What we collect, how we hold it, and who can see it.

1. Who we are

DiscipleIQ is a multi-tenant software-as-a-service platform headquartered in Seattle, Washington. We act as a data processor on behalf of the churches, ministries, and Christian schools that subscribe to our service. Each subscribing organization is a tenant. Each tenant owns its own member data, and DiscipleIQ administers that data on the tenant's behalf under the terms of our Master Services Agreement.

When this policy says we, us, or DiscipleIQ, it means the DiscipleIQ legal entity. When it says your church or tenant, it means the organization that invited you onto the platform. When it says you, it means the individual using DiscipleIQ, whether as a member, group leader, mentor, or administrator.

2. What we collect

We collect only what we need to deliver the discipleship features your church has turned on. The categories below are the complete list.

• Account identifiers. Email address, password hash, first and last name, and the OAuth identifier from Google if you sign in that way.
• Member profile data. Anything your tenant administrators choose to capture: contact information, household relationships, life stage, campus, ministry involvement, custom fields they configure, and notes leaders attach to a profile.
• Assessment responses. Your answers to the personality, spiritual gifts, DISC, Enneagram, and tenant-authored intake assessments you choose to take, along with the computed result.
• Communications. Messages exchanged inside the platform between members, mentors, and group leaders, plus the transactional emails we send through Resend on your behalf.
• Integration data. If your church connects Planning Center, we receive the people, custom fields, and group membership records that the integration is scoped to read. Tokens themselves are encrypted and never returned to the application layer.
• Operational telemetry. Server-side request logs, error reports, and anonymized performance metrics. We strip personally identifying fields before anything reaches a log line.
• Session cookies. A single first-party cookie set by Supabase Auth to keep you signed in. We do not set marketing cookies, advertising cookies, or analytics cookies that track you across other sites.

3. How we store it

All member data lives in a Supabase Postgres database hosted in the US-East-1 region. We do not replicate member data to other regions. We do not export member data to spreadsheets, data warehouses, or business-intelligence tools for internal use.

• Encryption at rest. AES-256 for the database, the storage layer, and the automated backups.
• Encryption in transit. TLS 1.3 between your browser, our Vercel edge, our Supabase database, and every third-party service we call on your behalf.
• Backups. Automated daily snapshots with point-in-time recovery for the previous seven days. Snapshots inherit the same encryption guarantees as the primary database.
• Tenant isolation.Every tenant-scoped table is governed by Postgres Row-Level Security policies that filter on the requesting user's tenant membership. Isolation is enforced inside the database itself, not in application code. One whole class of cross-tenant data leak is structurally impossible as a result.
• Token vaulting. Planning Center OAuth tokens and any future third-party integration tokens are stored inside Supabase Vault, encrypted with a per-tenant key. They are never returned to the application layer or written to any log.

4. Who can see what

Access to your data is governed at the database layer by the role you hold inside your tenant.

• Members can see their own profile, their own assessment results, and the public-facing information about groups and mentors they have been matched with or invited into.
• Group leaders can see the profiles and assessment summaries of the members in groups they lead, scoped to what their tenant administrator has chosen to share.
• Tenant administrators can see all member profiles and assessment results within their own tenant. They cannot see any data belonging to another tenant.
• DiscipleIQ staff have no standing access to tenant data. When a tenant opens a support case that requires a member of our staff to view tenant data, the tenant administrator must grant temporary, scoped access. Every read of tenant data by our staff is recorded in the audit log and visible to the tenant administrator.
• Third parties never receive member data unless your church has explicitly connected an integration that requires it. We do not sell member data. We do not license member data. We do not share member data with advertisers.

