Privacy Policy

Understanding who controls and who processes your data is foundational to this policy. Under applicable US and international privacy frameworks, the following roles apply on the AGAPAY platform:

For the purposes of this policy, "personal data" or "personal information" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.

We collect only the information necessary to provide the platform's services. The categories of personal data we collect are:

AGAPAY processes personal data on the following legal bases under applicable law:

• Contractual necessity. Processing required to fulfill our obligations to you under our Terms of Service - including processing donations, transmitting memorial names to clergy, and providing account services.
• Legal obligation. Processing required to comply with applicable law - including IRS record-keeping requirements for charitable organizations (7-year retention of financial records), anti-money-laundering obligations, and applicable state charity registration laws.
• Legitimate interests. Processing necessary for AGAPAY's legitimate business interests where not overridden by your privacy rights - including platform security, fraud prevention, and aggregate analytics to improve the platform.
• Consent. Where required by applicable law, we obtain your consent before processing your data for specific purposes (such as marketing communications). You may withdraw consent at any time by contacting hello@agapay.app, without affecting the lawfulness of prior processing.

We collect and process personal data solely for the following purposes, and we do not use your data for any purpose incompatible with those listed here without your consent:

• Transaction processing. Processing and recording charitable gifts on behalf of the recipient parish or monastery, including generating receipts and confirmation emails.
• Memorial transmission. Transmitting liturgical memorial and intention names to designated clergy for commemoration at the proskomedia, panikhida, or parastas.
• Requested parish outreach. When you explicitly ask us to contact a prospective parish, storing the request, sending a one-time introduction to the public parish contact you provide, notifying the AGAPAY team, and confirming the request with you. We do not share your email address with the parish.
• Giving records. Generating annual giving statements and year-end commemoration records for donors, for tax substantiation and personal record-keeping purposes.
• Legal compliance. Complying with applicable tax, accounting, charitable reporting, anti-money-laundering, and financial record-keeping requirements.
• Account services. Maintaining donor and administrator accounts, providing support, and communicating regarding your use of the platform when requested.
• Contract records. Preserving reliable, append-only evidence of the Terms and disclosure affirmatively accepted by an account holder or authorized Organization representative.
• Platform security. Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and other harmful activity.
• Platform improvement. Using aggregated, de-identified analytics data to understand usage patterns and improve the platform. Individual user data is not used for this purpose.
• Internal referral and campaign measurement. Measuring whether AGAPAY's own parishioner-referral and outreach efforts lead to visits, shares, downloads, and demo requests so AGAPAY can evaluate and improve those efforts. AGAPAY uses these reports solely for its own internal business analysis and does not sell the underlying information or use it to build marketing profiles.

AGAPAY uses limited browser storage and provider-hosted security, payment, analytics, and campaign-measurement technologies to operate and evaluate the platform. AGAPAY does not use these technologies to sell personal information or conduct cross-context behavioral advertising.

• Essential browser storage. AGAPAY uses first-party local storage for donor sign-in state and selected preferences, and session storage for parish and administrator sign-in state. Donor server sessions expire after 14 days; parish and administrator server sessions expire after 12 hours. Browser values may remain on a device until logout, browser-data deletion, or application cleanup, but an expired server session cannot authorize access.
• Provider-hosted technologies. Cloudflare Turnstile and Stripe-hosted checkout may use cookies or similar technologies on their own widgets or pages for fraud prevention, security, and payment processing under their respective privacy notices.
• Analytics. We use Cloudflare Web Analytics, a privacy-preserving tool that does not use cookies, fingerprinting, or cross-site tracking to collect personally identifiable data. Analytics data is aggregate and anonymized. No user-level behavioral profiles are created.
• First-party referral attribution. On public marketing pages, browser storage preserves the first visit for up to 90 days and the current visit source across page navigation (30 minutes of inactivity). Contact, demo, and registration submissions include both records: campaign tags, referring and landing-page paths, conversion page, and timestamps. URL query strings and fragments are excluded from stored page and referrer URLs. No fingerprint or visitor ID is created. Forms continue to work when this storage is unavailable.
• Limited Meta campaign measurement. On AGAPAY's parishioner-referral and parish-demo pages, the Meta Pixel records page views and selected actions such as email shares, link copies, council-overview downloads, and successfully submitted demo requests. Depending on browser and Meta settings, Meta may receive the page URL, event name, IP address, browser or device information, and cookie or similar identifiers. AGAPAY uses the resulting measurement reports only for its own internal referral and campaign analysis. AGAPAY does not sell this information, use these events for retargeting or cross-context behavioral advertising, or provide form contents such as names, email addresses, parish names, or messages to the Pixel.
• No sale of tracking information. AGAPAY does not sell, rent, or trade information collected through analytics or campaign-measurement technologies. Meta processes Pixel data under its own privacy policy and controls; use of the Pixel does not change AGAPAY's unconditional no-sale commitment in Section 7.

