Privacy Policy

Our role. For the giving data your church connects, your church is the data controller: it decides what to connect and why. Constat acts as a data processor / service providerthat stores and processes that information on the church's instructions to provide the service. If you are a donor whose gift a church recorded, direct requests about that information to the church.

1. Information We Collect

Account Information

When you create an account, or are invited to one, we collect:

• Name and email address
• The church or firm name
• A password, if you choose one (stored only as a hash, never in plain text)
• Your access level in each church or firm
• The versions of these Terms and this Privacy Policy you accepted

Giving Data from Planning Center

When your church connects Planning Center, we read from Giving:

• Funds and campuses
• Gifts: amount, date, fund designations, payment method, processing fee, and the batch or payout they belong to
• Refunds and batches
• Donor names and email addresses, only when your church turns on keeping them (detail mode turns it on)

QuickBooks Data

When your church connects QuickBooks Online, we read its company settings and the accounts, classes, locations, items and payment methods needed to map funds, and we keep a record of each object we post (its id and the request and response).

Payout Files

The payout emails and CSV files your church forwards to its Constat address or uploads. Each file is scanned for viruses before it is read. Messages from senders your church has not allowed are stored but not read.

Communications With Us

When you contact support, we keep your name, email address, and the contents of your request so we can respond.

When you send the contact form or request a giving platform, we store your name, email address, message and a hashed form of your IP address, and use them only to reply to you.

Usage Information

We automatically collect certain information when you use Constat:

• Log data (IP address, browser type, pages visited, timestamps)
• Actions taken in the app, recorded in an audit log (who approved, posted, connected or changed what, and when)
• Error reports and product analytics

Payment Information

Payments are processed by Stripe. When you subscribe, you enter your payment details on a page Stripe hosts, and Stripe stores them; we never receive or store your card number. We keep the Stripe customer and subscription identifiers and the subscription details Stripe sends us, such as the plan, billing interval, quantity, billing period, status and whether a payment failed.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: sync giving data, group and tie out payouts, and post the payouts you approve to QuickBooks
• Enable Collaboration: let the people your church or firm invites review and approve payouts
• Send Notifications: sync reports, invitations, and sign-in links
• Maintain Audit Trails: keep a record of who did what, for accountability
• Improve the Service: understand how it is used and fix errors
• Provide Support: answer your questions and troubleshoot problems
• Ensure Security: detect and prevent fraud, abuse, and security incidents

3. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA). We do not use your data to train artificial-intelligence or machine-learning models, and we do not use it for advertising. We share information only in the following circumstances.

Within Your Church or Firm

Data is shared with members of your church or firm according to the access level each one has. Donor names are visible only to reviewers and above.

QuickBooks Online

We send your church's QuickBooks company the deposits (and, in detail mode, the receipts and donor customers) that are approved for posting. In the default summary mode no donor names are sent to QuickBooks.

Service Providers

We use these companies (our "subprocessors") to operate Constat:

• Vercel: Hosts the app and runs the nightly sync and other scheduled jobs.
• Supabase: Database, sign-in, and private storage for payout files.
• Resend: Sends sync reports and invitations, and receives forwarded payout emails.
• Sentry: Error reports from the app, so failures get fixed.
• PostHog: Product analytics: which pages and features are used.
• Cloudflare: Bot checks on the sign-up, sign-in, contact and platform-request forms (Turnstile).
• Fly.io: Runs the ClamAV virus scanner that checks every payout file before it is read.
• Stripe: Subscription billing and payments.
• Anthropic: Suggests column mappings and reads PDF payout totals, on redacted data.

They may use your data only to provide their services to us. The current list, with regions, is on our Security page, and we will update it before adding a new subprocessor.

Column-Mapping Suggestions

When we cannot read a payout file's columns, a person at your church or firm can ask Anthropic's Claude model to suggest how to map them. We send only the column names, the totals of the amount columns and up to five rows with names, descriptions, contact details, card digits, account numbers and notes removed. That person confirms every mapping before any file is read with it; a suggestion is never applied on its own. Where reading a PDF statement is switched on, we also send the lines of a text PDF that contain an amount, with names, email addresses and long numbers removed, to read the payout totals; we never read individual gifts or donors from a PDF, and a PDF whose totals do not balance to the cent is not used.

Legal Requirements

We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect our rights or property
• Prevent fraud or illegal activity
• Protect the safety of users or the public

Business Transfers

If Constat or Steward Software LLC is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Data Security

• Encryption in Transit: all traffic to and from Constat uses HTTPS
• Encryption at Rest: Planning Center, QuickBooks, Pushpay and Xero access tokens are encrypted by us with AES-256-GCM. Our database and file storage provider, Supabase, states in its security documentation that it encrypts customer data at rest with AES-256
• Access Controls: row-level security limits every person to the churches and firms they belong to
• File Scanning: every payout file is scanned for viruses before it is read

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected]. More detail is on our Security page.

5. Data Retention

• Giving records, payouts and payout files: kept until your church deletes them
• Audit log: kept as the record of what happened, including after a church is deleted (with the church removed from it)
• Account information: kept while your account is active and for a reasonable period afterward

When a church owner deletes a church, we revoke our access at Planning Center and Intuit and delete the church's payout files, synced gifts, payouts and mappings. Nothing is deleted in QuickBooks or Planning Center.

6. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: request a copy of your personal data
• Correction: request correction of inaccurate data
• Deletion: request deletion of your data (subject to legal and retention requirements)
• Portability: request your data in a portable format (a church can also export it as CSV)

To exercise these rights, contact us at [email protected]. We will respond to verifiable requests within the timeframe required by applicable law (generally within 45 days, with an extension where permitted). We do not discriminate against you for exercising your privacy rights. If we deny a request, you may appeal by emailing [email protected]with "Appeal" in the subject line; we will respond within 45 days.

Giving records belong to the church that connected them. Requests about that data should go to the church, and we will help the church fulfill them.

7. Cookies

We use cookies and similar technologies for:

• Authentication: keeping you signed in
• Preferences: remembering your settings (like dark mode)
• Security: detecting and preventing abuse
• Analytics: understanding how the service is used
• Referrals: when you open a bookkeeping firm's referral link, a first-party cookie named constat_ref stores that firm's account name in the web address (its slug) for 30 days, so an account you create in that browser is recorded as referred by the firm. It is read once, when the account is created, and then deleted.

You can control cookies through your browser settings, but disabling them may affect functionality. We do not use cookies for cross-context behavioral advertising, and we do not currently respond to Do Not Track or Global Privacy Control signals.

8. Children

Constatis not directed at anyone under 18, and we do not knowingly collect personal information directly from children. Giving records a church connects may include gifts made in a minor's name; the church is responsible for that data.

9. International Data Transfers

Constat is operated from the United States. If you use the service from outside the US, your information may be transferred to and processed in the US.

10. Breach Notification

If we confirm a security breach affecting a church's personal information, we will notify that church without undue delay and provide the information reasonably available to us. As the controller, the church is responsible for any notifications to affected individuals and regulators; we will reasonably assist. A church subject to data-protection laws may request a data processing addendum at [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting a notice on our website
• Sending an email to account owners
• Updating the "Last updated" date above

Continued use of Constat after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact Steward Software LLC at [email protected].