Privacy Policy

Steward Software LLC ("we," "our," or "us") is committed to protecting the privacy of churches and organizations that use our incident management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. Information We Collect

Account Information

When you create an account or organization, we collect:

• Name and email address
• Organization name
• Password (stored securely hashed, never in plain text)
• Role within your organization

Incident Data

When you use Steward to document incidents, you may provide:

• Incident details, descriptions, and narratives
• Names and contact information of involved parties
• Dates, times, and locations
• Photos, documents, and other attachments
• Internal notes and communications

Important:You control what information is entered into incident reports. We recommend following your organization's policies regarding what personal information to include.

Public Intake Submissions

When someone submits a report through a church's public intake form, we collect:

• The information the submitter chooses to provide, including incident details and narrative
• Contact information (name, email, phone number), which is entirely optional and used only to enable follow-up communication if the submitter requests it
• IP address, which is collected on all public intake submissions for abuse prevention and rate limiting purposes
• Browser user agent, which is collected for troubleshooting and security purposes

Important:Submissions made through a public intake form may be described as "anonymous," meaning the submitter is not required to provide their name or contact information. However, even anonymous submissions result in the collection of the submitter's IP address and browser user agent for abuse prevention, rate limiting, and security purposes.

Usage Information

We automatically collect certain information when you use Steward:

• Log data (IP address, browser type, pages visited, timestamps)
• Device information
• Actions taken within the platform (for audit trail purposes)

Payment Information

If you subscribe to a paid plan, payment processing is handled by Stripe. We do not store credit card numbers on our servers. We receive from Stripe:

• Billing name and address
• Last four digits of payment method
• Transaction history

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: Store, organize, and display your incident records
• Enable Collaboration: Allow authorized team members to access and work on incidents
• Send Notifications: Alert you to new incidents, assignments, and updates
• Generate Exports: Create PDF reports and data exports at your request
• Maintain Audit Trails: Log actions for accountability and legal defensibility
• Process Payments: Manage subscriptions and billing
• Improve the Service: Analyze usage patterns to enhance features
• Provide Support: Respond to your questions and troubleshoot issues
• Ensure Security: Detect and prevent fraud, abuse, and security incidents

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

Within Your Organization

Incident data is shared with members of your organization according to the role-based permissions you configure. Administrators control who can access what information.

Service Providers

We use trusted third-party services to operate Steward:

• Supabase: Database hosting and authentication
• Vercel: Application hosting
• Resend: Email delivery
• Stripe: Payment processing
• Cloudflare: Security and CAPTCHA (Turnstile)
• Sentry: Error tracking and monitoring

These providers are contractually obligated to protect your data and use it only to provide services to us.

Legal Requirements

We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect our rights or property
• Prevent fraud or illegal activity
• Protect the safety of users or the public

Business Transfers

If Steward is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted to and from Steward uses TLS/HTTPS encryption
• Encryption at Rest: Data stored in our database is encrypted
• Access Controls: Row-level security ensures users only access authorized data
• Password Security: Passwords are hashed using secure algorithms
• Regular Backups: Data is backed up regularly to prevent loss
• Monitoring: We monitor for security incidents and unauthorized access

While we strive to protect your information, no method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

5. Data Retention

We retain your data according to the following policies:

• Incident Records:Retained according to your organization's configured retention period (default: 7 years), unless under legal hold
• Audit Logs: Retained for the same period as related incident records
• Account Information: Retained while your account is active and for a reasonable period afterward
• Deleted Data: Soft-deleted incidents and attachments are permanently purged according to retention policies
• Attachment Removal:When attachments are removed (either directly by administrators or via approved removal requests), the file is deleted from storage but a record of the attachment's existence is retained on the incident for audit purposes

Organizations can configure their own retention periods. Data under legal hold is preserved regardless of retention settings. Attachments on incidents under legal hold cannot be removed.

6. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal and retention requirements)
• Portability: Request your data in a portable format
• Opt-Out: Unsubscribe from marketing communications

To exercise these rights, contact us at [email protected].

Note:Incident records are owned by your organization. Requests related to incident data should be directed to your organization's administrator.

7. Consent

By creating an account on Steward, you agree to this Privacy Policy and our Terms of Service. Your continued use of the platform constitutes ongoing acceptance of these terms.

By submitting a report through a public intake form, the submitter consents to the collection and processing of their submission data, including the incident details provided, their IP address, and browser user agent, as described in this Privacy Policy. This consent applies regardless of whether the submitter chooses to provide their name or contact information.

8. Cookies and Tracking

We use cookies and similar technologies for:

• Authentication: Keeping you logged in
• Preferences: Remembering your settings (like dark mode)
• Security: Detecting and preventing fraud
• Analytics: Understanding how the service is used

You can control cookies through your browser settings, but disabling them may affect functionality.

9. Information About Minors

Steward is not directed at individuals under the age of 18. However, we recognize that incident reports created within the platform may contain information about or involving minors, particularly in the context of child safety incidents, children's ministry activities, or youth programs.

Organizations using Steward are responsible for ensuring that any information about minors entered into the system is handled in accordance with applicable laws, including but not limited to the Children's Online Privacy Protection Act (COPPA) and state-specific child protection statutes. Organizations should limit the collection of minor information to what is necessary for incident documentation purposes.

Steward implements role-based access controls that restrict visibility of sensitive incident records, including the ability to mark incidents as private. Organizations should use these controls to limit access to records involving minors to authorized personnel only.

We do not knowingly collect personal information directly from children under 18. If a parent or guardian becomes aware that their child's information has been included in an incident report, they should contact the reporting organization directly to request review or removal.

10. Medical and Health Information

Incident reports may contain medical or health-related information when documenting medical emergencies, injuries, or health-related safety incidents. While Steward is not a healthcare provider and is not subject to HIPAA as a covered entity, we recognize the sensitive nature of this information.

Organizations that are subject to HIPAA or similar regulations should evaluate whether their use of Steward for documenting medical incidents requires a Business Associate Agreement (BAA). Steward does not currently offer BAA agreements. Organizations should avoid entering Protected Health Information (PHI) beyond what is necessary for incident documentation.

All incident data, including medical information, is encrypted at rest and in transit, protected by role-based access controls, and subject to the organization's configured data retention policy.

11. Legal and Insurance Use

Steward is designed to help organizations create structured, defensible incident records. While our system maintains immutable audit trails, append-only records, and professional export capabilities, Steward does not provide legal advice and makes no guarantee that records created in the system will be admissible in any particular legal proceeding or accepted by any particular insurance carrier.

Organizations should consult with their own legal counsel and insurance providers to ensure their incident documentation practices meet applicable requirements. The defensibility of any record depends on the accuracy and completeness of the information entered by the organization's users.

12. International Data Transfers

Steward is operated from the United States. If you access the service from outside the US, your information may be transferred to and processed in the US. By using Steward, you consent to this transfer.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting a notice on our website
• Sending an email to account administrators
• Updating the "Last updated" date above

Continued use of Steward after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

• Email: [email protected]
• Support: [email protected]