Privacy Policy

1. Introduction

This Privacy Policy describes how SOMA Insights ("Company," "we," "us," or "our") collects, uses, and protects your personal information when you use the Dispatch platform (the "Service").

By creating an account or using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

Account Information:

• Name
• Email address
• Profile picture (from Google sign-in)
• Organization name and details

Connect Card Data:

• Scanned connect card images (PDFs) you upload for processing
• Personal information contained on connect cards (names, addresses, phone numbers, prayer requests, etc.)
• Card template configurations and field mappings
• Routing rules and team assignments

Payment Information:

• We use Stripe to process payments. Your payment card details are collected and processed directly by Stripe and are not stored on our servers. See Stripe's Privacy Policy for details.

2.2 Information We Collect Automatically

Usage Data:

• Cards processed (counts, timestamps)
• Features accessed and frequency of use
• Batch processing history

Technical Data:

• IP address
• Browser type and version
• Device information
• Access times and dates
• Pages viewed within the Service

Cookies and Similar Technologies:

• Session cookies (required for authentication)
• Preference cookies (to remember your settings)
• We do not use third-party advertising cookies

3. How We Use Your Information

3.1 To Provide the Service

• Create and manage your account
• Process uploaded connect cards through our AI extraction pipeline
• Store and display extracted card data for review
• Route card data to appropriate team members via email notifications
• Process payments and manage subscriptions

3.2 To Improve the Service

• Analyze usage patterns to improve features
• Identify and fix technical issues
• Develop new features based on user needs

3.3 To Communicate with You

• Send transactional emails (account confirmation, batch processing notifications)
• Notify you of important changes to the Service or Terms
• Respond to your support requests
• Send product updates and tips (you may opt out)

3.4 Legal and Security Purposes

• Comply with legal obligations
• Enforce our Terms of Service
• Protect against fraudulent or unauthorized use
• Protect the rights and safety of our users

4. Data Sharing and Disclosure

4.1 We Do NOT

• Sell your personal information to third parties
• Share connect card data with anyone outside your organization
• Use your data for third-party advertising
• Share your information with marketing partners

4.2 We May Share With

Service Providers:

• Cloud hosting (Google Cloud Platform)
• Payment processing (Stripe)
• AI processing
• Email delivery (Resend)

These providers are bound by contractual obligations to protect your data and use it only for the purposes we specify.

AI Service Providers:

• We use AI to extract data from connect card images
• Card images are sent to our AI provider for processing and are subject to their API data policies
• Our AI provider does not use API data to train their models

Legal Requirements:

We may disclose your information if required by law, court order, or government request, or to protect the rights, property, or safety of our users or others.

Business Transfers:

If SOMA Insights is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Retention

5.1 Active Accounts

While your account is active, we retain:

• Your account information
• Uploaded card images and extracted data
• Processing history and audit logs
• Your preferences and settings

5.2 Card Image Storage

Uploaded card images are stored securely in Google Cloud Storage. Images are automatically deleted after 365 days per our data lifecycle policy.

5.3 After Account Deletion

When you delete your account:

• Your login credentials and account settings will be removed within 30 days
• Uploaded card images and extracted data will be deleted within 30 days
• Audit logs may be retained for up to 90 days for security purposes

5.4 Backup Retention

Our backup systems may retain copies of your data for up to 90 days after deletion from active systems.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Secure authentication via Google OAuth
• Row-level security (RLS) for multi-tenant data isolation
• Signed URLs for temporary file access (no public bucket access)
• Access controls limiting who can view organization data

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Your Rights and Choices

7.1 Access and Portability

You may request a copy of your personal data by emailing support@dispatch.church. We will respond to your request within 30 days.

7.2 Correction

You may update your account information through your account settings or by contacting us.

7.3 Deletion

You may delete your account at any time through your account settings. Note that some data may be retained as described in Section 5.

7.4 Communication Preferences

You may opt out of promotional emails by clicking "unsubscribe" in any email or updating your preferences in account settings. You cannot opt out of transactional emails necessary for the Service.

8. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.

Right to Delete: You may request deletion of your personal information, subject to certain exceptions.

Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Opt-Out of Sale: We do not sell personal information as defined by the CCPA.

To exercise these rights, contact us at support@dispatch.church. We will respond within 45 days.

9. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

10. Children's Privacy

We do not knowingly collect personal information from anyone under 13 years of age, in compliance with the Children's Online Privacy Protection Act (COPPA). Our Service is intended for users 18 and older as stated in our Terms of Service.

If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe we have collected information from a child under 13, please contact us at support@dispatch.church.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on the Service
• Sending an email to your registered address
• Displaying a notice when you log in

Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, contact us at:

SOMA Insights
Email: support@dispatch.church
Website: dispatch.church

By using Dispatch, you acknowledge that you have read and understood this Privacy Policy.