ServantBase Privacy Policy (DRAFT for legal review)
Effective date: October 16, 2026 Last updated: October 19, 2026
Plain-language summary
- We run a family of apps for churches, ministries and libraries. For the records a church or library keeps about its own people, we are the service provider and the organization is in charge. For your own account, we are in charge.
- We do not sell personal information and do not use it for advertising.
- Counseling content in HopeTrack is visible only to the roles a church assigns. It is not sent to the ServantBase AI gateway and does not appear in dashboard flags or reminders.
- Some features send the text you give them to an AI provider through OpenRouter. We use OpenRouter with zero data retention enabled on our account. What each model provider does with a request is governed by that provider's own terms.
- Backups roll off within about 6 months, so deleted data can remain in an encrypted backup for that long.
- You can download a copy of your data and ask for your account to be erased from your ServantBase start page. An erasure waits 14 days so you can change your mind. Church owners can do the same for a whole church (30 days). Counseling records are anonymised rather than deleted (section 11).
This is a working draft being prepared for review by a lawyer. It is not legal advice. Items marked [OWNER TO CONFIRM] are not final.
1. Who we are
The ServantBase services are operated by:
- Operator: Sims Anderson, an individual operating ServantBase as sole operator
- Mailing address: PO Box 1245, Forney, TX 75126
- Contact for privacy questions and requests: info@servantbase.com
In this policy "we", "us" and "ServantBase" mean that operator.
2. What this covers
This policy covers the ServantBase apps and sites (the "Services"): InEveryHouse, HopeTrack, HopeChat (Bible Counselors AI), Exegeter, ShelfMate, Ministry Hub (HymnBoard, ChurchApp, MinistryAutomate), the social posting tool (Postiz) used by Ministry Hub, the shared sign-in at accounts.servantbase.com, the start and admin sites at start.servantbase.com and www.servantbase.com, and the ServantBase AI gateway and connections vault behind them.
3. Our role: who is responsible for your information
- Account data (we are the controller). Your sign-in account and profile, security logs, feedback you send us, error reports, and billing contact details are held by us for our own purposes of running and securing the Services.
- Organization data (we are the processor or service provider). Information that a church, ministry or library enters about its own people (members, patrons, counselees, visitors, prospects, staff) and its own content belongs to that organization. The organization decides what to enter, who sees it, and how long to keep it. We handle it only to run the Services for the organization and on its instructions. See section 15.
- Individual users. If you use an individual app such as Exegeter on your own, your sermons, notes and library are your content. We host it only to run the service for you.
- If you have a question about records an organization holds about you, ask that organization first. We will help it respond.
4. What we collect, by category
| Category | Examples | Where |
|---|---|---|
| Account and profile | first and last name, email, phone, address, language, time zone, job title, profile picture, password (stored hashed, never readable by us), two-step sign-in settings, which organizations and roles you hold | shared sign-in, all apps |
| Organization | church or library name, address, phone, email, time zone, billing contact, plan and trial status, approval status | all apps |
| Activity and security | sign-in times, device and browser details, IP address, audit entries for administrative actions, the record of your acceptance of the Terms and Privacy Policy (date, version, IP address, browser details), device sign-in approval requests (deleted after one day) | all apps |
| Support and quality | feedback you submit (title, details, optional name and email, the page you were on); automatic error reports from the apps (error message, technical trace, page address, and the email of the signed-in user when the app includes it; the content of forms and requests is not included, though an error message can incidentally quote part of what the app was processing) | all apps |
| Notifications | push notification tokens and email delivery details | InEveryHouse, HopeTrack, Exegeter, others |
| Payments | subscription status, plan, payment references; we do not store card numbers. Billing is not live yet. | billing (planned) |
| AI use | the text you send to an AI feature and the answer (see section 6), plus a usage record kept by us (which organization, which feature, token counts, cost) | apps with AI |
| Connections and keys | API keys and sign-in tokens that an organization stores in its ServantBase vault, encrypted at rest; connected social channel tokens in Postiz | suite-core, Postiz |
What each app holds
| App | Organization and personal data it may hold |
|---|---|
| InEveryHouse | church and member records; people without logins (visitors, prospects: name, phone, email, address, status); outreach and visit notes; locations of addresses visited; push tokens |
| HopeTrack | counselor, staff and counselee accounts (counselee logins are created by church staff); counseling sessions, notes and homework; flags and reminders; messages; push tokens. This is the most sensitive data we host. See section 7. |