5. Third-party processors

We rely on a small set of vendors to run the platform. Each is bound by a written data-processing agreement and meets our security review. The complete list:

• Supabase — managed Postgres hosting, authentication, and storage. SOC 2 Type II.
• Vercel — content delivery, edge functions, and serverless runtime. SOC 2 Type II.
• Resend — transactional email delivery for invitations, password resets, outreach, and match notifications.
• Anthropic, OpenAI, and Google — large language model and embedding providers used to generate match explanations and to encode profile text into semantic vectors. We use the enterprise endpoints offered by each provider, which contractually exclude customer data from model training and from human review for quality assurance.
• Planning Center — connected only when your tenant administrator opts in. The OAuth scope is limited to the People, Groups, and custom-field resources the integration needs.
• Stripe — subscription billing. Card numbers are tokenized by Stripe and never touch our servers.
• Sentry — application error reporting. We strip personally identifying fields before any exception is sent.

6. AI and large language models

DiscipleIQ uses AI in two narrow, defensible ways. We want you to understand both.

• Embeddings. Member profile text and opportunity descriptions are encoded as numeric vectors so that semantic similarity becomes a database query rather than a hand-tagged guess. The vectors live in our own Postgres database. They cannot be reversed into original text.
• Match explanations. When the matching engine surfaces a recommendation, a language model writes a short, plain-language explanation of why that match was made. The model sees only the minimum data required to write that explanation. We redact direct identifiers where they are not load-bearing for the explanation.

We do not use customer data to train, fine-tune, or evaluate any AI model. Our providers' enterprise endpoints are configured to disable retention where they offer that control, and we audit those settings on a quarterly cadence.

7. Children

DiscipleIQ is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Many churches do, of course, keep records about children in their family ministries. If your church captures data about children, the tenant administrator is responsible for configuring the consent fields required by their internal child-safety policy and by applicable law before those records are entered. If you believe a child under 13 has created an account on DiscipleIQ without parental consent, write to privacy@discipleiq.com and we will delete the account.

8. Your rights as a data subject

Regardless of where you live, DiscipleIQ honors the rights below for every member on the platform.

• Access. You can request a copy of every field we hold about you by callingGET /api/me/export from your authenticated session. The response is a single JSON document containing your profile, your assessment results, your communications, and the metadata associated with each.
• Correction. You can edit any field on your own profile from your member dashboard. Fields managed by your tenant administrator are corrected by contacting that administrator.
• Deletion. You can request hard deletion by callingDELETE /api/me or by writing to privacy@discipleiq.com. We process deletion requests within thirty days, after a brief grace window to guard against accidental requests. Deletion cascades through every tenant-scoped table. The single exception is the audit log, which preserves a pseudonymous record of administrative actions so that security investigations remain possible. You may request that your audit-log entries be redacted as well; we honor that request unless an active investigation requires the entries to remain intact.
• Portability. The JSON export described above is your portable copy of your own data.
• Objection. You may object to specific uses of your data, including receiving outreach as a mentor candidate, by writing toprivacy@discipleiq.com.

9. Cookies

We set a single first-party session cookie, managed by Supabase Auth, so that you do not have to sign in on every page. That is the only cookie DiscipleIQ sets. We do not run advertising pixels, marketing tags, or cross-site analytics scripts on the platform. If you sign in with Google, Google sets its own cookies on its own domains; those cookies are governed by Google's privacy policy.

10. Retention

We retain member data for as long as your tenant maintains an active subscription. When a tenant terminates its subscription, we retain the data for ninety days so that the tenant administrator can request a full export, then we hard-delete it. Anonymized aggregate counts may persist for billing reconciliation. The audit log persists in pseudonymous form so that historical security investigations remain possible.

11. International transfers

DiscipleIQ operates entirely in the United States. If you access the platform from outside the United States, your data will be transferred to and stored in the US-East-1 region. We do not use Standard Contractual Clauses today because we do not knowingly serve European data subjects; if your church begins onboarding European members, write to privacy@discipleiq.com and we will execute an SCC addendum with your tenant.

12. Changes to this policy

We will give every tenant administrator at least thirty days of notice by email before any material change to this policy takes effect. Non-material clarifications may be published at any time, in which case the effective date at the top of this page is updated.

13. Contact

Privacy questions, deletion requests, and complaints all go toprivacy@discipleiq.com. We respond within two business days. For everything else, see oursecurity practices andterms of service.