Privacy Policy
This draft Privacy Policy describes how Stewardvine handles information in connection with its software. Stewardvine sells software only. Donations are processed by Square and settle directly into the parish's own Square account; Stewardvine never takes custody of donor funds. Payment card data is captured by Apple and Square, not by Stewardvine.
Stewardvine does not sell or share donor data. We do not sell donor personal information and do not “share” it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We honor the Global Privacy Control (GPC) as an opt-out signal.
1. What Stewardvine collects
- Parish-admin accounts. Names, work email addresses, roles, and login activity for the parish staff and volunteers who use the Stewardvine admin app.
- Donor email, only if voluntarily entered. If a donor chooses to provide an email address (for example, to receive a receipt from the parish), Stewardvine records it on the parish's behalf. Donors are not required to provide it to give.
- Donation metadata & receipts. Non-card details such as amount, date/time, fund or campaign, and the transaction identifiers returned by Square, used for the parish's records, reconciliation exports, and receipts.
- Encrypted connection tokens. Encrypted OAuth tokens that authorize the Software to connect to the parish's own Square account. These tokens can be revoked by the parish or Stewardvine at any time.
- Site & app usage. Basic log and device data and cookies used to operate this website and the admin app. See the Cookie Policy.
2. What Stewardvine does not collect
Stewardvine does not collect or store raw payment card numbers, CVV/security codes, or magnetic-stripe data. Card details are captured only inside Apple's Secure Element and Square's SDK during the tap, and are encrypted directly to Square for processing — they never touch Stewardvine's servers.
Tap to Pay on iPhone does not disclose the payer's name, address, phone number, or full card number to the merchant or the app. Stewardvine therefore does not receive that payer information from the payment itself.
3. Roles & responsibilities
- Donor data — Stewardvine is the parish's service provider/processor. Stewardvine processes donor-related information only to provide the Software to the parish and on the parish's documented instructions, as described in the Data Processing Addendum. The parish controls this data.
- Parish-admin data — Stewardvine is a business/controller. For the accounts of the parish staff and volunteers who use the Software, Stewardvine acts as a business (controller) to operate and secure the service.
- Payment data — Square and Apple. Square and Apple process payment information under their own privacy policies and terms. See [to be finalized] and [to be finalized].
4. Subprocessors
Stewardvine uses a limited set of vendors, including Square, to help deliver the Software. The current list is maintained on the Subprocessor List, which also describes how the parish is notified before a new subprocessor is added.
5. Retention
Stewardvine retains information for as long as needed to provide the Software and for the periods described in [to be finalized]. Retention of donation records must be reconciled with IRS substantiation and recordkeeping expectations on the one hand, and deletion rights on the other.
Drafting note: confirm the donation-record retention period with a CPA, and reconcile IRS substantiation/recordkeeping needs against consumer deletion rights before publishing. [to be finalized]
6. Security summary
Stewardvine's architecture is designed to keep its footprint over sensitive data narrow: card data is captured inside Apple's Secure Element and Square's SDK and encrypted to Square, connection tokens are stored encrypted, and access to the admin app is controlled and logged. Stewardvine applies reasonable and appropriate administrative, technical, and organizational measures. Stewardvine does not claim any specific certification or standard on this page. For more detail, see Security & Trust.
7. Your CCPA/CPRA rights
Depending on your state and role, you may have the right to know/access, correct, delete, and obtain a portable copy of your personal information, and to be free from discrimination for exercising these rights. To submit a request, contact [email protected]; we will verify your request as required. For donor data held on a parish's behalf, we will route or assist the request with the parish as the controlling organization.
You may use an authorized agent where permitted. Appeal rights, where applicable, are described at [to be finalized].
8. Do Not Sell or Share
Stewardvine does not sell or share donor data. We do not sell personal information for monetary or other valuable consideration, and we do not share it for cross-context behavioral advertising. Because we do not sell or share, there is nothing to opt out of on that basis; even so, we honor the Global Privacy Control (GPC) browser signal as an opt-out preference. [to be finalized]
9. Children's data
The Software is intended for use by parish staff and adult volunteers and is not directed to children. Stewardvine does not knowingly collect personal information from children as defined by applicable law. [to be finalized]
10. International scope
Stewardvine does not target the EU/EEA. The Software is offered to U.S. parishes and dioceses, and this Policy is written for U.S. law.
11. Contact & changes
We may update this Policy from time to time. Material changes will be posted here with an updated effective date and, where appropriate, notice to parish administrators. [to be finalized]
Questions about this policy? Contact [email protected].