Privacy Policy
1. Introduction
1580 Resources LLC (“we,” “us,” or “our”) operates the My Church Secretary (“MCS”) application, a software platform that helps small churches and similar religious organizations manage member directories, pastoral care, communications, and related administrative functions (the “Service”). This Privacy Policy describes how we collect, use, share, and protect personal information in connection with the Service.
This Policy applies to two categories of users:
- Church administrators, pastors, and other authorized users (“Customers”) who use the Service on behalf of a church or religious organization (a “Church”); and
- Church members, prospective members, visitors, and other individuals (“Members”) whose personal information is entered into or processed within the Service by a Church.
With respect to Member information, the Church is the controller and decision-maker regarding what data is collected and how it is used within the Service. MCS acts as a processor and handles Member information on the Church’s instructions under our Customer agreement. Members who wish to exercise rights over their information should generally contact their Church first; we will assist the Church in responding.
2. Information We Collect
2.1 Information We Collect from Customers
When a Customer creates an account or uses the Service, we collect:
- Name, email address, phone number, and role within the Church.
- Account credentials, including a username and a hashed (one-way encrypted) password.
- Church identifying information, including legal name, mailing address, and Employer Identification Number (EIN) where applicable.
- Subscription and payment information, which is processed through our third-party payment provider. We do not store complete payment card numbers.
- Support requests, feedback, and other communications you send to us.
2.2 Member Information We Process on Behalf of Churches
Churches use the Service to maintain records about their Members. The specific information held about a Member depends on what each Church chooses to enter, and typically includes:
- Names, mailing addresses, telephone numbers, and email addresses.
- Household and family relationships.
- Membership status and sacramental records, such as baptism, confirmation, and marriage records.
- Attendance, contribution, and pastoral care records.
- Birthdays, anniversaries, and other significant dates.
- Photographs uploaded by the Church.
- Records of SMS opt-in consent and message history.
- Donation records imported from the Church’s online-giving page, including donor name, donor email, gift amount, gift purpose, and the payment processor’s transaction reference. The Church is the merchant of record for online giving; complete payment card and bank-account details are captured directly by Stripe through embedded payment fields and are not visible to or stored by us.
We process this information solely to provide the Service to the Church and as otherwise permitted by our Customer agreement and this Policy.
2.3 Information Collected Automatically
When you use the Service, we automatically collect technical and usage information, including:
- IP address, device identifiers, browser type, and operating system.
- Pages, features, or screens accessed, and the dates and times of access.
- Diagnostic data, error logs, and performance metrics.
We use cookies and similar technologies for authentication and session management. You may disable cookies through your browser, although some features of the Service may not work properly without them.
2.4 Information from Third Parties
If you sign in to the Service through a third-party identity provider (such as a single sign-on service), we receive limited account information from that provider as authorized by you. We do not receive your password from those providers.
3. How We Use Information
We use personal information to:
- Provide, maintain, secure, and improve the Service.
- Process and deliver communications (including SMS text messages) initiated by a Church to its Members.
- Authenticate users and protect accounts against unauthorized access.
- Process subscription payments and manage billing.
- Import donation records from the Church’s online-giving page back into the Service for the Church’s recordkeeping and pastoral acknowledgment of donors.
- Respond to support requests and provide customer service.
- Send service-related notices, such as outage notifications, security advisories, and billing communications.
- Detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service or Acceptable Use Policy.
- Provide AI-assisted features, including: (a) helping Customers generate reports from data already in their Church’s directory, where the AI model interprets a Customer’s natural-language request and selects report filters and parameters — Member records themselves are not transmitted to the AI provider; and (b) drafting suggested social-media posts for the Customer’s connected social media accounts based on the upcoming Sunday’s Scripture readings, the liturgical season, and the Customer’s stated denominational style preference — no Member personal information is transmitted to the AI provider for this purpose.
- Comply with applicable laws, regulations, and lawful requests from government authorities.
We do not use Member information for our own marketing purposes. We do not use Customer or Member information to train artificial intelligence or machine learning models, and our AI service provider does not use the inputs or outputs of our API calls to train its models.
4. SMS Messaging — Program Disclosures
The Service enables Churches to send SMS text messages to Members who have opted in to receive them. The disclosures below apply to that messaging program.
Consent. A Member receives SMS messages from a Church only after that Church has obtained the Member’s express written consent to be contacted by text message. Churches are responsible for collecting and maintaining records of consent in accordance with our Customer agreement and applicable law, including the federal Telephone Consumer Protection Act (TCPA).
