Privacy Policy
Effective November 6, 2026 · 2026-11-06
Who handles your information
Shepherd Staff Resources operates Shepherd Connect. Churches decide which member information to enter and which leaders may access it; we process church records to provide the service. For changes to your church’s records, contact its administrator first. You may also contact us at jim@gratefulconsultinggroup.com without creating an account.
Information collected and sources
We receive information from church administrators, leaders, members, and payment-service events. This can include names, email addresses, phone numbers, birthdays, ministry membership, attendance and check-in/out times, communication preferences, faith milestones and notes, uploaded files, administrator contact details, and subscription status. We also use account identifiers, essential cookies, device tokens, saved language preferences, and request/security logs. Faith records can reveal religious beliefs; churches should limit sensitive notes to what is necessary.
How information is used and shared
We use information for account access, ministry records, authorized communications, billing, support, and abuse prevention. Church administrators and assigned ministry leaders can access records according to their roles. Authorized platform support may access information to resolve problems. Providers include Vercel for hosting, Supabase for database/authentication and file storage, Resend for email, and Stripe for payments. We may disclose information when legally required or necessary to protect rights and security. We do not sell member information or share it for cross-context behavioral advertising.
Payments and browser storage
Payment details are entered on Stripe’s checkout; Shepherd Connect stores subscription identifiers and billing status, not full card numbers. Essential cookies support staff sign-in and remembered check-in devices. Browser storage remembers language choices. The public website does not use advertising trackers. We do not use Global Privacy Control signals to enable sale or advertising sharing; those activities are not part of this service.
Retention and security
We use HTTPS, server-side authorization, and role-based access controls. No system guarantees absolute security. Records remain viewable/exportable for 90 days after paid access ends and are then locked, not automatically deleted. We retain account and service records as needed for the account, restoration, security, legal obligations, and dispute handling. Contact us to request deletion; legal retention exceptions and backup retention may apply. Do not rely on this service as your only archive.
Your choices, youth information, and changes
You may request access, correction, deletion, or information about our use of your data by email. We verify requests and coordinate with the church when appropriate, honoring applicable privacy rights without discrimination. Use unsubscribe links for ministry email preferences. The service is administered by adults and is not directed to children under 13 for independent account creation. Churches are responsible for appropriate parent/guardian permission when recording youth data. Data may be processed in the United States by our providers. We post updates with an effective date and communicate material changes when required.