This Privacy Policy explains how ContaIglesia, operated by BIBLEVERSE, LLC, collects, uses, shares, protects and retains information when you visit our site, request a demo, create an account, sign in, connect an organization or use the web or mobile application.

ContaIglesia is a web and mobile platform for accounting administration for churches, ministries, projects and other organizational units. In many cases, the customer subscribing to the service controls the data they upload, and BIBLEVERSE, LLC acts as the service provider that processes and hosts it.

This policy describes our general privacy and data protection practices for using the platform.

1. Information we collect

We collect information you provide directly and data generated when you use the platform.

Account and access data: name, email address, encrypted password or authentication token, and basic information needed to sign in.
Organization and main account data: church or customer name, internal identifiers, general settings, accounting area structure, roles, permissions and branding preferences.
Accounting and operational data: accounts, transactions, reports, third parties, budgets, imports, attachments and any other records you upload to the system.
Receipt photos: attaching a photo from your camera or gallery is optional. We link it to the accounting transaction and make it available to authorized members of your organization to view or export. We do not use these photos for advertising.
Billing data: information needed to process subscriptions, payments, refunds, plan status, payment references and billing-related events.
Contact and demo data: name, email, phone number, country, denomination, message and other information submitted through demo or contact forms.
Technical and usage data: IP address, browser, device, logs, security events, errors, timestamps, session cookies and reasonable technical telemetry.
Product and attribution events: general actions such as completing registration, starting a subscription or completing a purchase. We do not send your organization's accounting entries, receipts, donor names or accounting content to advertising platforms.
Third-party data: information we receive from Google when you choose to sign in with Google, from Stripe, Apple or Google Play when they process payments, and from services that manage subscriptions and in-app experiences.

2. How we use information

We use information to provide the service, protect the platform and improve the user experience.

Create and manage accounts, organizations and accounting units.
Provide authentication, role-based authorization and secure access to accounting data.
Process subscriptions, charge for plans, apply free trials, enable renewals and manage the commercial account.
Send confirmations, support notifications, replies to demo requests and operational messages.
Generate reports, financial controls, usage analytics and internal validations.
Detect fraud, abuse, unauthorized access, usage errors and technical problems.
Meet legal, tax, contractual and audit obligations where applicable.

3. Basis and authorization for processing

We process data based on our relationship with you, the need to provide the service, legal obligations and our legitimate interests in operating a secure platform.

Service provision: creating accounts, recording transactions, displaying reports and keeping the platform running.
Contract performance: managing your plan, free trial, billing and support.
Legitimate interest: security, fraud prevention, technical improvements, incident logging and basic product analytics.
Consent where applicable: for example, for certain commercial emails or specific preferences for which the law requires it.
Legal obligation: retaining certain billing, security or compliance records where required by law.

4. Google authentication and platform access

ContaIglesia may allow access with an email and password, and with Google through Supabase authentication.

If you choose Google, we receive the basic data needed to create or identify your account, such as your name and associated email address.
The platform uses technically necessary sessions and cookies to maintain access and remember your sign-in status.
We never request more information from Google than we need to authenticate you and provide access.

5. Accounting data and responsibility for content

The accounting and financial data you upload to ContaIglesia belongs to your organization or its original creator, as determined by applicable law and your internal agreements.

BIBLEVERSE, LLC processes this data to provide the service and does not use it to compete with you or resell it.

Each account may contain one or more organizations and accounting units.
Users with authorized roles may view or modify only what the customer's permission structure allows.
Your organization remains responsible for the accuracy of the data it records, validates, approves or shares.

6. Online payments and subscriptions

Payments and subscriptions may be processed by online payment providers. When you pay, that provider may receive information needed for billing, authorization, processing and management of the commercial relationship.

The payment provider may process payment data, customer references, subscription status, billing events and risk or verification data.
We may receive subscription status, the active plan, a customer reference and events such as renewal, cancellation or successful payment from the payment provider.
We do not store your full card details in ContaIglesia; the payment provider and its infrastructure handle them.
We may also record the commercial status needed internally to reflect your active plan and service validity.

7. Hosting, infrastructure and providers

ContaIglesia operates on third-party infrastructure that provides technical services.

Supabase: database, authentication and services needed to operate the application.
Vercel: web application hosting, deployments, technical logs and site delivery.
Cloudflare R2: private storage of receipt photos and temporary ZIP exports; downloads require authorization and time-limited links.
DigitalOcean: receipt export processing on a server with access limited to the files needed.
Stripe or another enabled payment provider: payment, subscription and billing event processing.
Transactional email provider, if enabled: delivery of operational notifications and demo requests.
Google: social authentication when the user chooses that sign-in method.
Apple App Store and Google Play: app distribution, in-app purchases and subscription status.
RevenueCat: synchronization of access entitlements arising from store purchases.
Superwall: presentation and measurement of in-app subscription experiences.
Meta: advertising event measurement and attribution when this integration is enabled.
TikTok: when its measurement is enabled and you accept it, TikTok receives general events to measure ads. On the web these may include visits, form events and registration; in the app, installation, opening, registration, starting a card-free trial and starting the subscription process. We do not send form contents, church names, transactions or receipts. You can disable it in Cookie preferences on the web or Settings in the app.