| HopeChat (Bible Counselors AI) | organization and member accounts; conversations with the AI assistant and the answers; uploaded or ingested reference material |
| Exegeter | the pastor's account and church workspace; sermons, notes, transcripts and library; the pastor's own provider keys where the pastor adds them |
| ShelfMate | library or church library organization; patrons (name, membership number, optional email, phone, address); books and loans |
| Ministry Hub (HymnBoard, ChurchApp, MinistryAutomate) | staff and volunteer accounts; hymn and service plans; church events, prayer requests and church app accounts; giving PIN entry; finance and giving data the church imports (for example by CSV or a Breeze sync); sermon video and media files, titles, descriptions and clips; connected channel details |
| Postiz (social posting) | the church's connected Facebook, Instagram and YouTube channel authorizations; scheduled posts and the images and videos attached to them |
| suite-core (accounts and admin) | people, organization memberships and roles, queued invitations (name and email of people a church has asked us to invite), the AI usage ledger, vault of connections, feedback, error reports, audit log |
People who never sign in (members, patrons, visitors, prospects) are stored only as records inside the app of the organization that entered them. They do not get a ServantBase account unless they choose to create one.
5. How we use it
To provide and secure the Services, sign you in, send notices you need or ask for (such as verification codes, password resets, invitations and plan changes), provide support, fix errors, prevent abuse and fraud, keep records of administrative actions, and meet legal obligations. All ServantBase email is sent from info@servantbase.com. We do not sell personal information, we do not share it for advertising, and we do not use cookies for advertising.
6. AI features
- What is sent. Some features send the text you provide (and, for some features, content such as a transcript or an image) to an AI provider to produce a result, for example book research, sermon tools, envelope reading or answers in HopeChat. Most requests go through the ServantBase AI gateway to OpenRouter, which forwards them to the model provider chosen for that request.
- What we keep. The gateway keeps only a usage record (which organization, which feature, token counts, cost). It does not store the text of your request or the answer. Apps that offer AI conversations (such as HopeChat) store those conversations in that app's own database for the organization.
- Whose key. AI requests use a spending-limited key that ServantBase creates for each organization, or, in some features, a key that a church or pastor supplies and controls, or an app-level ServantBase key. Not every feature goes through the gateway yet.
- Retention and training. We use OpenRouter with zero data retention enabled on our account. We do not use your content to train AI models. OpenRouter forwards each request to the model provider chosen for it, and how that provider handles a request is governed by its own terms and policies. The gateway does not store the text of your requests or the answers.
- Our own use. We do not use your content to train AI models and we do not sell it to AI companies.
- Controls. Organization and ServantBase administrators can turn AI off or limit it.
- Counseling data. HopeTrack does not send counseling session content to the ServantBase AI gateway. As of 16 October 2026, HopeTrack has no AI feature and no connection to any AI provider, so no counselee, session or note text is sent to one, including with a church-supplied key. HopeTrack does send some content through ordinary (non-AI) delivery services: chat push notifications show the first part of a message. These pass through our mail account and Google Firebase Cloud Messaging (section 9).
- AI answers can be wrong. They are not pastoral, legal, medical or financial advice.
7. Counseling and other sensitive information
- Churches use HopeTrack and related features to hold pastoral and counseling information that can reveal religious beliefs, mental or emotional health, family and addiction issues, and similar matters.
- That information is visible only to the roles the church assigns. Reminders, flags and the ministry dashboard do not include session content. Counselee records are not copied into the shared ServantBase account system; only staff accounts are.
- Our staff do not browse counseling content. Support access to a church's records happens only to fix a problem, on request, and is logged. As of 16 October 2026, when ServantBase staff sign in as a HopeTrack user to fix a problem, the session shows a banner and is logged; requiring a recorded reason and notifying the church are not built yet. [OWNER TO CONFIRM: the final support-access commitments for HopeTrack (reason, notice to the church, church consent) once roadmap item N144 is finished.]
- Each church is responsible for its own confidentiality commitments, pastoral duties, mandatory reporting duties and any legal privilege that may apply. ServantBase is a technology provider. It is not a member of the clergy, a counselor, or a party to any counseling relationship, and it does not receive confessions or counsel. We cannot promise that law treats hosted records as privileged. We may have to comply with valid legal process; where the law allows we will tell the affected organization first.
