Privacy Policy

gr8mart churches is operated by gr8mart, based in the United States. This policy covers churches.gr8mart.ai, the church dashboard, and the church websites we host.

We play two roles:

• We are the controller of information about churches' accounts and staff, billing, and the technical information needed to run and protect the Service.
• For information a church collects about the people it serves (forms, prayer requests, RSVPs, member accounts, households, groups and attendance), the church is the controller and we are its processor: we handle that information only to provide the Service to the church. If you are a church member or visitor, the church's own privacy notice explains how it uses your information, and you should contact the church first.

• Church accounts and staff: church name and web address, contact details, staff names, email addresses, roles, encrypted (hashed) passwords and sign-in records.
• Website content: the pages, photos, sermons, events and other content a church publishes.
• Congregation data, on churches' behalf: what people submit through a church's forms (name, email, phone, messages, prayer requests, interests), RSVPs, member accounts and household details (which may include children's first names, birth month and year, and school grade), group memberships and attendance, and notes church staff record.
• Payments: for paid plans, Stripe handles card details; we receive the plan, billing status and a customer reference.
• Technical information: IP address, browser type and pages requested, kept in server logs for security and troubleshooting. To prevent spam and abuse, we store a scrambled (hashed) form of a visitor's IP address with form submissions and sign-up attempts; it cannot be turned back into the address.

• To provide the Service a church signed up for (performance of a contract).
• To keep the Service secure, prevent spam, fraud and abuse, and fix problems (our legitimate interests in a safe, working service).
• To send service emails, such as sign-in links, confirmations and important account notices (contract and legitimate interests). We do not send marketing to church members or visitors.
• To meet legal obligations, such as tax and accounting records for payments.
• Where the law requires consent, we or the church will ask for it, and it can be withdrawn at any time.

We do not sell or rent personal information, and we do not "share" it for cross-context behavioral advertising. We do not use it to build advertising profiles.

We use only what the Service needs to work:

• Sign-in cookies that keep church staff, members and our own staff signed in. They are required to use those features.
• Settings saved in your browser (such as light or dark mode and a collapsed sidebar). These stay on your device.

We do not use advertising or analytics cookies, and we do not track you across other websites.

We use these providers ("sub-processors") to run the Service. Each may only use information to provide its service to us:

• Vercel: Hosts the website and app (United States and global edge network).
• Supabase: Database and photo storage (United States).
• Resend: Sends emails (sign-in links, confirmations, notifications) (United States).
• Stripe: Processes payments for paid plans; we never see full card details (United States).
• Cloudflare: Domain name (DNS) service (Global).
• Google Fonts: Delivers the typefaces church websites use; visitors' browsers request them from Google (Global).
• YouTube and Vimeo: Play sermon videos a church adds. YouTube videos use its privacy-enhanced mode; sermon thumbnails load from YouTube's image servers (Global).
• Google Maps: Shows a church's map, only after a visitor taps "Show map" (Global).

We will update this list before adding a new provider that handles personal information.

We may disclose information if required by law or to protect people's safety, and to a successor if the business is transferred, in which case this policy continues to apply.

We are based in the United States and our main providers store data there. When information from the UK, the European Economic Area or other places with transfer rules is processed in the United States, we rely on recognised safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

• Church account and congregation data: for as long as the church's account is open. When an account is closed, we delete it within 30 days; backups are overwritten within a further 30 days.
• When a church member deletes their account from their church's website, their member account and the information linked to it are deleted straight away.
• Security and audit logs: up to 24 months.
• Payment records: as long as tax and accounting law requires (usually up to 7 years).

We protect information with encryption in transit (HTTPS), hashed passwords, single-use sign-in links, role-based access for church staff, separate accounts with two-factor sign-in for our own staff, and logging of administrative actions. No system is perfectly secure, so we also limit what we collect and how long we keep it.

Depending on where you live, you may have the right to access, correct, download, delete or restrict the use of your personal information, to object to certain uses, and to withdraw consent. Some of these rights apply under the GDPR and UK GDPR, US state privacy laws (such as California's), and India's Digital Personal Data Protection Act.

• Church members can download or delete their own data from "My account" on their church's website.
• For information a church holds about you, please contact the church first. If you contact us, we will pass your request to the church and help it respond.
• For information we control, contact us at adr@gr8mart.ai. We will respond within one month (or the time the law requires) and will not treat you differently for exercising your rights.
• You may also complain to your local data protection authority.

India: our grievance contact for the purposes of the DPDP Act can be reached at adr@gr8mart.ai.

Church staff and member accounts are for adults only; children cannot sign up or sign in. A church may record limited information about children in a family's household (first name, birth month and year, and school grade) or on a group roster. Churches are responsible for doing this with a parent or guardian's knowledge and, where required, consent. We do not knowingly collect information directly from children.

We will post any changes here with a new date. For significant changes, we will notify church account holders by email and in the dashboard before they take effect.

Questions or requests about privacy: adr@gr8mart.ai.