EquipFlow

Privacy Policy

Last updated: May 5, 2026

This Privacy Policy describes how EquipFlow ("we," "us," or "our") collects, uses, and shares information about you when you use our learning management service (the "Service"). We are committed to protecting your privacy and being transparent about our data practices.

1. Information We Collect

Information you provide directly

  • Account information: Name, email address, and password when you register
  • Organization information: Organization name, subdomain, and branding assets when you set up a Tenant
  • Course content: Text, images, video references, and quiz content you create within the Service
  • Communications: Any messages or support requests you send to us

Information collected automatically

  • Usage data: Course completion events, lesson progress, and quiz responses
  • Log data: IP addresses, browser type, pages accessed, and timestamps when you use the Service
  • Product analytics: We use PostHog to understand how the Service is used — pages visited, features clicked, and events such as course publishes or lesson completions. Analytics events are associated with your user ID and your organization (Tenant) so we can measure activation, troubleshoot issues, and improve the product. Session replays are disabled.
  • Cookies and similar technologies: Session cookies to keep you signed in, and a first-party PostHog cookie used to maintain a stable analytics identifier across visits. We do not use third-party advertising cookies and do not sell or share analytics data for advertising.

Information from Planning Center

If your organization connects Planning Center, we receive and store the following data from the Planning Center API on your organization's behalf:

  • People records: names, email addresses, and Planning Center person IDs
  • Group memberships and group names
  • Workflow step assignments (to trigger course enrollments)
  • Custom field definitions and values (to support completion writebacks)

This data is used solely to provide the Planning Center integration features you have enabled. We write data back to Planning Center only when you configure a course to do so (e.g., updating a custom field on completion or advancing a workflow card).

2. How We Use Your Information

We use the information we collect to:

  • Create and manage your account and organization
  • Deliver the Service, including course assignments, progress tracking, and notifications
  • Send transactional emails such as invitation links and magic login links (via Resend)
  • Synchronize data with Planning Center when you have enabled that integration
  • Detect and prevent fraud, abuse, and security incidents
  • Improve and develop the Service
  • Comply with legal obligations

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

Service providers

We use third-party providers to operate the Service:

  • Cloudflare — hosting, content delivery, database storage (Cloudflare Workers, D1, R2), and security (Turnstile CAPTCHA). Data may be processed in Cloudflare's global network.
  • Resend — transactional email delivery. Your email address and name are shared with Resend to send you service emails.
  • PostHog — product analytics. We share a pseudonymous user identifier, your email, your role, and your organization's identifier so events can be grouped per-Tenant. Event data is processed in PostHog's US region. PostHog acts as a sub-processor under our Data Processing Agreement.
  • Planning Center — if you enable the integration, we exchange data with Planning Center's API as described in Section 1.

Legal requirements

We may disclose information if required to do so by law, regulation, or legal process, or to protect the rights, property, or safety of EquipFlow, our users, or the public.

Business transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

4. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account and organization data: Retained while your account is active. Deleted within 30 days of account termination.
  • Course content and enrollments: Retained while your account is active. Deleted within 30 days of account termination.
  • Planning Center sync data: Retained while your account is active. We do not retain a separate copy of PC data beyond what is needed to operate the integration.
  • Log and usage data: Retained for up to 90 days for security and debugging purposes.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Deletion (right to erasure): Request deletion of your personal data. You can initiate account deletion from your account settings or by contacting us.
  • Portability: Request your data in a machine-readable format
  • Restriction: Request that we limit processing of your data in certain circumstances
  • Objection: Object to processing of your data where we rely on legitimate interests

To exercise any of these rights, please contact us at hello@equipflow.church. We will respond within 30 days. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

6. GDPR and International Transfers

If you are located in the European Economic Area (EEA) or United Kingdom, your data may be transferred to and processed in the United States and other countries where our service providers operate. We rely on Cloudflare's Standard Contractual Clauses and other appropriate safeguards for such transfers.

For organizations using EquipFlow to process personal data of EEA or UK individuals, EquipFlow acts as a data processor and your organization acts as the data controller. Contact us at hello@equipflow.church to request a Data Processing Agreement.

7. California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, the right to request deletion, and the right not to be discriminated against for exercising these rights. We do not sell personal information. To exercise your rights, contact us at hello@equipflow.church.

8. Security

We implement industry-standard security measures to protect your information, including encryption in transit (HTTPS), hashed password storage, and tenant-level data isolation to prevent cross-organization data access. No security system is perfect, however, and we cannot guarantee absolute security.

If you discover a security vulnerability, please report it to hello@equipflow.church.

9. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us so we can delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or by sending an email to the address associated with your account. The "last updated" date at the top of this page indicates when the policy was last revised.

11. Contact

If you have questions or concerns about this Privacy Policy, please contact us at:

EquipFlow
hello@equipflow.church