Data Processing Agreement & Church Congregation Data Stewardship

1. Congregation Data Ownership & Export Guarantees

Data Ownership: Your church retains full ownership of all congregation data stored in GraceBase, including member information, donation records, attendance, group memberships, and any other data you enter or upload to the platform. GraceBase acts solely as a processor of this data on your behalf.

Export Rights: You have the right to export your complete dataset at any time in standard formats (CSV, JSON, or other structured formats). No restrictions apply — you can export your data whenever you choose, whether your subscription is active, suspended, or cancelled. GraceBase will not prevent, delay, or restrict your ability to export your data.

Data Portability: You may switch to competing platforms at any time. Upon written request, we will provide your data in a portable, machine-readable format suitable for transfer to another service.

No Hostage Practices: GraceBase does not lock churches into our platform through data hostage practices, hidden export fees, or technical barriers to data retrieval. Exporting your data is always free and friction-free.

2. Minor & Child Check-In Stewardship (COPPA)

Child Data Protections: GraceBase recognizes that churches collect information about children through programs like nursery check-in, children's ministry, and youth groups. We take special care in protecting this data.

COPPA Compliance: Where the Children's Online Privacy Protection Act (COPPA) applies, GraceBase implements features and safeguards to help churches comply, including:

• Parental consent tracking tools to document verifiable parental consent before storing children's personal information
• Age-appropriate data collection limits — children's data is entered only by authorized church staff, not by children directly
• Restricted access controls — only authorized staff can view children's records
• Data retention and deletion tools to remove children's records when no longer needed

Church Responsibility: However, your church remains responsible for complying with COPPA and applicable state laws governing child data protection. GraceBase provides the tools; your church determines how and when to use them.

3. Sub-Processor Disclosure Table

GraceBase uses the following third-party service providers to operate the platform. Each provider processes data only as necessary to provide their specific service:

We maintain data processing agreements with each sub-processor and will notify you of any material changes. For questions about our sub-processors, contact privacy@gracebase.co.

4. Tenant Isolation & Security Controls

Multi-Tenant Architecture: GraceBase operates as a multi-tenant platform, meaning multiple churches use the same application infrastructure. We implement strict isolation controls to ensure that no church can access another church's data.

Row-Level Security (RLS): Our PostgreSQL database enforces Row-Level Security policies at the database layer. Every query for congregation data includes automatic filters based on the authenticated user's church assignment. Even if a bad actor bypassed application logic, the database itself would reject unauthorized queries.

Encryption at Rest: All data is encrypted using AES-256 encryption while stored on disk. Database backups are also encrypted.

Encryption in Transit: All communication between your browser, the GraceBase application, and our backend services uses TLS 1.3 encryption. No congregation data is ever transmitted unencrypted.

Access Logging: We maintain audit logs of all data access and administrative actions, enabling us to detect and investigate suspicious activity.

5. 72-Hour Incident Notification Window

Incident Response: In the unlikely event of a confirmed data breach, security incident, or unauthorized access affecting your church's data, GraceBase commits to:

• Notification within 72 hours: We will notify affected churches by email to the account owner and administrators within 72 hours of confirming the incident
• Detailed disclosure: Our notification will include details of what data was affected, when we discovered the incident, what we have done to remediate it, and what steps churches should take
• Continued updates: We will keep affected churches informed as our investigation progresses
• Compliance with law: We will also comply with all applicable data breach notification laws by jurisdiction

For security concerns or to report a potential breach, contact security@gracebase.co immediately.

Data Processing Terms

Lawful Processing: Your church controls what data is collected and how it is used. GraceBase processes data only as instructed by your church to provide the Service.

Data Retention: Your church determines how long data is retained. You can delete records anytime, and upon account cancellation, you have 90 days to export your data before it is permanently deleted from our systems.

International Transfers: Our service providers are located in the United States, and your information may be processed there. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) to protect your information.

Third-Party Processors: We maintain written data processing agreements with all sub-processors to ensure they meet the same data protection standards we do. Sub-processors are bound by confidentiality and cannot use data for their own purposes.

Contact & Further Information

For questions about this Data Processing Agreement, data protection, or to discuss any concerns about how we handle your church's data, please contact us: