Privacy policy

Shep (“Shep”, “we”, “us”) provides software that helps churches care for their people. This policy explains how we handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), the New Zealand Privacy Act 2020 and its Information Privacy Principles, and, where they apply, the UK and EU General Data Protection Regulation.

It covers three groups of people:

• People in a church that uses Shep: members, leaders, pastors and admins, and people whose details a church records (for example, someone who fills in a connect card).
• Church account holders: the people who sign a church up and manage its account with us.
• Visitors to our website and people who contact us.

When your church uses Shep, your church decides what is recorded about its people, who in the church can see it, and how long it is kept. Shep holds and processes that information on your church’s behalf and only to run the service for them. In GDPR terms, your church is the controller and Shep is its processor. Our data processing terms set out the promises we make to churches about this.

So if you have a question about what your church records about you, or you would like something changed or removed, it is usually quickest to ask your church first. You are also always welcome to ask us, and we will help or pass your request to your church.

For church account holders, website visitors and people who contact us, Shep decides how information is handled and is directly responsible for it.

Information you or your church give us

• Account details: name, email address, mobile number (if given), profile photo and sign-in details.
• Church membership: which churches and groups you belong to, and your role in each.
• Discipleship and care information: your own reflections on your next steps, a leader’s observations about how you are going, notes written by leaders, records of conversations and other interactions, prayer requests, reminders, and posts you share with your church.
• Connect cards (visitor forms): mobile number, name, email address and answers to the questions your church chooses to ask.
• Notification choices: which emails and push notifications you want.
• Messages to us: what you send through our contact form or by email.
• Church account details: church name, timezone, branding and the account holder’s contact details.

Information from systems your church connects

If your church connects Shep to its church management system (such as Elvanto, Planning Center or Breeze), we receive the people, groups and contact details your church chooses to sync.

Information collected automatically

• Sign-in activity: when you sign in, your browser’s user agent and your IP address.
• Usage: pages viewed and features used, through Google Tag Manager, Google Analytics and PostHog. PostHog knows you by an ID, not your name or email, and may record a replay of a session with all text and inputs masked and all images blocked.
• Errors: when something breaks, error details and device information through Sentry. A small sample of sessions, and sessions where an error occurs, may be recorded as a replay with all text masked and all images blocked, so we see the shape of what happened rather than what was on screen.
• Connect card activity: when a QR code is scanned and whether a card is opened, started, submitted or left.
• Push subscriptions: if you turn on notifications, the push address your browser gives us.

See our cookie policy for the cookies and browser storage involved.

Information about a person’s faith, church involvement and pastoral care is sensitive information under Australian and New Zealand privacy law and “special category data” under the GDPR, because it reveals religious beliefs and may touch on health or family circumstances. We treat everything recorded in Shep that way.

• Churches must only record sensitive information about a person with that person’s consent (or a parent or guardian’s consent for a child), or where the law otherwise allows it. Our acceptable use policy asks churches to record only what genuinely helps them care for someone.
• We never use sensitive information for advertising, profiling for marketing, or sale.
• We do not use church data to train artificial intelligence models.

We use personal information to:

• run Shep for your church, including showing the right information to the right people;
• send the emails and notifications you have chosen, and essential service messages;
• work out care signals for leaders, such as who has not had a conversation in a while;
• sync with the systems your church has connected;
• keep Shep secure, investigate problems and fix errors;
• understand how Shep is used so we can improve it, using analytics that do not identify you by name;
• reply to you, and manage our relationship with the churches we serve; and
• meet our legal obligations.

Under the GDPR, we rely on performing our contract with your church, our legitimate interest in running a secure and reliable service, your consent (for example, push notifications and analytics where consent is required), and legal obligations.

Shep uses computer programs to work out signals such as how recently someone was in touch with their leader, or how a relationship is going based on logged conversations. These signals help a church team notice who might need a call. They are prompts for people, not verdicts.

Shep does not make decisions about you by itself. No signal changes your membership, access, role or anything else that significantly affects you without a person at your church choosing to act. A person shown a signal can always ask their church how it was worked out.

