Privacy Policy

Last updated: February 2026

1. Introduction

Church Content OS (“we,” “us,” “our”) is committed to protecting the privacy of churches and their staff who use our platform. This policy explains what data we collect, how we use it, and your rights.

2. Data We Collect

• Account data: Name, email address, organization name, denomination preference.
• Content data: Sermon notes, generated content, templates, and edits you create.
• Usage data: Feature usage metrics, generation counts, login timestamps.
• Payment data: Processed by Stripe. We do not store credit card numbers.

3. Special Category Data (GDPR Article 9)

Sermon notes and denomination preferences may constitute religious data under GDPR Article 9. We process this data solely to provide our service (theological content generation) based on your explicit consent when you create an account and input sermon content.

• Religious data is never shared with third parties for marketing.
• AI providers (Anthropic, OpenAI) process sermon notes only to generate your content. They do not train on your data per their business terms.
• You can delete all your data at any time from Settings.

4. How We Use Your Data

• Generate denomination-calibrated content from your sermon notes.
• Provide collaboration features (team comments, review workflow).
• Send transactional emails (password reset, team invitations).
• Improve our service through aggregated, anonymized analytics.

5. Data Storage & Security

Data is stored in Supabase (PostgreSQL) with row-level security. All data is encrypted in transit (TLS) and at rest. Each organization's data is logically isolated through RLS policies.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, all content, sermon notes, and personal data are permanently deleted within 30 days.

7. Your Rights

You have the right to:

• Access, export, or delete your data.
• Withdraw consent for processing religious data.
• Request data portability (export all content as JSON/PDF).
• Lodge a complaint with your data protection authority.

8. Third-Party Services

• Supabase: Database and authentication.
• Anthropic (Claude): AI content generation.
• OpenAI: AI content generation (alternative provider).
• Stripe: Payment processing.
• Resend: Transactional email delivery.
• Vercel: Hosting and deployment.

9. Contact

For privacy questions, email [email protected].