Privacy Policy

ChurchOS is committed to protecting your church's data with the highest standards of privacy and security.

GDPR Compliant
SOC 2 Type II
Last Updated: 12/4/2025
Data Access

We only access your data for system maintenance and customer support. All access is logged and auditable.

Your Rights

Full data export, deletion, and granular permission controls. You own and control your church data.

Security

Bank-level encryption, secure data centers, and regular security audits protect your information.

What Data We Collect

Sensitive Personal Data

The following information is considered sensitive and receives enhanced protection:

  • Personal Identifiers: First name, last name, email address
  • Contact Information: Phone numbers, home addresses
  • Demographics: Age, gender, date of birth
  • Religious Information: Membership status, attendance records
  • Financial Data: Donation history, payment information

Technical Data

  • Usage analytics and system performance metrics
  • Login activity and security logs
  • IP addresses and browser information (for security)

Church Administration Data

  • Event attendance and participation records
  • Ministry involvement and volunteer activities
  • Communication preferences and campaign responses

Our Data Access Principles

Limited Technical Access

  • • System maintenance and security only
  • • Authorized personnel only
  • • All access is logged and auditable
  • • Time-limited access sessions

Zero Business Use

  • • We NEVER use your data for business purposes
  • • We NEVER share data with third parties
  • • We NEVER analyze data for competitive insights
  • • Your data remains YOUR data

Data Security & Encryption

Current Security Measures

Data Protection

  • • TLS 1.3 encryption in transit
  • • AES-256 encryption at rest
  • • Secure database connections
  • • Regular security audits

Access Controls

  • • Multi-factor authentication
  • • Role-based permissions
  • • Session management
  • • Audit logging

Enhanced Security (Coming Soon)

We're implementing additional security measures for sensitive personal data:

  • • Field-level encryption for names and email addresses
  • • Customer data access dashboard
  • • Real-time access monitoring alerts
  • • Zero-knowledge architecture options

Privacy Audit & Transparency System

Comprehensive Activity Logging

We maintain detailed audit logs of all sensitive data access to ensure complete transparency and accountability:

What We Log

  • • Who accessed sensitive member data
  • • When the access occurred (precise timestamps)
  • • Which specific data fields were viewed
  • • Purpose of the data access
  • • Data exports and downloads
  • • IP address and user agent information

Your Access Rights

  • • View all access logs for your organization
  • • Export audit logs in CSV format
  • • Filter logs by date, admin, or activity type
  • • Real-time monitoring dashboard
  • • Automatic 7-year retention for compliance
  • • No log data is ever modified or deleted

Data Access Monitor

Church administrators can access the Privacy Audit section in their dashboard to:

  • • Monitor all sensitive data access in real-time
  • • Review historical access patterns and trends
  • • Identify unusual access patterns for security
  • • Generate compliance reports for regulatory requirements
  • • Demonstrate transparency to church members upon request

Your Data Rights

Data Access & Control

  • Full data export in standard formats
  • Real-time data deletion
  • Granular permission controls
  • Data portability to other systems

Transparency & Accountability

  • Real-time privacy audit dashboard access
  • Detailed access logs with 7-year retention
  • Exportable compliance reports (CSV format)
  • Automatic logging of all sensitive data access
  • Data processing activity reports
  • Incident notifications within 24 hours
  • Regular privacy policy updates

Privacy Contact

For privacy-related questions, data requests, or security concerns:

Email: info@softswitch.tech

Response Time: 24-48 hours for privacy requests

Data Requests: Processed within 30 days

Legal Compliance

GDPR

European Union

CCPA

California

SOC 2

Security Standards

This policy was last updated on 12/4/2025 and is effective immediately.