SmallGroupOS, Inc, Inc. ("SmallGroupOS," "we," "us," or "our") is committed to protecting the privacy of youth ministers, ministry leaders, students, and families who use our platform. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.
1. Information We Collect
We collect information necessary to provide our services to youth ministries:
- Account Information: Name, email address, and role when you create an account. Password hashes (we never store plaintext passwords).
- Ministry and Parish Data: Organization name, ministry details, and configuration settings.
- Student Records: Names, contact information, attendance records, discipleship stage data, group assignments, and notes entered by authorized ministry leaders.
- Attendance and Engagement Data: Check-in records, game participation, mood check responses, and session analytics.
- Form Submissions: Data submitted through ministry forms including registration forms, permission slips, and event sign-ups. This may include parent/guardian contact information and emergency contacts.
- Payment Information: Subscription billing is processed through Stripe. We do not store credit card numbers on our servers. Form payment data for event registrations is also processed through Stripe.
- Usage Data: Basic analytics about how you use the platform to help us improve the service (pages visited, features used).
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the SmallGroupOS platform
- Authenticate users and manage account access
- Enable ministry leaders to track student discipleship and engagement
- Generate analytics and reports for ministry leaders
- Process subscription payments and form-based payments
- Send transactional emails (magic links, verification emails, account notifications)
- Respond to support requests
3. Data Encryption and Security
We take the security of student data extremely seriously. Sensitive personal information is encrypted using AES-256-CBC encryption at rest. All data is transmitted over HTTPS/TLS. We implement role-based access controls to ensure that only authorized ministry leaders can access student information within their ministry.
Session tokens are stored as secure, HTTP-only cookies. Passwords are hashed using industry-standard algorithms and are never stored in plaintext.
4. We Do Not Sell Your Data
We will never sell, rent, or trade your personal information or student data to third parties. Period. Our mission is to serve youth ministers - not to monetize their data. Your ministry's data belongs to your ministry.
5. Data Sharing
We only share data with third parties in the following limited circumstances:
- Payment Processing: We use Stripe to process payments. Stripe's privacy policy governs payment data they collect.
- Email Delivery: We use Resend to deliver transactional emails (magic links, verification emails).
- Legal Requirements: We may disclose information if required by law, subpoena, or court order, or to protect the safety of individuals.
- Mandatory Reporting: If information shared through the platform indicates a minor is in danger, we support and expect ministry leaders to follow their legal mandatory reporting obligations.
6. Children's Privacy (COPPA)
SmallGroupOS is designed for use by youth ministers and ministry leaders who work with minors. We are committed to complying with the Children's Online Privacy Protection Act (COPPA).
- Student accounts are not created directly by minors. Ministry leaders create and manage student records.
- When students participate in live sessions (games, mood checks, brain dump walls), they join via temporary session codes without creating persistent accounts.
- Anonymous features (mood checks, brain dump walls) do not collect personally identifiable information from students.
- We do not knowingly collect personal information directly from children under 13 without verified parental consent.
- Parents or guardians may contact us to review, delete, or restrict the collection of their child's information.
7. Data Retention and Deletion
Ministry data is retained for as long as the ministry maintains an active account. When a ministry cancels their subscription, their data is retained for 90 days in case they wish to reactivate, after which it is permanently deleted.
Ministries can request immediate deletion of their data at any time by contacting us. Individual student records can be deleted by authorized ministry leaders through the platform.
8. Your Rights
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your account and associated data
- Export your ministry's data in a standard format
- Withdraw consent for optional data processing
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised.
10. Contact Us
If you have questions about this Privacy Policy or how we handle your data, please contact us at:
Email: [email protected]
Organization: SmallGroupOS, Inc, Inc.