Privacy Policy

Effective Date: March 14, 2026

Vine and Branch Software, LLC ("Company," "we," "us," or "our") is committed to protecting the privacy of users of the Vine and Branch church management platform ("Service"). This Privacy Policy describes how we collect, use, store, and protect your information.

1. Information We Collect

Account Information: When you register, we collect your name, email address, username, and password (stored as a secure hash). Administrators may also upload a profile photo.

Content You Provide: Sermons, prayer requests, announcements, calendar events, comments, and any other content you upload or enter into the Service.

Usage Data: We collect audit log data including the actions you take within the Service, along with your IP address and browser user-agent at the time of each action.

Technical Data: Browser type and version, device type, operating system, and session information collected automatically when you use the Service.

2. How We Use Your Information

To provide, operate, and maintain the Service
To authenticate your identity and manage your account
To maintain audit logs for your Organization's security and compliance purposes
To detect and prevent unauthorized access, fraud, and abuse
To communicate with you about your account, service updates, and support requests
To improve the Service through aggregate, anonymized usage analysis

3. How We Share Your Information

We do not sell your personal information. We may share it only in the following circumstances:

Within your Organization: Administrators can access user accounts, content, and audit logs within the Service.
Service Providers: Trusted third-party providers who assist us in operating the Service, subject to confidentiality obligations.
Legal Requirements: If required by law, court order, or governmental authority.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.

4. Data Retention

We retain your data for as long as your Organization's account is active or as necessary to provide the Service. When an account is deleted, we will delete or anonymize associated personal data within 90 days, except where retention is required by law.

5. Data Security

We implement industry-standard measures to protect your data, including:

Passwords stored using secure one-way hashing (bcrypt)
HTTPS enforced for all connections
Role-based access controls limiting data access to authorized users
Account lockout protection against brute-force login attempts
Field-level AES-128 encryption for sensitive records (pastoral notes, medical/allergy information, background check data)

6. Cookies and Tracking

The Service (portal) uses essential cookies only. A session authentication cookie is set on login — it is HttpOnly, SameSite=Strict, and necessary for the Service to function. This marketing site (vineandbranchapp.com) uses a localStorage value to remember your cookie consent preference and loads Google Analytics (measurement ID G-E7EK7QR4ZR) to understand aggregate traffic and page usage. We do not use advertising cookies. You can block analytics via browser controls or extensions; essential Service cookies are required to sign in.

7. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information without parental consent, please contact us and we will promptly delete it.

8. Sensitive and Special Category Data

Certain features of the Service allow authorized administrators to record sensitive information, including pastoral care notes, children's medical and allergy information, and background check results. All such fields are encrypted at rest before storage and are never shared with third parties except your Organization's designated administrators.

HIPAA Notice: Vine and Branch is a church management platform, not a healthcare provider or health plan. Pastoral care notes and children's allergy information do not constitute Protected Health Information (PHI) under HIPAA in standard church contexts. If your church operates a licensed counseling ministry, you may have independent HIPAA obligations; a Business Associate Agreement (BAA) template is available upon request at legal@vineandbranch.app.

9. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including the right to access, correct, or delete your data. Contact your Organization's administrator or reach us at privacy@vineandbranch.app. We will respond within 30 days.

10. International Transfers

The Service is hosted and operated in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page.

12. Contact

For privacy-related questions or requests: privacy@vineandbranch.app

Data Processing Agreement

If your church has EU members or operates under GDPR or US state privacy laws, you may need a Data Processing Agreement (DPA) with Vine & Branch. Download our standard DPA template for your records.