Types of Messages. SMS messages may include service and event reminders, prayer chain requests, weather-related cancellations, pastoral care follow-ups, schedule changes, and similar communications associated with the Church’s ministry. The specific message types depend on each Church’s program.
Message Frequency. Message frequency varies by Church and may range from a few messages per month to multiple messages per week.
Message and Data Rates. Message and data rates may apply. SMS messages are subject to the rates and fees of the recipient’s mobile carrier.
Opt-Out. A Member may opt out of SMS messages at any time by replying STOP, STOPALL, END, QUIT, CANCEL, UNSUBSCRIBE, or OPT OUT to any message. Opt-outs are processed automatically and at no charge to the Member. After opting out, the Member will receive a single confirmation message and will not receive further messages from that Church through the Service unless the Member opts back in. A Member who has previously opted out may opt back in by replying START, UNSTOP, or YES.
Help. A Member may reply HELP to any message to receive contact information for the Church and instructions on how to opt out.
Phone Numbers Are Not Sold or Shared for Marketing. We do not sell, rent, lease, or share Member phone numbers, opt-in data, or SMS consent records with third parties for marketing, advertising, or promotional purposes. Phone numbers and consent records are used only to facilitate the Church’s authorized messaging to its Members and for required service and compliance operations, including relay through telecommunications providers, delivery reporting, and STOP and HELP keyword handling.
Telecommunications Providers. SMS messages are transmitted through our SMS service provider (identified in Section 6.2) and the recipient’s mobile carrier. These providers receive phone numbers and message content as necessary to deliver the messages.
5. Public-Facing Content
Certain features of the Service allow a Church to publish information about its ministry to audiences outside the Service, such as a public-facing website, social media account, or external email distribution. These publishing features are configured and controlled by the Church.
5.1 What May Be Published
A Church may use the Service to publish:
- Calendar information, including event titles, dates, times, locations, descriptions, and the names of leaders, readers, or other participants assigned by the Church.
- Announcements and similar communications authored by the Church.
Each Church determines, through settings within the Service, what content to publish and to which destinations. Publishing is initiated only when a Church user takes an action that selects content for publication.
5.2 Member Information in Published Content
Member personal information — including mailing addresses, telephone numbers, email addresses, household composition, sacramental records, contribution records, attendance records, pastoral care notes, photographs, dates of birth, and SMS consent records — is not published to public audiences by the Service. A Member’s name may appear in publicly published calendar entries, bulletins, or orders of service only when the Church has assigned that Member to a public role for a scheduled service, event, or ministry activity.
5.3 Removal Requests
A Member who does not wish to be identified in publicly published content should contact the Church. The Church controls publication decisions and can remove or anonymize a Member’s name in future content generated through the Service. We will reasonably assist the Church in identifying and removing content that was generated through the Service. Once content has been distributed to a third-party platform such as a public website, social media service, or external email recipient, removal from that platform is subject to that platform’s own controls.
5.4 Third-Party Platforms
When a Church publishes content to a third-party platform such as a public website, a social media service (for example, Facebook), or an external email service, that platform’s own privacy practices and terms of service govern its handling of the content once received. We are not responsible for the privacy practices of those platforms, and we encourage Churches to review the policies of any platform to which they publish.
5.5 Connected Social Media Accounts
A Church may connect its own social media account (for example, its Facebook page) to the Service so that the Service can publish posts the Church has authored and approved. The Church grants this access through the platform’s OAuth process and may revoke it at any time through that platform’s settings. When the Service publishes a post on the Church’s behalf, the post content — including any photographs and the names of any persons assigned to a public role for a scheduled event — is transmitted through the platform’s API. The Church’s relationship with the connected platform is governed by that platform’s own terms and privacy policies.
5.6 Online Giving
Where a Church enables the online-giving feature, donations are processed through a payment page integrated into the Church’s own public-facing website. The Church is the merchant of record for donations received through that page and contracts directly with our payment processor. Donation funds flow into bank accounts the Church controls; we do not process, settle, custody, or transmit donation funds. Complete payment card and bank-account information is captured directly by the payment processor through embedded payment fields and is not visible to or stored by us. For each completed donation, the Service imports the donor’s name, the donor’s email address, the gift amount, the gift purpose (where indicated by the donor), and the payment processor’s transaction reference; this information is recorded on the Church’s behalf so that the Church can issue receipts and acknowledge donors. Donor information received through the online-giving page is subject to this Policy in the same manner as other Member information described in Section 2.2.