- Sensitive data are handled under the same security measures as other data (section 12); we do not make a separate "sensitive" copy.
8. Who we share it with (sub-processors)
These service providers help us run the Services. We use them only for the purpose shown. Organization data stays on our own servers unless a feature in the list sends it out.
| Provider | Purpose | What it may receive | Location |
|---|---|---|---|
| Hostinger (VPS hosting and mail) | Runs all apps, databases, media storage (our own Garage S3 store), the sign-in system (self-hosted Logto), Postiz, the HopeChat database and workflow automation (n8n); also the mail account (info@servantbase.com) that sends all ServantBase email | everything we host; email addresses and message content of emails we send | United States (the server's network address is registered to Hostinger in Phoenix, Arizona) |
| Cloudflare | Network proxy for the optional alternate sign-in addresses exegeter.stand4him.com and ministrydash.stand4him.com only | web traffic to those two addresses | United States and other Cloudflare locations |
| pCloud | Encrypted off-site backups. Backups are encrypted on our server before they leave it, so pCloud cannot read them. pCloud is not used by the apps themselves | encrypted backup files only | provider's storage locations |
| OpenRouter and the AI model providers it routes to | AI features | text, transcripts or images sent by an AI feature | United States and wherever the chosen provider operates |
| Google (Firebase Cloud Messaging) | Push notifications | push token and notification text | United States and other Google locations |
| Google (Maps and geocoding) | Maps and address lookup in HopeTrack and InEveryHouse | addresses and coordinates | United States and other Google locations |
| Google (YouTube and Google APIs) | Reading public video data; with a church's authorization, publishing and reading its YouTube channel | see section 10 | United States and other Google locations |
| Google Drive | Ministry Hub file handling that is being retired in favor of our own media store | sermon files and finance files used by the Hub | United States and other Google locations |
| Meta (Facebook and Instagram) | Publishing posts to a church's Pages and Instagram accounts when the church connects them | posts, images, videos and Page tokens | United States and other Meta locations |
| Church-chosen services: Breeze ChMS, Klap, youtube-transcript.io | Optional connections a church or pastor turns on with its own account or key | the data that connection needs (for example giving or people records for Breeze, video files for Klap, a video link for transcripts) | provider's locations |
| Font, video and code delivery services (Bunny Fonts, YouTube, jsDelivr, unpkg) | Load fonts, embedded videos and page code in some apps | your IP address and browser details when a page loads; no account data | United States and other provider locations |
| TinyMCE (Tiny Technologies) | Text editor in HopeTrack | the editor may be loaded from the vendor; content is not sent unless you use a cloud editor feature | United States |
| PayPal | Payments, when billing starts | billing name, email and payment references | United States. Not live yet. |
| healthchecks.io and a notification service (ntfy) | Operational alerts when servers or backups fail | no personal data, only "up" or "failed" messages | provider's locations |
We may also disclose information if the law requires it, to enforce our terms, or to protect people's safety. We will tell the affected organization first where the law allows.
Within an organization, administrators can see the accounts and records of that organization according to the roles it sets.
9. International use
Our servers are in the United States (section 8), and the Services are built mainly for churches and libraries in the United States. Organizations outside the United States may also use the Services. If you use the Services from another country, your information is transferred to and processed in the United States and the other locations in section 8, where privacy laws may differ from those where you live. We rely on the contractual terms in section 15 and on your use of the Services for those transfers. We have not certified compliance with the GDPR or any other non-U.S. privacy regime; if you need specific transfer terms, contact info@servantbase.com.
10. Social media connections and Google user data
Churches can connect their own YouTube channel, Facebook Page or Instagram account so the Ministry Hub can schedule and publish sermon clips and posts through Postiz. This happens only after a person with the right to do so approves the connection on Google's or Meta's own consent screen. You can disconnect at any time inside Postiz or in your Google or Meta account settings.
What we access from Google. When a church connects YouTube, we ask for these permissions: manage your YouTube account and channel, upload videos, read channel and video information, read YouTube Analytics reports, and your Google account email address and basic profile (to show which account is connected). We use them only to publish, schedule and report on that church's own videos and posts, and to show who is connected.