You may configure your browser to refuse cookies or clear cookies and site data. Login, checkout, security checks, and session persistence may not operate correctly when required browser storage or provider technologies are blocked.

We do not currently respond to browser Do Not Track (DNT) signals, as no uniform standard for DNT has been established. Browser privacy settings, content blockers, and Meta's activity controls may limit or block Pixel requests without affecting the referral page or demo-request form.

AGAPAY shares limited personal data with the following service providers, each engaged under contractual data protection obligations. We conduct due diligence on providers' privacy and security practices before engagement.

We do not share personal data with any party beyond those listed above, except as required by law (see Section 7 below).

Beyond the service providers listed in Section 6, AGAPAY may share your personal data only in the following limited circumstances:

• With your Organization. Donor transaction records, memorial submissions, and giving history are shared with the registered administrator(s) of the recipient Organization. This sharing is inherent to the platform's purpose and is the basis on which you donate through AGAPAY.
• Legal process. We may disclose personal data in response to a valid subpoena, court order, or other legal process, or when required by applicable law or regulation. Where legally permitted, we will notify affected users before disclosure.
• Protection of rights. We may disclose personal data when we reasonably believe disclosure is necessary to prevent fraud, protect our legal rights, or protect the safety of any person.
• Business transfers. In the event of a merger, acquisition, or sale of all or substantially all of AGAPAY's assets, personal data may be transferred to the successor entity, subject to the same privacy protections described in this policy. We will provide notice of such a transfer and, where required, obtain consent.
• With your consent. We may share data for any other purpose with your explicit prior consent.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiration of the applicable retention period, data is securely deleted or irreversibly anonymized using industry-standard methods. You may request early deletion of non-legally-required data under Section 10-11 below.

Parish exports, closure, and retained copies

Requesting an export. Authorized parish administrators may use Data portability in the parish dashboard after signing in and completing the required identity verification. Exports provide eligible parish-scoped CSV and JSON records, supported uploaded files, and a manifest listing the export window, included files, checksums, and exclusions. They may contain sensitive parish, directory, giving, or accounting information. Authentication credentials, independent donor accounts, parent-owned Learn records, and other parishes' private data are excluded; shared identities contain limited fields. External media may be listed as links. An ordinary export is not a complete inventory of every stored or third-party copy. Contact hello@agapay.app if an export exceeds the limits shown in the dialog, needs unsupported media, fails, or is unavailable.

Temporary archives and downloaded copies. Export archives are held in private storage and downloaded through authenticated access. Download access expires seven days after the request, at the deadline shown in the dashboard. Expired archives are scheduled for cleanup; expiration of access is not a claim that every stored or recovery copy was erased at that instant. Export status and integrity metadata may remain after archive cleanup. Save and inspect the archive before the deadline, keep it secure, and share it only with authorized recipients. AGAPAY cannot recall copies already downloaded or transferred by the parish.

Cancellation and deletion are separate. Subscription cancellation remains available through the billing controls or support. It does not automatically delete records, and an export does not cancel the subscription. Contact us to request closure or deletion while the automated workflow is unavailable. These requests remain subject to identity and authority checks, applicable rights, and lawful retention exceptions; the disabled automated workflow does not suspend an individual's privacy rights or applicable response deadlines.

Retained records. A future automated closure would remove only eligible active parish data after a saved and verified final export, separate confirmation, and required safeguards. Accounting books, transactions, supporting financial or legal evidence, relevant support correspondence, legal holds, and minimal closure records may need to remain with restricted access. Independent donor accounts, parent-owned Learn records, and identities needed by another parish are not erased as part of one parish's closure. The applicable categories, retention periods, and any review dates must be disclosed before closure is authorized. A review date is not confirmation of automatic deletion. The draft automated-closure retention schedule is not approved by publication of this notice, and this notice does not replace the retention periods above with that draft schedule.

Backups and restoration. Deleting active records is separate from expiry of backups and provider recovery history. Strict backup expiry for automatic parish closure is not yet enabled: the current recovery process can preserve the newest recovery copy when all copies are past the normal expiry period. We therefore do not promise that downloading an export or cancelling a subscription immediately erases every backup. Automatic closure remains unavailable until backup expiry, recovery-copy inventory, and restoration safeguards are verified. Those safeguards require replaying the independent closure record before restored service resumes so that a completed closure is not undone by a restore. Records legitimately retained after closure may also appear in later backups until approved disposal.

