Privacy Policy

When a church uses Shepherd Station, we store what it enters and what the platform needs to function: organization details, team member accounts, contacts and their information, messages, form submissions, giving records, website content, and advertising settings. This data belongs to the church. We use it only to operate the service, never sell it, and never share it between churches — each organization's data is isolated from every other's.

When someone visits a church website or submits a form on one, that church receives the information. We process it on the church's behalf so the website, forms, and follow-up work. If you have questions about how a church uses your information, contact that church directly — it controls the data.

Church websites on Shepherd Station can use Google Analytics, Google Ads, and Meta (Facebook) measurement tools so the church can understand its visitors and improve its outreach. These tools only load after a visitor in a region that requires consent accepts cookies through the site's consent banner. Visitors can decline, and can change their choice at any time. Declining means the church's measurement tools don't run for that visitor.

A church's own contacts and advertising. To help a church reach new people and measure whether its ads work, a church may choose to share email addresses of its own contacts (people who gave them to the church) with Google Ads and Meta (Facebook) for advertising matching and measurement. Email addresses are normalized and converted into a one-way SHA-256 hash before they leave Shepherd Station, so the advertising platform receives a code, not the readable address. This never includes information Shepherd Station receives from Google APIs, which is covered separately in section 4.

Phone numbers are never shared with advertising platforms. Mobile and phone numbers are used only to communicate with you (for example, texts you agreed to receive) and are never uploaded to, shared with, or used by Google, Meta, or any other advertising platform — not even in hashed form.

What we access. When a church connects Google, Shepherd Station asks only for Google Ads access. With it we read the church's own Google Ads account: campaigns, ads, keywords, search terms, budgets, conversion settings, and performance.

Google Business Profile (only where a church turns it on). If a church separately connects its Google Business Profile, we ask for Business Profile access and read only the listings the church chooses: name, address or service area, hours, reviews, posts and basic performance. We use it to show that listing in Shepherd Station and to make replies, hours changes and posts the church confirms one by one. This connection is stored apart from Google Ads, its sign-in tokens are encrypted, and disconnecting it deletes those tokens and the saved listing links right away. Shepherd Station is not endorsed by, sponsored by or partnered with Google.

How we use it. We use this data only to show the church its Google Ads results inside Shepherd Station and to make the changes the church requests or approves: creating, editing, and pausing campaigns; updating keywords, negative keywords, and ad wording; and setting up conversion tracking. New campaigns are created paused, and changes that affect spending are never made without the church's approval. To draft ad wording and keyword suggestions for the church, the relevant campaign details are processed by AI models (Google Gemini and OpenAI) solely to return that draft. We do not use Google user data to develop, improve, or train generalized AI or machine learning models.

How we share it. We do not sell Google user data, do not transfer it to data brokers or information resellers, do not use it for advertising, and never share it with Meta or any other advertising platform. We share it only with the service providers that run these features for us (hosting, database, and the AI processing described above), only as needed to provide them, or when required by law. People can read it only with the church's permission, for security or support, or where the law requires.

How we protect it. Google sign-in tokens are kept on our servers only, sent over encrypted connections, stored in an encrypted database, and never shown in the browser. Access is limited by role and by church, so one church can never reach another's Google data.

Retention and deletion. A church can disconnect Google in Shepherd Station at any time, and anyone can also remove access in their Google Account's security settings. Disconnecting immediately deletes the Google sign-in tokens we hold. Campaign results saved while connected stay in the church's records until the church asks us to delete them (email support@shepherdstation.app) or closes its account, and are then deleted as described in section 7.

Limited Use. Shepherd Station's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Subscriptions to Shepherd Station are processed by Stripe, and giving payments are processed on each church's own payment account. Card and bank details go directly to the payment provider and never pass through our servers in full. We retain only the records needed to confirm that payments happened.

Texts and emails sent through the platform are sent on behalf of the church using providers it has authorized (such as Twilio and our email delivery provider). Message delivery events (sent, delivered, failed) are recorded so the church can see what happened. Reply STOP to opt out of texts from a church; churches are expected to honor opt-outs.

Shepherd Station text messages. If you give us your mobile number and agree to receive texts from Shepherd Station (for example, a verification code or preview texts while setting up your account), we use it only to send those messages. Message frequency varies with what you request. Msg & data rates may apply. Reply STOP to opt out or HELP for help at any time. Mobile information, phone numbers, and SMS consent are not shared, sold, or provided to third parties or affiliates for marketing or promotional purposes.

We keep an organization's data while its account is active. After an account closes, data remains exportable for a reasonable period and is then deleted. Standard service records (like billing history) are kept as long as legally required.

Access to data is restricted by role and by organization, protected with encrypted connections, and audited. We limit internal access to what's needed to support churches and operate the platform.

Team members can update their account details in the app. Individuals whose information a church holds may request access, correction, or deletion from that church. You can also contact us at support@shepherdstation.app and we will pass the request to the church and assist.

We may update this policy as the service evolves. The date at the top shows the latest version, and material changes will be communicated to church owners.