Limited Use statement. ServantBase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms:
- We use Google user data only to provide and improve the user-facing features the church sees (scheduling, publishing, reporting).
- We do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or sale with notice to you.
- We do not use it for advertising, and we do not sell it.
- Our staff do not read it unless you ask for support, it is necessary for security or abuse investigation, or the law requires it.
- We do not use Google user data to develop, improve or train generalized AI or machine-learning models. As of 16 October 2026, we do not send YouTube account data to AI providers: no sign-in or access token, channel or account details, comments or analytics reports go to an AI provider. The Ministry Hub's AI steps receive only sermon transcripts, scripts, quotes, clip transcripts, titles and dates that the church supplied or published as public videos.
YouTube API Services. Our use of YouTube features is also subject to the YouTube Terms of Service and the Google Privacy Policy. You can revoke ServantBase's access to your Google data at any time at https://myaccount.google.com/permissions.
Facebook and Instagram. Our use of Meta data follows the Meta Platform Terms. We store only the authorization needed to post for the church and the posts and media the church schedules. To remove a connection, disconnect it in Postiz or remove the app in your Facebook or Instagram settings. To ask us to delete the data tied to a connection, email info@servantbase.com and we will do so as described in section 11.
Where it is stored. Connection tokens are held in Postiz and in the organization's ServantBase vault on our servers. The vault encrypts stored keys. As of 16 October 2026, Postiz itself does not encrypt connection tokens in its database; they are stored as received from Google and Meta. That database is not reachable from the internet (only from the server's internal network), and backups are encrypted before they leave the server.
11. Your choices and rights
- Download your data. On your ServantBase start page (start.servantbase.com), "Your data", press "Prepare my export". ServantBase asks each app you use for your own data in it and emails you a link to one file. The link works for 7 days, only while you are signed in as you. Notes, sessions and other records that a counselor or staff member wrote about you are the organization's records, not yours alone, and are not in your export; ask the organization for them.
- Erase your account. On the same page, "Erase my account" (you confirm by typing your email address). The erasure starts after a 14-day waiting period; we email you a link to cancel it at any time before then, and nothing is erased until then. If you are the only owner of a church that has other members, you must first make someone else an owner or close the church. When it runs, ServantBase asks every app to erase your data and only removes its own record of you after every app has confirmed. An app that cannot be reached is retried, so the erasure may take longer than 14 days. We delete your sign-in account (the one at accounts.servantbase.com) by hand when the erasure is complete.
- What an erasure does and does not remove. Your account, your sign-ins and devices, your own messages, answers, notes and content are deleted. Some records belong to the organization or involve other people, so they stay without your name: a loan record at a library, an event you created on a church calendar, sermons and blocks you wrote in a church workspace (they keep your name as plain text, with no link to an account), and giving or finance records the organization must keep. They show "Former member". In HopeTrack and HopeChat the counseling records and the questions and answers (already redacted) are kept and anonymised: the link to you is removed and the account that remains can no longer sign in. We keep a log that an erasure happened (identifiers and counts only, never the content) and the record that you accepted our Terms and Privacy Policy, which no longer carries your name or email. Anything you posted outside our systems (for example to Facebook or YouTube) is not affected.
- Organization data and closing a church. A church owner can download everything the church holds ("Church data" on the church page) and can ask to remove the church. The export is prepared and emailed first, then the removal waits 30 days (the owner can cancel). The church's records in each app are removed, except that counseling records in HopeTrack and HopeChat are exported and removed by hand with the church's pastor, never by an automatic request, and the Ministry Hub's own default church is removed by hand. Billing records are kept as tax rules require, without the church's contact details. If your information is in an organization's records, ask that organization first.
- Email still works. You can still email info@servantbase.com for any of this. We respond within 30 days and may need to confirm who you are first.
- Deletion and backups. Erased data can remain in encrypted backups until they roll off (section 13); backups are not rewritten. We do not restore erased data into the live system except to recover from a disaster, and then we re-apply the erasures.
- Other choices. You can turn off optional notifications and turn on two-step sign-in for your account (available to every account, optional).
- Where you live. Depending on where you live (for example Texas or other states) you may have additional rights, such as to know, correct, delete, obtain a copy, or appeal a refusal. Email us and we will respond as the law requires.
