Privacy Policy

Who we are and what this policy covers

BLUETOUCH LLC, a Texas limited liability company, operates the Risen Together service (“Risen Together,” “we,” “us,” or “our”).

This policy covers the public website, inquiry form, account and Organization onboarding, and authenticated Risen Together service. Our initial market is the United States.

Information we process

• Authentication: Clerk-managed identity, verified email, and session information. Risen Together stores Clerk’s external user identifier to connect an identity to an Organization actor; we do not store your password.
• Organization: church or Organization name, locations, membership, roles, settings, starter catalog, and connected-service configuration.
• Care coordination: People, households, helper or member details, capabilities and resources, availability, Needs, beneficiary identity and visibility, general locations, commitments, requests, coordination readiness, fulfillment, and resolution history.
• Public inquiries: your name, church, church or work email, general inquiry description, and correspondence.
• Technical information: IP address, browser or device details, timestamps, request paths, authentication/session state, selected-Organization state, and operational or security logs.

Information about people without accounts

Organization users may enter information about beneficiaries, households, helpers, or church members who do not themselves have Risen Together accounts. Users are responsible for having appropriate authority or permission to provide that information.

Why we use information

We use information to authenticate users; create and administer Organizations; coordinate care; match potential helpers; communicate requests; preserve care history; provide support; secure and troubleshoot the service; enforce the included-Need allowance and future entitlements; reconcile future billing; comply with law; protect rights and safety; and improve Risen Together using appropriately aggregated or de-identified information.

We do not sell personal information or use care-coordination information for targeted advertising. Submitting the inquiry form does not create a marketing-email subscription or an automated decision about a person.

Temporary Need continuation

If an additional Need reaches the unavailable subscription boundary, submitted intake may be encrypted and retained for up to seven days so its author can continue later. The encrypted payload is deleted after successful resolution or expiry as implemented. Limited tombstone or receipt information may remain to preserve integrity and idempotency. The continuation is private to its author; billing administrators do not receive its content through billing operations.

First-included-Need evidence

Risen Together keeps the time and identifier of the first successfully created Need, plus creation receipts, to enforce one durable included Need per Organization and safely handle retries. Deleting a Need does not erase or reset that allowance evidence.

Billing information

Paid checkout is not currently available. If billing is enabled later, Risen Together may store local billing-account identifiers, Paddle customer, transaction, and subscription identifiers, normalized lifecycle and entitlement evidence, checkout and reconciliation records, and webhook receipts. Risen Together does not intentionally receive or store full payment-card numbers; Paddle handles payment details as merchant of record.

Service providers

• Clerk provides authentication and session management.
• Vercel hosts the public and authenticated applications and processes requests, security information, and operational logs.
• Neon provides PostgreSQL data storage.
• Resend transmits transactional and inquiry email.
• Google Workspace receives and stores inquiry and support email.
• Google Maps Platform provides optional church and location search.
• Paddle will act as merchant of record only if future paid billing is enabled.

We may also disclose information when reasonably necessary to comply with law, respond to valid legal process, protect rights or security, or support a properly structured business transaction subject to applicable obligations.

Optional church search

When you use church search, we send the search to Google Maps Platform. We may use approximate location derived from your IP address to prioritize nearby results; we do not request device GPS. In the public inquiry flow, the selected Google church name and Place ID are included in the internal inquiry email so our team can identify the selection; other Google-provided names and locations are temporary. During authenticated onboarding, a confirmed selection can supply the church name, general location, coordinates, and Place ID used to create the Organization and first Location. You can use manual entry instead.

Cookies and session state

Clerk uses identity and session state needed to sign users in. Risen Together sets an HTTP-only, same-site selected-Organization cookie, secure in production, with a maximum age of 30 days. Browser state may also support interface and retry behavior. We do not currently use an advertising, session-replay, or marketing-tracking stack.

How information is shared

Information is shared inside the relevant Organization according to roles, exact Need scope, beneficiary visibility, and invitation or claim controls; with providers that operate the service; and when reasonably necessary for legal process, safety, rights protection, or a properly structured business transaction.

Retention

Retention depends on the purpose and record type. Source-defined periods include up to seven days for encrypted Need-continuation payloads and 30 days for the selected-Organization cookie. Public inquiries that do not become an active relationship generally have a target of up to 12 months after the last substantive interaction.

Need, Person, household, commitment, entitlement, billing, delivery, and audit records may be retained to operate the service, preserve church care history, enforce allowances, meet legal or accounting needs, resolve disputes, or protect integrity. Archived product records are not the same as deletion. Aggregated or de-identified information may be kept longer when it is reasonably non-linkable and we do not attempt to reidentify it.

Sensitive information and emergencies

Share only what helpers need to coordinate care. Avoid unnecessary medical details, financial information, passwords, government identifiers, confidential counseling information, and unnecessarily detailed private addresses. Risen Together does not inspect or classify Need text for sensitive content and is not an emergency-response service.

Security

We use measures such as tenant-scoped authorization, encrypted temporary continuation payloads, token hashing, server-only credentials, authenticated provider callbacks, and restricted operational logging. No transmission or storage method is completely secure.

Your choices and requests

Users can control some sharing through Organization roles, Need audience, and beneficiary visibility. Email hello@risentogether.com to ask about, correct, or request deletion of information. We will verify identity and Organization authority proportionately and respond subject to applicable law, legitimate exceptions, and records we need to preserve. Specific legal rights depend on applicable law.

Children

The public inquiry and account-creation flows are intended for adults acting in connection with a church or church organization and are not directed to children. Contact us if you believe a child submitted personal information so we can review it appropriately.

Changes and contact

We may update this policy as the service or our practices change. We will post the revised policy with an updated effective date and provide any additional notice required by applicable law.

Privacy questions and requests: hello@risentogether.com.