6. How We Share Information
We share personal information only as described below.
6.1 With the Church
Member information entered by a Church is accessible only to authorized users of that Church and to our personnel who require access to operate and support the Service. We do not make a Member’s information available to any other Church, to other Customers, or to the public.
Within a Church’s account, the Service applies role-based access controls to certain pastoral fields. In particular, fields designated as pastoral care notes are visible only to the Authorized User holding the pastor role at that Church; other Authorized Users, including administrative staff, are denied both read and write access to those fields. The Customer is responsible for assigning roles within the Service accurately.
6.2 With Service Providers
We use trusted third-party vendors to deliver the Service. These vendors are bound by contractual obligations to use information only as necessary to provide their services to us and to safeguard it appropriately. Current vendors by category:
- Telecommunications: Twilio Inc., for SMS delivery and related messaging services.
- Application hosting and data storage: Microsoft Corporation (Microsoft Azure, including Azure SQL Database) — hosts the Service and stores Customer account information and the Member records that Churches enter through the Service. Microsoft acts solely as a data processor on our behalf and does not access Customer or Member information for its own purposes. Data is encrypted in transit and at rest.
- File storage: Cloudflare, Inc. (Cloudflare R2) — stores photographs, documents, and other files uploaded through the Service. Cloudflare acts solely as a data processor on our behalf and does not access file contents for its own purposes. Files are encrypted in transit and at rest.
- Payment processing: Stripe, Inc. — processes (a) Customer subscription payments to MCS, where MCS is the merchant of record; and (b) donations from Members and other donors to a Customer’s online-giving page, where the Customer (the Church) is the merchant of record and contracts directly with Stripe. In both roles, complete payment card and bank-account details are captured directly by Stripe through embedded payment fields and are not visible to or stored by us.
- Transactional email: Resend, Inc. — delivers transactional email on our behalf, including account verification, password resets, billing notices, and service-related notifications to Customers.
- Error tracking and performance monitoring: Microsoft Corporation (Azure Application Insights) — collects application diagnostic data, error logs, exception traces, and performance telemetry to help us monitor Service health and troubleshoot issues.
- AI-assisted features: Anthropic, PBC (Claude API) — supports two workflows: (a) translating Customers’ natural-language directory questions into report filters and parameters within the Service; and (b) drafting suggested social-media posts based on the upcoming Sunday’s Scripture readings, the liturgical season, and the Customer’s stated denominational style preference. Member records are not transmitted to Anthropic for either workflow. Anthropic does not use the inputs or outputs of our API calls to train its models.
We will update this Policy to reflect material changes to the vendor list, and where required by our Customer agreement we will provide advance notice to Customer administrators before engaging a new vendor that has access to Customer or Member information.
6.3 Legal and Safety Disclosures
We may disclose information when we reasonably believe disclosure is required by law or appropriate to (a) respond to a valid subpoena, court order, or governmental request; (b) enforce our Terms of Service or other agreements; (c) investigate or prevent illegal activity, fraud, or threats to the rights, property, or safety of any person; or (d) protect the security and integrity of the Service. Where permitted, we will notify the affected Church before disclosure.
6.4 Business Transfers
If we are involved in a merger, acquisition, financing, reorganization, sale of all or substantially all of our assets, or bankruptcy, personal information may be transferred as part of that transaction. We will provide notice as required by law and will require any successor to honor the commitments made in this Policy.
6.5 We Do Not Sell Personal Information
We do not sell personal information, and we do not share personal information with third parties for those third parties’ independent marketing or advertising purposes. We do not engage in “targeted advertising” as defined under applicable U.S. state consumer privacy laws.
7. Data Retention
We retain personal information for as long as needed to provide the Service and for legitimate business and legal purposes:
- Active Customer accounts: Customer and Member data is retained for the duration of the Customer’s subscription.
- Closed or terminated accounts: Customer and Member data is retained for up to ninety (90) days following termination, during which the Customer may request export or restoration of its data. After ninety (90) days, the data is deleted or anonymized, unless a longer retention period is required by law or by the Customer’s instructions.
- SMS consent and message records: On behalf of the Church and as its processor, we retain records of opt-in consent, opt-outs, and message delivery for a minimum of four (4) years following the last message or the date consent was withdrawn. This retention period is designed to support the Church’s compliance with the federal Telephone Consumer Protection Act and the practical evidentiary needs of any related dispute. The Church remains responsible for the legal status of these records as the controller.
