Your church's data belongs to your church. Full stop.

1Who we are

Church Base Cloud (“CBC”, “we”) is operated by DigitAI Solutions LLC (USA). For anything in this policy, write to hello@churchbasecloud.com — a human answers.

2Two roles: your church, and us

For the people records inside a church's space, the church decides what is stored and who may see it — in data-protection terms, the church is the controller and we are its processor: we store and process that data only to provide the service, on the church's instructions, and for nothing else.

For the small amount of data we need ourselves — the church's contact person, billing details, support emails — we are the controller.

3What data is stored

• Member data your church manages: names, contact details, households, groups, serving teams, attendance, notes your team writes, prayer requests, and (if your church uses it) giving records. What is collected is your church's decision.
• Account data: name, email address, password (stored only as a salted hash), language preference.
• Technical data: server logs (IP address, time, requested page) kept briefly for security and troubleshooting, and the session cookie that keeps you signed in.

Optional Google Analytics on the public website

Only with your permission do we load Google Analytics 4 (Google Ireland Limited / Google LLC). It measures public page visits, campaign categories, demo and contact clicks, video progress and enquiry steps. Form answers, names, email addresses, full query strings, private app pages and donation records are not sent. Clicking an email link is not counted as a received enquiry, and starting checkout is not counted as a purchase.

You may decline without losing any site features and withdraw consent through Analytics settings in the footer. Your choice is stored in this browser for up to 180 days; analytics cookies expire after 180 days. No Google tag is loaded before opt-in. Advertising personalisation and Google Signals are disabled. Google processes technical connection data when its service is loaded; processing in the United States may occur. This measurement relies on your consent. See Google’s privacy policy and information about Analytics data safeguards.

Google privacy policy · Google Analytics data safeguards

4Where your data lives

The platform runs on servers of Hetzner Online GmbH in the European Union (Finland), an ISO-27001-certified hosting provider. Transactional email is delivered through a German email provider. Encrypted daily backups are kept on the same EU infrastructure for 14 days.

Each church's data lives in its own, separate database — isolation is built into the architecture, not just into permissions.

5Who else touches data — and who doesn't

We use a deliberately short list of service providers, each only for what it says:

AI is optional. Administrators can connect Google Gemini, OpenAI, Anthropic Claude, xAI Grok, Mistral, OpenRouter or a public OpenAI-compatible HTTPS provider. Writing and help use the configured model chain; image refinement uses Gemini. Submitted prompts and images go to the selected remote service. Use suitable content, review the provider’s data terms and check generated results. CBC’s AI usage log records operational metadata such as provider, model, token counts, latency and success, not the questions or answers.

That is the whole list. We never sell data, never share it for advertising, and never use your church's data to train AI models.

Website chat and voice assistant

The optional website assistant is provided by DigitAI Agents, operated by DigitAI Solutions LLC. Loading its widget transmits technical connection data to that service. Messages, relevant conversation context and, when you choose voice, your audio are processed by the configured OpenAI services to answer your product questions. The microphone starts only after you choose voice and grant browser permission. The voice is AI-generated. Conversations are stored in the team’s conversation inbox for service and follow-up; the assistant has no access to your church’s private member database.

A human follow-up requires your explicit submission of an email address or phone number in the contact form. We use those details to answer that enquiry, not to subscribe you to advertising. Do not submit member lists, pastoral or health information, children’s data, passwords or payment details. You can use the demo and website without the assistant. For access or deletion requests, contact hello@churchbasecloud.com. OpenAI processing may take place outside the EU; its applicable data terms and retention rules also apply.

OpenAI privacy policy

Optional advertising measurement

Only with your permission, Microsoft Advertising UET records page views, enquiry steps, technical errors and confirmed enquiry receipts to measure advertising results. We send the brand and step names, not form answers, names, email addresses or phone numbers. Microsoft also receives technical connection data and may use UET identifiers. We do not activate Clarity or session recordings. Your choice is stored in this browser for up to 180 days. With consent, approved campaign identifiers and the Microsoft click identifier are retained in this tab for up to 24 hours and attached to a submitted enquiry for internal attribution. You can withdraw through Analytics settings in the footer; new measurement then stops and our attribution storage and UET cookies are removed. Without consent, the enquiry still works. Microsoft privacy information: https://privacy.microsoft.com/privacystatement.

6Cookies

In the private church applications, we use the session and security cookies needed for sign-in and protection against forged requests. On this public marketing website, optional Google Analytics cookies are added only after you choose to allow analytics. Declining leaves the website fully usable. The footer lets you change your choice and remove analytics cookies.

7What members control themselves

Privacy is designed into the member app, not bolted on:

• The member directory is opt-in — nobody appears in it until they (or the church office, where local practice allows) switch their visibility on.
• Phone number and photo each have their own opt-in toggle.
• Prayer requests can be posted anonymously.
• Every member can see and edit their own profile data.

8Security

• Encrypted connections (TLS/HTTPS) everywhere — for every church address automatically.
• One isolated database per church; role-based access inside each church.
• Passwords stored as salted hashes; sensitive settings encrypted at rest.
• Encrypted daily backups, 14-day retention, EU-hosted.
• Firewalled servers, automatic security updates, intrusion protection.

9Your rights, export & deletion

Members exercise their rights (access, correction, deletion) with their church — the church controls its records, and the tools to answer are built in. For our own records (billing contacts, support mail), write to us directly.

Churches can export their data at any time (people lists as CSV, giving statements, calendar feeds). When a church leaves, its database and uploaded files are deleted within 30 days of the end of the contract — backups roll out of retention within a further 14 days.

10Changes to this policy

If this policy changes in a way that matters, we notify church admins by email before the change takes effect. The current version always lives at this address.

11Contact

Questions, concerns, or a request about your data: hello@churchbasecloud.com.