Privacy Policy

1. Information We Collect

theFlock collects information you provide directly when creating an account or setting up your organisation — including your name, email address, organisation name, and billing information.

Through the platform, your organisation may enter congregation member data including names, contact details, attendance records, financial giving records, pastoral notes, and prayer requests. This data belongs to your organisation and is held by theFlock solely as a data processor on your behalf.

We automatically collect certain usage data including IP addresses, browser type, pages visited, and feature interactions to improve the service.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the theFlock platform
• Process transactions and send related billing communications
• Send product updates, security alerts, and administrative messages
• Respond to comments, questions, and support requests
• Monitor and analyse platform usage to improve functionality
• Detect and prevent fraudulent or abusive activity

We do not sell your data or your congregation's data to any third party, ever.

3. Data Sharing

We share information only in the following circumstances:

• Service providers: trusted third parties who assist in operating the platform (hosting, payment processing, analytics) under strict confidentiality agreements
• Legal requirements: when required by law, court order, or governmental authority
• Business transfers: in connection with a merger or acquisition, with advance notice to affected organisations
• With your consent: in any other case where you have given explicit authorisation

4. Data Security

We take data security seriously. Your data is stored on AWS Aurora PostgreSQL Serverless in encrypted form. All data in transit is encrypted via TLS 1.2+. We implement row-level multi-tenancy ensuring one organisation cannot access another's data.

Access to congregation member data requires authentication. We use bcrypt password hashing and short-lived JWT tokens. No payment card data is stored on our servers — all billing is handled by PCI-compliant processors.

5. Data Retention

We retain your account and organisation data for as long as your subscription is active. Upon account closure, we will delete or anonymise your data within 90 days, except where we are required to retain it for legal obligations.

Congregation member data entered by your organisation is retained for the life of your subscription. You may request deletion of specific records at any time through the Admin console or by contacting support.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• GDPR (EU/UK residents): right to access, rectification, erasure, restriction, portability, and objection
• CCPA (California residents): right to know what data we collect, right to delete, right to opt out of sale (we do not sell data)
• All users: right to receive a copy of your data, right to correct inaccuracies, right to close your account

To exercise any of these rights, contact us at help@theflock.company. We will respond within 30 days.

7. Contact

For privacy-related questions, concerns, or data requests:

Email: help@theflock.company
Subject line: Privacy Request — [your organisation name]

For general support: help@theflock.company