Privacy Policy

Last updated: October 12, 2026

1. Introduction

DiscipleLink ("we," "us," or "our") is a digital discipleship platform that empowers churches and ministries with tools for community building and spiritual growth. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our platform.

By using DiscipleLink, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Information You Provide

  • Account information: First name, last name, email address, username, phone number, profession, and skills.
  • Community application data: Church/organization name, description, website, address, phone number, administrator contact details, and requested license count.
  • Content you create: Journal entries, reading plan progress, book assignment responses, group activity, and comments.
  • Communications: Support tickets, bug reports, and feedback.
  • Date of birth: Collected during the application process to verify age eligibility. Encrypted at rest.

2.2 Information Collected Automatically

  • Usage data: Pages visited, features used, reading plan completion rates, and engagement metrics.
  • Device information: Browser type, operating system, and device identifiers for push notifications.
  • Log data: IP address, access times, and referring URLs.
  • Cookies: Essential cookies for session management and authentication. See Section 8 for details.

3. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the DiscipleLink platform.
  • Create and manage your account and community membership.
  • Send notifications about reading plans, journals, assignments, and community updates.
  • Send weekly activity summaries and encouragement emails.
  • Process community applications and manage licenses.
  • Provide customer support and respond to inquiries.
  • Send marketing communications (only with your explicit consent).
  • Analyze usage patterns to improve our services.
  • Comply with legal obligations.

4. Third-Party Processors

We share your data with the following third-party service providers who process data on our behalf:

  • SendGrid (Twilio): Email delivery for notifications, invitations, and communications. SendGrid processes your email address and message content in order to deliver it.
  • Google Translate: Optional content translation. Text you choose to translate is sent to Google's translation API.
  • Slack: Internal team notifications for support tickets and system alerts. Your support ticket content may be shared with our support team via Slack.
  • Google Cloud Platform: Cloud hosting and infrastructure. All platform data is stored on Google Cloud servers located in the United States.
  • Sentry: Error monitoring. Technical diagnostics about application errors are sent to Sentry; we configure it not to receive your journal content, form submissions, or contact details.

Each processor is bound by data processing agreements that require them to protect your data in accordance with applicable law.

5. International Data Transfers

DiscipleLink is operated from the United States. If you access our platform from outside the United States, your data will be transferred to and processed in the United States. We rely on standard contractual clauses and data processing agreements with our third-party processors to ensure appropriate safeguards for international transfers.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data under the legal bases described in Section 6.

6. Legal Basis for Processing (GDPR)

If you are in the EEA, UK, or Switzerland, our legal bases for processing your personal data are:

  • Contract performance: Processing necessary to provide the DiscipleLink platform (account management, content delivery, notifications).
  • Legitimate interests: Analytics, service improvement, and security (where not overridden by your rights).
  • Consent: Marketing emails, analytics cookies, and optional data processing. You may withdraw consent at any time.
  • Legal obligation: Where required by law.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specific retention periods:

  • Active accounts: Data retained for the duration of your membership.
  • Deleted accounts: Personal data is anonymized within 30 days of a confirmed deletion request. Anonymized records are retained for referential integrity.
  • Community applications: Denied applications are retained for 1 year, then deleted.
  • Session data: Expired sessions are cleaned up automatically.
  • Notification logs: Retained for 1 year.
  • Password reset tokens: Expired tokens are deleted automatically.

8. Cookies

DiscipleLink uses cookies as follows:

  • Essential cookies: Required for authentication, session management, CSRF protection, and language preferences. These cannot be disabled.
  • Analytics cookies: Used to understand how you interact with the platform. These are only set with your consent.

You can manage your cookie preferences at any time through the cookie consent banner or your account settings.

9. Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data.
  • Rectification: Correct inaccurate data via your account settings.
  • Deletion: Request deletion of your account and personal data.
  • Portability: Export your data in a machine-readable format.
  • Restriction: Request we limit processing of your data.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Withdraw consent for marketing emails or analytics cookies at any time.

To exercise these rights, visit your account settings or contact us at privacy@staging.disciplelink.net.

10. Children's Privacy (COPPA)

DiscipleLink does not knowingly collect personal information from children under 13. If an applicant indicates they are under 13, their application is rejected and they are directed to have a parent or guardian contact us. If we learn that we have collected personal information from a child under 13, we will promptly delete it.

Users aged 13-17 may use DiscipleLink with parental/guardian awareness through their church or ministry community.

11. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

  • Encryption of sensitive data at rest (passwords, dates of birth, invitation tokens).
  • HTTPS encryption for all data in transit.
  • Role-based access controls (RBAC).
  • CSRF protection and rate limiting.
  • Security headers (HSTS, CSP, X-Frame-Options).
  • Regular security reviews.

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@staging.disciplelink.net.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of DiscipleLink after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Cookie Preferences

We use essential cookies for the platform to function. Analytics cookies help us improve DiscipleLink. Read our Privacy Policy.

Bug/Issue Tracker