8. Cookies, sessions and similar technologies

We use cookies and similar storage only where necessary or useful for reasonably operating the platform.

Session and authentication cookies to maintain access and remember your status.
Basic interface and operational preferences.
Technical and security records that help detect errors, maintain active sessions and prevent abuse.
On public pages we use Google Analytics and Meta to measure visits and general actions. When TikTok measurement is enabled, a shared notice lets you accept, reject or choose separately the analytics and advertising cookies from Google, Meta and TikTok. Your choice is remembered for 180 days and can be changed in Cookie preferences. We respect browser GPC and Do Not Track opt-out signals. Blockers or refusal may prevent attributing a visit to an ad without affecting service access.

9. Advertising, attribution and ATT permission

With your consent we may use Meta App Events and the TikTok SDK to measure whether a campaign introduces people to ContaIglesia and to record general actions. Meta may receive subscription conversions verified by RevenueCat. The card-free trial is distinguished from a purchase or a store subscription trial. These integrations do not provide access to your church's accounting data.

App advertising measurement is optional and you can change your choice in Settings. Refusing it does not limit access. Previous permission for Meta does not by itself enable TikTok measurement.

On iPhone and iPad, we request App Tracking Transparency (ATT) permission before allowing collection of the advertising identifier. You may refuse and continue using ContaIglesia.

If you accept ATT, the system may use the device advertising identifier for attribution.
If you refuse ATT, we disable collection of that identifier. TikTok's mobile integration does not start; Meta limits measurement to permitted signals and the RevenueCat conversion integration does not send personal attribution to Meta.
You can change permission later in iOS privacy settings.
We do not sell personal data or send accounting transactions, files, receipts or lists of people to Meta or TikTok. TikTok's automatic capture of screen contents and purchases is disabled.

10. Data retention

We retain information for as long as necessary to provide the service, meet legal obligations, resolve disputes and protect our legitimate interests.

Account and organization data is retained while the account is active or as reasonably necessary for support, audit or compliance.
Billing and subscription data may be retained for the period required by accounting, tax or contractual obligations.
Photos can be attached during a valid free trial or active access period. When that period ends, we offer 90 days of recovery access to view and export retained receipts, without new uploads. This access period is not an automatic deletion date for originals; deletion requests are handled through the channels stated in this policy.
Each ZIP export is available for one hour after preparation finishes. We reuse the file when its contents have not changed and then delete the temporary copy and its incomplete parts through a cleanup task. A technical interruption may delay cleanup. This does not delete the original photos or copies you downloaded to your device.
Technical and security logs may be retained for limited periods for operation and diagnostics.
If you close your account or request deletion, we may delete or anonymize data except where retention is required by law or a legitimate operational need.

11. Security

We apply reasonable and appropriate measures to protect the information we process, but no system is completely invulnerable.

Role- and account-based access controls.
Permission-based authorization and logical data separation.
Authentication and protected routes to reduce unauthorized access.
Technical monitoring and error review to detect abnormal behavior.
We recommend strong passwords and protecting access to your email, Google account and devices.

12. Sharing information

We do not sell your personal information. We share data only where needed to operate the service or required by law.

With technical providers that help us host the service, process payments, authenticate users, send emails or monitor the service.
With authorized members of your own account or organization according to the roles and permissions you defined.
With authorities or third parties where required by law, a valid order or legal process.
In a corporate reorganization, merger, acquisition or similar transaction, within the limits allowed by law.

13. International transfers

Your data may be processed or stored outside your country of residence, for example in our providers' hosting, payment or authentication systems.

When data leaves your country, we take reasonable measures to protect it.
Service continuity may require distributed infrastructure or providers with an international presence.
If local law requires additional transfer mechanisms, we will apply them where applicable.

14. User rights and deletion

Depending on your jurisdiction, you may have rights of access, rectification, deletion, portability, objection, restriction and withdrawal of consent.

You can request access to your data or the data of the account you control.
You can request corrections if you identify errors.
You can request deletion where the law permits it and we have no obligation to retain the data.
You can request export of certain technically exportable data.
You can delete your account in the app under My account > Delete my account, or follow the instructions published at /en/account-deletion.
You can exercise these rights by writing to the contact listed at the end of this policy.

15. Minors

ContaIglesia is not directed at minors or children as individual users. If an organization uploads information about minors as part of its internal operations, it must do so under its own responsibility and applicable legal basis.

16. Changes to this policy

We may update this Privacy Policy to reflect operational, technical, legal or commercial changes.

When we do, we will publish the updated version with a new effective date.

17. Contact

If you have questions about this policy, data handling or your rights, please contact us.

Responsible entity: BIBLEVERSE, LLC, operating ContaIglesia.
Contact email: privacy@contaiglesia.com or the support channel published on the site.
If your organization needs a data processing agreement or additional terms, you can request them separately.