Privacy policy

01

Who we are

ShepherdCircle (“we”, “our”, “us”) operates a church management platform provided via shepherdcircle.com.

If you have questions about this policy, contact us at support@shepherdcircle.com.

02

What data we collect

Account data: name, email address, and authentication credentials when you register.

Church data: church name, location, logo, and administrative settings you provide.

Member data: congregation member information entered by your church administrators, including names, contact details, demographic information, and attendance records.

Usage data: pages visited, features used, and session information to help us improve the platform.

03

How we use your data

To provide and operate the ShepherdCircle platform.

To authenticate your account and keep it secure.

To send transactional emails (magic link logins, birthday reminders, invitations).

To send SMS verification codes when a member uses the member directory.

To provide customer support when you contact us.

We do not sell your data, rent it, or use it for advertising purposes.

04

Data ownership

All member data entered into ShepherdCircle belongs to your church. You retain full ownership and control of your data.

You may export or delete your data at any time from within the platform settings.

05

Data storage and security

Your data is stored in Supabase (PostgreSQL), hosted on infrastructure provided by AWS and Supabase Inc.

We enforce row-level security (RLS) policies to ensure your church’s data is never accessible to other organisations.

All data is encrypted in transit (TLS) and at rest.

Authentication is handled by NextAuth.js with JWT tokens scoped to your church.

06

When our team can see your data

A small number of ShepherdCircle staff can open your church’s account. We do this only to help when you contact support, to fix a problem with billing or your account, to keep the service secure, or when the law requires it.

Staff use a separate, private console. To get in they sign in with an approved staff account and pass two-step verification, and their access ends automatically.

Every time staff sign in to the console, we keep a record of who it was and when. As we add tools for staff to view or change a church’s account, those actions will be recorded too, along with the reason. Nobody, including our own staff, can edit or delete these records.

Staff can’t sign in to your account as you, and we don’t look at prayer requests or individual gifts. When we need your church’s numbers, we use totals.

You can ask us for the record of staff access to your church’s account at support@shepherdcircle.com.

07

Third-party services

We use the following third-party services to operate ShepherdCircle:

Supabase — database and authentication storage

Resend — transactional email delivery

mNotify — SMS delivery for member directory verification codes

Paystack — payment processing for paid subscriptions

Vercel — hosting and deployment

Each of these services has their own privacy policy and data processing practices.

08

Cookies

We use a cookie to keep you signed in.

If you arrive through one of our short links (for example shepherdcircle.com/go/flyer-a5 from a printed flyer), we also set a cookie that remembers which one, for up to 90 days. If you then set up a church, we save that link’s name with it, so we can tell which of our flyers, posters and videos are working. It holds only the link’s name, nothing about you, and is never shared.

We do not use advertising cookies or third-party tracking.

09

Your rights

You have the right to access, correct, or delete your personal data at any time.

Church administrators may delete their church account and all associated data from the Settings page.

To request a full data export or account deletion by email, contact support@shepherdcircle.com.

You can also ask for the record of when our staff accessed your church’s account.

10

Changes to this policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email. Continued use of the platform after changes constitutes acceptance.