Church Engagement OS

Privacy Policy

Effective date: [Aug 2026] · Last updated: [Sep 2026]

Church Engagement OS ("we," "our," or "us") is operated by The Barrett Group LLC. This policy explains what personal information is collected through Church Engagement OS, how it is used and protected, who it is shared with, and the rights available over that data. Church Engagement OS is a ministry engagement platform — not an accounting system, not a bank, and not a provider of legal or tax advice.

1. Who controls this data — a note before anything else

This section applies to every other section below it, so it comes first.

Your church is the data controller. We are the data processor. When a church signs up for Church Engagement OS, church staff enter and manage information about members, visitors, and guests — names, contact details, household relationships, giving records, event registrations. We do not collect this information directly from those individuals, and we do not decide what is collected or why — the church does. Our role is to store it securely, make it usable for the church, and follow the church's instructions about it (including instructions to export or delete it).

Practical effect: if you are a member of a church using Church Engagement OS and have a question about what information your church has recorded about you, or want to request a correction or deletion, your church is the right first point of contact, since they control that data and can act on it directly. We support export and deletion requests a church makes to us on your behalf (see Section 8), and we are glad to help if a church is unclear on how, but we cannot act on an individual member's request without the church's involvement, in the same way a payroll processor cannot act on an employee's request without their employer.

If you are church staff with your own login (an Admin or Staff account), different rules apply to your own account information (Section 2, Account and identity information) — there, we are the controller, the same as any ordinary SaaS login.

2. Information We Collect

Account and identity information (staff/admin logins)

  • Email address (used for authentication)
  • Display name
  • Authentication method: magic link or Google OAuth. We never store passwords.
  • Role and module permissions within your church's account

Member self-serve login information

  • Email address used for magic-link sign-in
  • Which person record(s) that email is linked to within a household

Records entered by church staff (controlled by the church — see Section 1)

  • People and households — name, contact info, birthdate, address, household relationships, status (active/inactive/visitor/deceased), and any custom fields a church chooses to record
  • Giving — donation amount, date, fund, tax treatment, and notes. Payment card data for online giving is handled directly by Stripe — we do not store card numbers (see Section 5).
  • Events — registrations, including guest registrations from people not otherwise in the system
  • Groups — ministry, small-group, and committee membership
  • Photos — a photo of a person, if church staff add one or the member adds their own. A photo is used only so that staff and leaders can recognise someone in a room: it is shown on the person's record, in lists of people, on rosters, at check-in, and to the member on their own page. It is stored privately, served through short-lived links, and is never printed, exported, mailed, or shown on a public page. Removing it deletes the file.

Text messaging (SMS)

  • Phone numbers, together with a record of texting consent: when it was given and how — a box the person ticked on their church's connect card, a church staff member recording consent given in person or in writing, or a YES reply sent from the phone itself
  • A log of text messages sent — recipient, message type, and delivery outcome — kept as the compliance record that texting law requires

Text messages are sent only to people with recorded consent. Every recipient can opt out at any time by replying STOP, and a STOP is honored immediately across the entire platform. Message and data rates may apply.

No mobile phone numbers, SMS consent records, or text-messaging opt-in data are shared with, sold to, or rented to third parties or affiliates for their marketing or promotional purposes. This information is shared only with Telnyx, our SMS delivery provider (Section 4), and solely to deliver the messages themselves.

Usage and technical data

  • Application logs, used for error diagnosis
  • Session data (managed by Supabase Auth)
  • Audit records of platform support access (see Section 6)

Product usage analytics — two kinds, treated differently

We record which parts of the software get used, so we can tell which features are worth continuing to build. These are two different kinds of collection and we keep them separate rather than describing both as "analytics."

Staff use of the software. When someone signed in as church staff opens a module — People, Giving, Events, Communication — or reaches a milestone in one of them (a deposit started, an event created, an announcement sent, a newsletter set up, a module's access granted to another staff member), we record that it happened, against the church and not against the individual staff member. We do not record which staff member did it, and the records are not linked to a named person or used to build a profile of one. We record the module or the milestone, not the individual actions inside it: we can tell that a church uses Events, and we cannot tell what any one person clicked, searched for, or read.

Public pages — a church's giving page and its public event pages — are measured anonymously. No account exists for a visitor to those pages, and none is created: no profile is built, and page addresses are stripped of anything that follows a "?" so that a link identifying one payment or one registration cannot travel with the measurement.

Neither kind ever carries giving amounts, financial records, member details, or the content of anything a church has entered. If that ever needs to change, this policy is changed and re-published first.

3. How Information Is Used

  • Provide the service — store and organize records the church enters, generate giving statements, process event registrations and payments
  • Access control — enforce the permissions each church configures, so a staff member sees only the modules they've been granted
  • Authentication — verify identity via magic link or Google OAuth
  • Improve reliability — diagnose errors and data issues using application logs
  • Legal compliance — respond to lawful requests and enforce our Terms of Service

We do not sell data. We do not use church or member data for advertising, and we do not share it with data brokers.