Copies outside the parish purge. Records independently held by Stripe, email delivery providers, external media services, the parish, or other recipients follow their own applicable retention and deletion controls. AGAPAY's parish export or active-data purge does not itself erase those copies. We remain responsible for applicable obligations concerning providers processing data on our behalf.

Individual requests. Parish-wide portability is separate from your right to request access, correction, or deletion of your own information. Use the contact and request methods below or the My AGAPAY account deletion page; you do not need parish administrator access to submit an individual request.

AGAPAY employs administrative, technical, and physical safeguards designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction.

No method of transmission over the internet or electronic storage is completely secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security against all threats. You also play a role: keep your account credentials confidential and notify us immediately at hello@agapay.app if you suspect unauthorized access.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) affords you the following rights regarding your personal information:

To exercise any California privacy right, submit a verifiable written request to hello@agapay.app with subject line "California Privacy Request." We will verify your identity before processing any request and respond within 45 days as required by law, with a possible 45-day extension for complex requests with prior notice.

You may designate an authorized agent to submit requests on your behalf by providing written authorization. We may require direct verification from you if an agent submits a request.

If you are a Texas resident, the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, affords you the following rights regarding your personal data:

To exercise any Texas privacy right, submit a written request to hello@agapay.app with subject line "Texas Privacy Request." We will respond within 45 days, with a possible 45-day extension for complex requests.

Appeals. If we decline to act on your request, you may appeal by responding in writing to our decision email. If your appeal is denied, you may contact the Texas Attorney General to submit a complaint.

AGAPAY's accounts and administrative tools are intended for adults. Children are not permitted to create their own AGAPAY account or independently submit personal information to the platform.

AGAPAY Learn is a parent-managed homeschool service. A parent or legal guardian may enter information about a child, including the child's first name, age, grade or form, learning plans, attendance, academic work, scores, grades, notes, report cards, and transcripts. Parish Directory households and authorized parish personnel may also maintain limited information about minors, including household relationships, contact or profile information, photos, and carefully controlled publication settings. These features are operated by adults on behalf of their children or communities.

By entering information about a minor, the adult represents that they are the child's parent or legal guardian, or are otherwise authorized by the parent or legal guardian and the Organization to provide and manage that information. AGAPAY does not use child data for advertising or sell it. A parent or guardian may contact hello@agapay.app to request access, correction, or deletion, subject to identity verification, Organization responsibilities, and lawful retention requirements.

If you believe a child has used AGAPAY independently, or that child information was entered without appropriate authority, contact us immediately at hello@agapay.app. We will investigate and take appropriate action, which may include restricting access or deleting information that is not required to be retained.

Memorial names submitted for liturgical commemoration may include the names of minors; this data is treated with the same protections as all personal data under this policy, and is transmitted only to the designated clergy of the recipient Organization.

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform features. When we make material changes, we will:

• Post the updated policy on this page with a revised "Last Updated" date.
• Provide notice to affected account holders before or when material changes take effect when required by law or reasonably practicable.
• Display an in-product notice or send email when a change materially affects how account data is handled.

Non-material changes - such as typographical corrections, clarifications that do not change our practices, or updated contact information - may be made without advance notice and will be effective upon posting.

When a material change requires renewed agreement, AGAPAY will request affirmative acceptance from affected registered account holders and preserve evidence of that acceptance. We will not apply a material change to a dispute of which AGAPAY had actual notice before the change. If you do not agree, you may terminate your account before the change takes effect for you by contacting hello@agapay.app.

Disputes arising out of this Privacy Policy or AGAPAY's handling of personal data are governed by Section 24 of the Terms of Service, including its 30-day good-faith informal-resolution process, small-claims option, court process, voluntary post-dispute alternatives, and limits on retroactive changes. AGAPAY does not require arbitration or a class-action waiver.

• Governing law. This Privacy Policy is governed by the laws of the State of Texas, without regard to conflict of law provisions.
• Regulatory rights preserved. Nothing in this section limits your right to lodge a complaint with applicable state or federal privacy regulators, including the Texas Attorney General or the FTC.

For privacy-related questions, concerns, data access requests, or to exercise any right described in this policy, please contact AGAPAY at:

Account deletion: My AGAPAY users may initiate deletion from Account Settings or use the dedicated My AGAPAY account deletion page.

• Privacy requests: hello@agapay.app - include "Privacy Request" or your applicable right (e.g., "California Privacy Request") in the subject line
• Parish support: parishes@agapay.app
• Technical support: support@agapay.app
• Platform: agapay.app

We will respond to all privacy-related inquiries within 30 days of receipt. For requests under California or Texas law, we will respond within the statutory timeframe (45 days, with possible extension). We will request identity verification before processing any data access, correction, or deletion request.