Política de privacidad

Overview

Shepherd Atlas ("we," "our," or "the Service") is a congregation management platform for religious institutions. This Privacy Policy describes how we collect, use, and protect information when you use Shepherd Atlas.

Shepherd Atlas operates as a data processor on behalf of the religious organization (the data controller) that uses our platform. The congregation owns its data. We process it only to provide the Service.

What data we collect

Account data: When you sign up, we collect your name, email address, and password (stored as a bcrypt hash — never in plain text).

Organization data: Member records, family units, donation history, event attendance, communications, sermon records, and volunteer information — all entered by your organization's administrators. This data belongs to your organization.

Usage data: Standard server logs including IP addresses, browser type, and pages visited, used for security monitoring and service improvement. We do not sell or share this data.

Payment data: Billing is handled by Stripe. We do not store credit card numbers or payment details on our servers.

How we use data

We use your data to:

• Provide and maintain the Shepherd Atlas platform
• Process your subscription and billing via Stripe
• Send service-related emails (receipts, security notifications)
• Improve the Service and fix bugs
• Comply with legal obligations

We do not sell, rent, or share your congregation's member or giving data with any third party for marketing or commercial purposes.

Smart Insights and your data

Smart Insights — engagement scoring, the daily digest, giving insights and message drafts — are calculated deterministically from your own organization's data. They run on our servers and send no congregation data to any external AI provider.

No third-party AI service is used, and your data is never used to train any model. If we later add a feature that relies on an external AI provider, it will be disclosed here and named in the subprocessor list below, and it will remain switched off until your organization enables it.

Data storage and security

Shepherd Atlas's application (Vercel) and database (a managed Postgres instance) both run in Frankfurt, Germany (EU). Vercel's content-delivery network may cache static, non-personal assets (page layout, images, scripts) at edge locations elsewhere for performance; this does not involve organization or member data, which is processed only in the EU. Data is transmitted over HTTPS, and database access is restricted to application servers. Some processing is still carried out by providers based in the United States — payments (Stripe), email delivery (Resend), and error monitoring (Sentry) — under appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms).

We implement technical safeguards including hashed passwords, session-based authentication, and organization-level data isolation (multi-tenant architecture ensures one organization cannot access another's data).

Data retention

Your data is retained as long as your account is active. If you cancel your subscription, your organization's data is retained for 30 days after account closure to allow for recovery or export. After that period, data is permanently deleted unless you request earlier deletion.

You may export your complete member and donation data at any time via the CSV export functions in Shepherd Atlas. You own your data.

Third-party service providers

We use the following sub-processors to operate Shepherd Atlas. Each is bound by a Data Processing Agreement and handles data only as needed to provide its service:

• Stripe — payment processing and subscription billing. Stripe stores your payment instrument and billing history. We never see or store raw card numbers. See Stripe's Privacy Policy.
• Resend — transactional email delivery (receipts, password resets, security notifications). Email content is transmitted to Resend for delivery and is not stored beyond standard log retention. See Resend's Privacy Policy.
• Vercel — application hosting and edge network. Vercel processes request logs and deploys the Shepherd Atlas web application. See Vercel's Privacy Policy.
• Prisma Postgres (database hosting) — stores all organization and member data in a managed PostgreSQL database. Data is encrypted at rest and in transit. See Prisma's Privacy Policy.
• Sentry — error and availability monitoring. Error reports may include technical request context and user identifiers. See Sentry's Privacy Policy.

We do not sell your data to any third party, and none of these providers are permitted to use your data for their own commercial purposes.

Cookies

Shepherd Atlas uses only essential cookies required for the service to function:

• Session cookie — maintains your authenticated session. Expires when you close your browser or after 30 days, whichever comes first.
• CSRF token — protects form submissions from cross-site request forgery attacks.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. There is no cross-site behavioral tracking. You cannot opt out of essential cookies because they are required for the application to work; however you may clear them at any time by clearing your browser cookies or signing out.

This is why you were not asked to accept cookies. Consent is required for cookies that are not strictly necessary — advertising, tracking, analytics. We set none of those, so there is nothing to consent to and no banner to click away.

California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: request deletion of your personal information, subject to certain exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale: Shepherd Atlas does not sell personal information, so this right is not applicable.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA rights.

To exercise these rights, contact us at support@shepherdatlas.com. We will respond within 45 days.

GDPR rights

If you are located in the European Union or UK, you have the following rights regarding your personal data:

• Right to access: request a copy of your personal data
• Right to correction: request correction of inaccurate data
• Right to erasure: request deletion of your personal data
• Right to portability: receive your data in a machine-readable format
• Right to object: object to processing of your data

To exercise any of these rights, email us at support@shepherdatlas.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority (in Germany: the competent Landesbehörde für Datenschutz; in other EU member states: the authority of your country of residence).

Contact

Questions about this Privacy Policy or data requests: support@shepherdatlas.com