Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: When you create an account, we collect your email address, name (if provided), and authentication credentials. If you sign up through Google, we receive your name, email, and profile picture from Google.
• Profile Information: Religious denomination and personal preferences you choose to share for personalized guidance.
• User Content: Chat messages and conversations with our AI, verse annotations, personal notes, bookmarks, and any other content you create within the Service.
• Payment Information: When you subscribe, payment details are collected and processed by our payment processor, Paddle. We do not directly collect or store your credit card numbers.
• Communications: Feedback you submit, support requests, and any other communications you send to us.

1.2 Information Collected Automatically

• Device Information: Browser type, operating system, device type, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, features used, time spent on the Service, click patterns, and interaction data.
• Log Data: IP address, access times, referring/exit URLs, and server logs.
• Location Data: General geographic location based on IP address (country/region level only, not precise location).

1.3 Information from Third Parties

• Authentication Providers: If you sign in with Google, we receive basic profile information as permitted by your Google privacy settings.
• Payment Processor: Paddle may share transaction information, subscription status, and billing details necessary for managing your subscription.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: Deliver AI-powered biblical guidance, process your queries, display relevant Scripture, and enable all Service features.
• Personalize Your Experience: Tailor responses based on your denomination preferences and interaction history.
• Process Transactions: Manage subscriptions, process payments through Paddle, and handle billing inquiries.
• Communicate with You: Send important service announcements, respond to support requests, and provide account-related notifications.
• Improve the Service: Analyze usage patterns, identify issues, develop new features, and enhance user experience.
• Ensure Security: Detect and prevent fraud, abuse, and unauthorized access to protect you and our Service.
• Comply with Legal Obligations: Meet legal requirements, respond to lawful requests, and protect our legal rights.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Service you requested (account creation, AI responses, subscription management).
• Legitimate Interests: Processing for our legitimate business interests (improving the Service, security, analytics) where these do not override your rights.
• Consent: Where you have given explicit consent for specific processing activities (marketing communications, optional cookies).
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with trusted third parties who help us operate the Service:

• OpenAI: Your chat messages are processed by OpenAI's AI systems to generate responses. OpenAI processes this data according to their privacy policy and data processing terms.
• Paddle: Our Merchant of Record handles payment processing, subscription billing, tax collection, and related financial services.
• Supabase: Provides our database infrastructure, user authentication, and data storage services.
• Vercel: Hosts our application and provides content delivery services.
• Google: Provides authentication services if you choose to sign in with Google.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, property, or safety, or that of others.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

4.4 With Your Consent

We may share your information for other purposes with your explicit consent.

5. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws.

When we transfer data outside the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequacy decisions
• Other legally approved transfer mechanisms

6. Data Retention

We retain your personal information for as long as necessary to:

• Provide the Service while your account is active
• Comply with legal obligations (tax, accounting, legal holds)
• Resolve disputes and enforce our agreements
• Maintain security and prevent fraud

When you delete your account, we will delete or anonymize your personal data within 30 days, except for data we are required to retain for legal purposes. Some information may remain in encrypted backups for a limited period.

In the event that we discontinue the Service, we will make reasonable efforts to notify users in advance where practicable. However, we are not obligated to preserve, return, or make available any data after Service discontinuation. You are responsible for exporting any data you wish to retain before account deletion or Service termination.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of your personal data we hold.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw previously given consent at any time.

To exercise these rights, contact us at help@whatthebiblesays.me. We will respond within the timeframe required by applicable law (typically 30 days).

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

8.1 Right to Know

You can request information about the categories and specific pieces of personal information we have collected about you, the sources of collection, our purposes for collecting or selling the information, and the categories of third parties with whom we share it.

8.2 Right to Delete

You can request deletion of your personal information, subject to certain exceptions.

8.3 Right to Opt-Out of Sale/Sharing

We do not sell your personal information as defined by the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising.

8.4 Right to Correct

You can request correction of inaccurate personal information.

8.5 Right to Limit Use of Sensitive Information

We only use sensitive personal information (such as religious beliefs inferred from your denomination preference) for the purposes of providing the Service you requested.

8.6 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights.

9. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following additional rights:

• All rights listed in Section 7 above
• Right to lodge a complaint with your local data protection authority
• Right to obtain human intervention for automated decisions that significantly affect you

Data Protection Authorities

You have the right to lodge a complaint with your local supervisory authority if you believe we have violated your privacy rights. You can find your local authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en

10. Cookies and Tracking Technologies

10.1 What We Use

• Essential Cookies: Required for authentication, security, and basic Service functionality. These cannot be disabled.
• Functional Cookies: Remember your preferences and settings.
• Analytics: We may use analytics services to understand how users interact with our Service.

10.2 Your Choices

Most browsers allow you to control cookies through settings. However, disabling essential cookies may prevent you from using parts of our Service. You can also opt out of analytics tracking where applicable.

10.3 Do Not Track

Our Service does not currently respond to Do Not Track (DNT) browser signals. We will update this policy if we implement DNT recognition in the future.

11. Children's Privacy

The Service is not intended for children under 13 years of age (or the minimum age of digital consent in your jurisdiction, such as 16 in some EU countries).

We do not knowingly collect personal information from children under these age limits. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at help@whatthebiblesays.me, and we will promptly delete such information.

If you are between 13 and 18 years old, you may only use the Service with your parent or guardian's consent and supervision.

12. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication mechanisms
• Regular security assessments and updates
• Access controls limiting who can access your data
• Secure infrastructure provided by reputable cloud providers

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

13. Third-Party Links and Services

Our Service may contain links to third-party websites or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you by email (if you have an account) or post a prominent notice on our Service
• For significant changes, we may ask for your renewed consent where required by law

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For privacy-related inquiries, please include "Privacy Request" in the subject line of your email. We aim to respond to all legitimate requests within 30 days.