on a page, such as fonts, maps and videos, which receive your IP address and browser information directly from your browser, as described in section 5.
• In aggregated or de-identified form that cannot reasonably be used to identify you or your Church.

10. What your Church can see

A Church controls who among its people has which role, and the Service shows information to Church Staff according to their role. Generally:

Church Staff may also receive emails and notifications about activity, such as new connect cards, news Members share, requests for contact or help, crisis alerts from Lamp (without the message), and a weekly summary of counts. A Church can download a complete copy of its information, including information about you.

Your Church decides how to use what it can see, and its use is governed by its own policies. Information you share through the Service is not a confidential or privileged communication by reason of being shared through the Service. Church Staff may be required by law to report certain information, for example about the abuse of a child.

11. Access by Shepherd's View personnel

Authorized Shepherd's View personnel can access information on the Service, including information in any Church's account. We limit this access to personnel who need it and use it to provide support, troubleshoot and fix problems, maintain and secure the Service, investigate abuse or misuse, comply with law, and as otherwise described in this policy.

• Personnel designated as platform administrators can open any active Church's dashboard with full administrative and pastoral access, which includes Members' prayer requests, Lamp questions, life events, check-in answers and member-area activity, and can make changes there. We do not need a Church's permission to do so and do not notify the Church each time. We keep an internal record of the pages our personnel open and the changes they make in a Church's account.
• Our personnel can also see account details, billing status and summary counts for every Church, and can access the underlying systems and data in the course of operating the Service.

12. Service providers and third parties

We use these companies to provide the Service, and give each the information it needs to perform its function:

Churches may also connect or link to other services, such as external giving providers or video hosts. Those services are not our service providers and their own policies apply.

13. How long we keep information

We keep information for as long as needed for the purposes in this policy, unless a longer period is required or permitted by law. Specifically:

Some information may remain after deletion: gift records kept by the Church for tax and accounting purposes; family members you added to your household; newsletter subscriptions, connect cards and contact messages, which are separate from a Member account; entries in a Church's audit log until it expires; and our internal records. Deleted information also remains in backups until they expire in the ordinary course, generally within 7 days.

14. Security

We use administrative, technical and physical measures designed to protect information, including:

• encryption in transit between browsers and our infrastructure;
• separation of each Church's information at the database level, with database rules that prevent one Church's records from being read in another Church's context;
• encryption at rest, with a key specific to each Church that is itself protected by a cloud key-management service, for prayer requests, Lamp questions and answers, pastoral notes, Members' prayer needs, life-event notes, connect-card prayer requests and notes, and two-factor sign-in secrets;
• one-way hashing of passwords, and required two-factor sign-in for Church administrators and anyone with pastoral access;
• private file storage served through short-lived links; and
• logs of sensitive actions.

Other information, such as names, email addresses, directory details, About me details, check-in answers, attendance and activity records, is not encrypted at the field level, although it is stored on encrypted infrastructure where our providers offer it. No method of transmission or storage is completely secure, and we cannot guarantee the security of information. If we learn of a security incident affecting your information, we will notify affected Churches and, where required, individuals and authorities, as required by law.

15. Your choices

• What you share. Most profile, About me, family, life event and prayer information is optional. You choose what appears in the directory, whether your About me is shared with Church leaders or only pastors, and the visibility of each prayer request.
• Celebrations. You can turn off showing your birthday and anniversary to Church leaders on your About me page.
• Check-in and monthly check-in. Checking in at services and answering the monthly check-in are optional.
• Notifications, email and texts. You can turn off push notifications in your browser or account, unsubscribe from newsletters using the link in each one, and stop texts by replying STOP.
• Visitor statistics. Turn on Global Privacy Control or Do Not Track in your browser and your public-site visits won't be counted.
• Product news. If you opted in when requesting our demo, use the unsubscribe link or contact us.

16. Access, correction and deletion

Members can view and correct most of their information in the member app, download a copy of their information ("Download my data" on the account page), and delete their account. Your Church can also help with requests about information it holds.

Requests to us. You may ask us to access, correct, delete or obtain a copy of personal information by emailing [privacy email]. We will verify your request using information associated with your account, and may ask for more information to do so. Where we hold information on behalf of a Church, we may refer your request to the Church or act on its instructions. We may decline requests where permitted by law, for example where we need the information to comply with a legal obligation or protect against fraud.

17. State privacy rights

Depending on where you live and whether a particular law applies to us or to your Church, you may have rights to: confirm whether we process your personal information; access it; correct it; delete it; obtain a portable copy; opt out of the sale of personal information, targeted advertising, or certain profiling (we do not sell personal information or engage in targeted advertising); and limit or consent to the processing of sensitive information. Information about religious beliefs and health may be considered sensitive under some state laws. We process it to provide the features Churches and Members choose to use.

To exercise these rights, contact us as described in section 16. You may use an authorized agent where the law allows, and we may require proof of the agent's authority and verification of your identity. If we deny your request, you may appeal by replying to our decision or emailing [privacy email] with the subject "Privacy appeal," and we will respond within the time the law requires. We will not discriminate against you for exercising your rights. Where we process information on behalf of a Church, the Church may be the party responsible for responding to your request.

18. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Churches can require new members to confirm they are 13 or older. Parents and guardians may add information about their children, such as names, birthdays and service check-ins, as family members, and Church Staff may record it; the Church is responsible for that information. If you believe a child under 13 has given us personal information, contact us at [privacy email] and we will take appropriate steps to delete it.

19. Use outside the United States

The Service is intended for Churches and people in the United States. We and our service providers store and process information in the United States, where data protection laws may differ from those of your country. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

20. Changes to this policy

We may update this policy from time to time. We will post the updated policy with a new effective date. If we make a material change, we will tell Church account owners by email or in the dashboard before it takes effect, and Churches are responsible for telling their Members where appropriate. Changes apply to information collected after the effective date, and to existing information where the law allows.

21. Contact us

[Company legal name]
[Mailing address]
Privacy: [privacy email]