4. Data Sharing — Subprocessors

We share data only with the vendors necessary to operate Church Engagement OS, each contractually bound to use it only to provide services to us:

  • Supabase — database hosting and authentication. Row-level security policies enforce tenant isolation at the database layer, so one church's data is not reachable from another's.
  • Vercel — application hosting.
  • Stripe — payment processing, in two distinct roles (see Section 5).
  • Resend — transactional email (magic links, notifications) and, separately, broadcast email to a church's membership.
  • Telnyx — text-message (SMS) delivery. Receives the phone number and content of each text a church sends, and returns delivery outcomes and STOP/HELP replies. Mobile numbers and consent records go to Telnyx solely to deliver messages, never for marketing (see the SMS heading in Section 2).
  • PostHog — product analytics. Receives usage data (features used, screens visited) to help us improve the product, in the two separate forms described in Section 2: staff use recorded against the church rather than against any individual staff member, and anonymous measurement of public pages. Does not receive giving amounts, financial records, or the content of member records.
  • Sentry — error reporting. Receives diagnostic information when something in the software fails: the error and where in the code it happened, the page it happened on, and the browser or server it happened in. This is troubleshooting data, and it is a different thing from the analytics above — an error report has to carry enough detail to fix the fault, so it may incidentally include a name or an identifier that appears in the failing operation. We do not send it session cookies or authentication headers, the contents of forms or uploaded files, or the tokens in private links; and we do not record video of anyone's screen. Reports are retained for a limited period and used only to diagnose and fix faults.

Legal requirements

We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public, and will notify the affected church when legally permitted to do so.

Business transfers

If Church Engagement OS is acquired or merged, data may transfer to the successor entity. Affected churches will be notified before data becomes subject to a materially different privacy policy.

5. Payment Processing — Two Distinct Flows

Platform subscription. If a church subscribes to a paid tier of Church Engagement OS, Stripe processes that subscription payment directly. Stripe receives the church's billing contact and payment card data. Governed by Stripe's Privacy Policy.

Member giving and event payments (Stripe Connect). When a church enables online giving or paid event registration, funds from members and guests are processed through Stripe Connect and settle directly into the church's own connected Stripe account — not ours. We facilitate this technically but do not take custody of these funds at any point. Payment card data for these transactions goes directly to Stripe; we store only the resulting record (amount, date, fund, and a reference to the Stripe transaction).

6. Data Security

  • Data is encrypted in transit (TLS) and at rest.
  • Row-level security (RLS) is enforced at the database layer, scoped by church, so no church's data is reachable by another's queries — this is a database-level guarantee, not only an application-level check.
  • Authentication is passwordless (magic link or Google OAuth) for staff and members alike. No passwords are stored.
  • The credentials used for backend administrative operations are never reachable from the browser application.
  • Platform support access is logged and time-limited. If our support team needs to view a church's account to help resolve an issue, that access is read-only, automatically expires (currently within 8 hours), and every session is written to an audit record — who accessed what church's data, when, and for how long.
  • We conduct periodic access reviews and maintain a tested backup/restore process.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at the address in Section 12.

7. Data Retention

  • Active accounts — data is retained for as long as a church's account is active, per the church's own configuration and requests.
  • Backups — purged on a routine rotation schedule.
  • Giving records — churches may need to retain financial records for tax substantiation purposes even after a member is no longer active or has requested deletion of their personal information. See Section 8 for how we handle this tension between deletion requests and legitimate recordkeeping needs.

8. Export and Deletion

Both are church-controlled actions, consistent with the church being the data controller (Section 1):

  • Export. A church can export records for an individual person (for responding to that person's own request) or export its entire account's data (if it stops using Church Engagement OS).
  • Deletion / erasure. A church can request that a person's personal information be redacted. Where a church has a legitimate ongoing need to retain the underlying financial record (for example, tax substantiation for a prior year's giving), we support redacting personal details while preserving the financial record itself — the church decides which applies and we execute it; we do not unilaterally decide to keep or delete data over a church's instruction.

A church administrator can do both of the whole-account actions without asking us: signed in as an administrator, this page offers a complete export of the church's records and a permanent deletion of them. The deletion is immediate and cannot be undone — it removes every record, closes the church's account, deletes the files it uploaded for import, and closes any login that is left attached to no other church. Export first.

9. Children's Information

Church Engagement OS does not have child-facing accounts or logins. Any information about a child (for example, a birthdate or a youth-event registration) is entered by church staff or a parent/guardian — we do not collect information directly from children.

10. A Note on Religious Information

Church Engagement OS is, by its nature, built around religious congregations, and the information it stores (church membership, giving, ministry involvement) is inherently connected to religious affiliation — treated as a sensitive category of personal information under several privacy frameworks (including the EU GDPR). We take this seriously: this information is handled with the same tenant-isolation and access controls as everything else in this policy, and is never used for any purpose beyond what the church itself configures.

11. Changes to This Policy

We may update this policy as the product evolves. For material changes, we will notify affected churches by email in advance of the change taking effect. The "Last updated" date above reflects the most recent revision.

12. Contact

Questions or requests related to privacy:

13. California Privacy Rights

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Because your church is generally the controller of your personal information (Section 1), requests to exercise these rights should generally go to your church first; we support and execute requests a church makes to us.

No sale or sharing of personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising as defined under the CPRA. No mobile information will be sold or shared with third parties for promotional or marketing purposes; mobile phone numbers and text-messaging consent are used only to send the messages a person agreed to receive (Section 2).

Your rights under the CPRA

  • Right to know what personal information is collected, used, disclosed, and shared.
  • Right to delete personal information, subject to legitimate recordkeeping needs (Section 8).
  • Right to correct inaccurate personal information.
  • Right to opt out of sale or sharing — we do not sell or share personal information, but the right exists regardless.
  • Right to non-discrimination for exercising any of these rights.

Email privacy@engagement.church with the subject line "California Privacy Rights Request," including your name, the church you're associated with, and the right you wish to exercise. We will take reasonable steps to verify identity and involve the relevant church before acting, and will respond within 45 days (extendable by an additional 45 days as permitted by law).