- Backups: Information may persist in routine backup systems for up to ninety (90) days following deletion from primary systems.
A Customer may request earlier deletion of its data by contacting us, subject to any legal retention obligations.
8. Data Security
We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These safeguards include encryption of data in transit using industry-standard TLS, encryption at rest, role-based access controls, audit logging, secure backups, and routine security reviews. No system can be guaranteed completely secure. We encourage all users to choose strong, unique passwords, to keep their account credentials confidential, and to notify us promptly of any suspected unauthorized access at the contact address in Section 13.
9. Your Rights and Choices
9.1 All Users
Subject to applicable law and reasonable verification of your identity, you may:
- Request access to a copy of the personal information we hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of your information, subject to legal and contractual retention requirements. Members should direct deletion requests to their Church as described in Section 9.2.
- Withdraw consent to SMS messaging at any time, as described in Section 4.
- Close your Customer account.
9.2 Members
If you are a Member, you should generally direct requests regarding your information to the Church that maintains your record, because the Church controls what information is collected and how it is used. We will reasonably assist Churches in responding to Member requests.
9.3 Minnesota and Iowa Residents
The Service is offered to churches and religious organizations located in Minnesota and Iowa. Residents of those states have rights under their state consumer privacy laws, as described below.
Minnesota residents: Under the Minnesota Consumer Data Privacy Act, you have the right to: (a) confirm whether we are processing your personal data and access that data; (b) correct inaccurate personal data; (c) delete personal data; (d) obtain a portable copy of personal data you provided to us; (e) opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and (f) question the result of profiling and be informed of the actions we might take to address the result.
Iowa residents: Under the Iowa Consumer Data Protection Act, you have the right to: (a) confirm whether we are processing your personal data and access that data; (b) delete personal data you provided to us; (c) obtain a portable copy of personal data you provided to us; and (d) opt out of the sale of personal data and of targeted advertising.
As stated in Section 6.5, we do not sell personal data, do not engage in targeted advertising, and do not use personal data for profiling in furtherance of decisions that produce legal or similarly significant effects about you.
How to exercise your rights. You may submit a request by contacting us at the address in Section 13. We will verify your request using information already associated with your account or, for Members, by working with the Church that maintains your record. Minnesota residents may designate an authorized agent to make a request on their behalf; we may require the agent to provide written authorization and may require you to verify your identity directly with us.
Appeals (Minnesota). If we decline to take action on your request, you may appeal our decision by replying to our response or by contacting us at the address in Section 13 within a reasonable time. We will respond to your appeal in writing within forty-five (45) days of receipt. If we deny your appeal, we will provide you with information on how to submit a complaint to the Minnesota Attorney General.
10. Children’s Privacy
The Service is intended for use by adults who act on behalf of a Church. We do not knowingly collect personal information directly from children under the age of thirteen (13). Churches may, however, enter information about minor Members — such as in family directory records, baptism or confirmation records, or pastoral care notes — at the direction of the minor’s parent or guardian and consistent with the Church’s role in the family’s religious life. Under our Customer agreement, the Church is responsible for obtaining any parental or guardian consent required by applicable law before entering information about a child under thirteen (13) into the Service. We process this information solely on the Church’s behalf and in accordance with applicable law. With respect to teen Members (ages 13 through 17), we do not use their personal information for targeted advertising, do not sell or share it as those terms are defined under U.S. state privacy laws, and do not profile them in a way that produces legal or similarly significant effects. Parents or guardians who wish to review, correct, or delete information about a minor should contact the Church first; we will assist the Church in fulfilling those requests.
11. Third-Party Links and Services
The Service may contain links to third-party websites or features that integrate with third-party services. This Policy does not apply to those websites or services. We are not responsible for their privacy practices. We encourage you to review the privacy notice of any third party before providing personal information to it.
12. Changes to This Policy
We may update this Policy from time to time. The “Last Updated” date at the top reflects the most recent revision. If we make material changes, we will provide notice by email to Customer administrators or by a prominent notice within the Service at least thirty (30) days before the change takes effect, except where a shorter period is required by law. Your continued use of the Service after the effective date of an updated Policy constitutes your acceptance of the updated Policy.
13. Contact Us
If you have questions, concerns, or requests regarding this Policy or our privacy practices, please visit our Contact page or write to us at:
1580 Resources LLC
Attn: Privacy
22 Mitchell Drive, Faribault, MN 55021
Email: pastoralex@mychurchsecretary.com