12. Security
Measures that are in place today:
- Traffic between you and the Services is encrypted in transit (HTTPS).
- Passwords are stored hashed. Sign-in runs through the ServantBase sign-in system, with optional two-step sign-in for every account. Two-step sign-in is required for the ServantBase administration panel.
- Access inside each app is role based. Organizations see only their own data.
- API keys that organizations store in the ServantBase vault are encrypted at rest.
- Administrative actions in the ServantBase admin are written to an audit log.
- Server backups are encrypted before leaving our server and are tested periodically with restore drills.
- Errors are collected centrally so we can fix problems quickly.
No system is perfectly secure. We cannot guarantee that every record stays protected. Tell us at info@servantbase.com if you suspect a problem.
If something goes wrong. If we confirm a breach of security that affects personal information we host for an organization, we will notify that organization without undue delay and within 72 hours of confirming it, with what we know and what we are doing. Where the law requires us to notify individuals or regulators for account data we control, we will do so within the legal deadlines.
13. How long we keep it
These are our retention periods. Where noted, automatic deletion is not built yet.
| Data | Kept for |
|---|---|
| Account and profile data | while the account is active; erased after the 14-day waiting period when you ask for erasure (section 11), unless the law requires us to keep it |
| Organization data | while the organization's subscription or trial is active; when the organization asks to close, it is exported and then removed after a 30-day waiting period (section 11). We have not yet built automatic deletion for an organization whose service simply ends, so until then that deletion is done by hand 30 days after the end |
| Export files you ask for | 7 days, then deleted automatically |
| Encrypted backups | 7 daily, 4 weekly and 6 monthly copies; older copies are removed automatically. So deleted data can remain in a backup for up to 6 months. Local working copies of database dumps are kept two weeks |
| Device sign-in approval requests | deleted after one day (automatic) |
| Queued invitations | until accepted or removed; we plan to expire them after 90 days (not built yet) |
| Server and web logs | 90 days (our target; log rotation is not yet verified on every server) |
| Error reports and the admin audit log | currently kept until we delete them; there is no automatic deletion yet. we plan to keep error reports 1 year and the audit log 2 years |
| AI usage records (no message text) | as long as needed for billing and tax records 7 years |
| Feedback you send | until resolved, then up to 2 years |
| Billing records | as the law requires |
14. Cookies and similar technology
We use cookies and local storage that are necessary to keep you signed in, remember your language and let the apps work offline. We do not use advertising cookies. As of 16 October 2026, none of our apps runs analytics, advertising, session-recording or tracking scripts (no Google Analytics, tag managers or ad pixels), and the optional analytics and error-tracking features built into Postiz are switched off. Some pages do load fonts, maps, videos or code libraries from outside servers, and those servers can see your IP address and browser details when the page loads: Bunny Fonts (ChurchApp, InEveryHouse and ShelfMate pages), YouTube embeds and thumbnails (HopeTrack, ChurchApp), Google Maps (HopeTrack registration, InEveryHouse), and code libraries from jsDelivr, unpkg or Tailwind's CDN (ShelfMate, InEveryHouse, some error pages).
15. Terms for organizations (data processing)
If you use the Services on behalf of a church, ministry or library, then for the information you enter about other people we act as your service provider. We will: process it only to provide the Services and on your documented instructions; keep it confidential and limit access to people who need it; use the sub-processors in section 8 and tell you about material changes; help you answer requests from the people you serve, within reason; tell you about a confirmed breach as in section 12; and, when service ends, return (export) and then delete the data as in section 13. You are responsible for the lawful basis, notices and consents for the information you enter, including photos and information about minors. A signed data processing agreement is available on request.
16. Children
The Services are not directed to children under 13 and we do not knowingly create accounts for them or collect their information directly. Churches may record information about children and youth (for example in a counseling, church or library record) and may create counselee or member accounts. The church is responsible for having any parent or guardian permission the law requires and must not create an account for a child under 13 unless it has that permission. If you believe a child under 13 has an account without permission, tell us at info@servantbase.com and we will delete it.
17. Changes
We will post the new version here with a new "last updated" date. For material changes we will notify account holders by email or in the app before they take effect where possible.
18. Contact
Sims Anderson, PO Box 1245, Forney, TX 75126, info@servantbase.com.
Version 2e10d5b0, 19 Oct 2026