Access inside a church follows each person’s role. In particular:

• You can see your own reflections and your own profile.
• A note written about you is private to the leader who wrote it, unless they share it with your care team (your shepherds, group leaders, pastors and admins). Your care team can reply to shared notes. Church admins can also read private notes, and each time they do it is recorded. Notes and replies about you are never shown to you through Shep.
• A leader’s observations about how you are going are visible to leaders, pastors and admins, but not to you through Shep.
• Posts are visible to the audience chosen when they are shared.

These rules are enforced in the application and the database. You can still ask for a copy of information held about you (see section 11). Our privacy and trust page shows this as a table.

Outside your church, we only share personal information:

• with the service providers listed on our sub-processors page, who may only use it to provide their service to us;
• with systems your church connects, as your church instructs;
• if the law requires it, or to protect someone’s life, health or safety; and
• to a buyer of our business, who must keep handling it under this policy, after we tell churches first.

We do not sell personal information and we do not share it for advertising.

Shep’s database, including all discipleship and care information, is hosted in Australia.

Shep’s application also runs in Australia. Some service providers handle limited information outside Australia to do their job: emails are sent through providers in the EU and US; error reports and analytics are processed in the US and EU; and push notifications are delivered by your device’s browser vendor. The sub-processors page lists each one, what it receives and where.

Before disclosing personal information overseas, we take reasonable steps (as APP 8 and NZ IPP 12 require) to make sure the recipient protects it to a comparable standard, including through contracts. For UK and EU information we rely on adequacy decisions or standard contractual clauses.

• Encryption in transit (HTTPS) and at rest.
• Role-based access, backed by row-level security in the database.
• Credentials for connected systems are encrypted before they are stored.
• Changes to church settings, invitations and admin access are recorded in an audit log.
• Only a small number of Shep staff can access production systems, and only when needed to support a church or fix a problem.

No system is perfectly secure. If a data breach is likely to cause someone serious harm, we will tell affected churches without undue delay, and we or the church will notify affected people and the Office of the Australian Information Commissioner (under the Notifiable Data Breaches scheme), the New Zealand Privacy Commissioner, or another regulator as the law requires. See our security page to report a vulnerability.

• We keep church information for as long as the church uses Shep, or until the church deletes it.
• When a church closes its account, it can export its information first. We then delete it within 90 days.
• When we receive a valid request to delete a person’s account, we delete it within 30 days, unless the law requires us to keep something.
• Deleted information can remain in encrypted backups until those backups are overwritten on their normal cycle.
• Records of sent emails and notifications are kept for up to two years so we can avoid duplicates and investigate delivery problems.

You can ask to:

• get a copy of the personal information held about you;
• correct information that is wrong, out of date or misleading;
• have your information deleted;
• stop or limit certain uses, such as analytics or notifications; and
• receive your information in a common, machine-readable format.

You can update your profile and notification choices yourself in Shep. For anything else, ask your church or email privacy@shephub.com. We will confirm who you are, and respond within 30 days. There is no charge.

We may decline part of a request where the law allows, for example if giving access would unreasonably affect someone else’s privacy or safety. If we do, we will tell you why and how to complain.

Shep accounts are for people aged 16 and over. Younger people may only have an account, or have information recorded about them, with the consent of a parent or guardian and in line with the church’s child safety policies.

If you are a parent or guardian and think information about your child is in Shep without your consent, contact the church or us and we will help remove it.

We send church account holders occasional news about Shep. Every such email has an unsubscribe link, as the Spam Act 2003 and the Unsolicited Electronic Messages Act 2007 (NZ) require. Service emails, such as security notices, are sent whatever your marketing choice. Emails your church sends through Shep, like daily reminders, are controlled from your notification settings.

If you are worried about how your information has been handled, email privacy@shephub.com. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

• in Australia, the Office of the Australian Information Commissioner (1300 363 992);
• in New Zealand, the Office of the Privacy Commissioner (0800 803 909); or
• in the UK or EU, your local data protection authority.

We will update this policy when our practices change. If a change materially affects how we handle information, we will tell church admins by email at least 30 days before it takes effect. The version history below records every change.