Privacy Policy & Compliance

Terms of Service

Please read these Terms of Service carefully before subscribing. These terms govern your access to and use of WorshipFlow AI.

1. Sole Trader Status & Limitation of Liability

WorshipFlow AI is operated by Chris Renshaw as a sole trader. To the maximum extent permitted by applicable law, you agree that the Operator's total aggregate liability for all claims arising out of or related to the Service, whether in contract, tort (including negligence), or otherwise, shall be strictly limited to the total fees paid by you to the Operator for the Service during the twelve (12) months immediately preceding the event giving rise to such liability.

Under no circumstances shall the Operator be liable for any indirect, special, incidental, punitive, exemplary, or consequential damages (including, but not limited to, loss of profits, loss of data, loss of business, or service interruptions) arising out of or in connection with the use or inability to use this Service. You acknowledge that you are advised to maintain independent professional indemnity insurance for your operations and that the Service is built as a convenience utility for church administrations.

2. Subscription, Billing, and Cancellation

• Recurring Fees: Access to standard and premium features is provided on a recurring subscription basis (monthly or annual billing).
• Auto-Renewal: Subscriptions automatically renew at the end of each billing cycle unless cancelled. You authorize us to charge your selected payment method via our payment gateway (Stripe) for the renewal term.
• Cancellation Policy: You may cancel your subscription at any time via the self-service Stripe Customer Portal. Upon cancellation, your subscription will remain active until the end of your current billing period, after which access will be downgraded to a limited 'Free Tier' in a 'Read-Only Staging' state so you do not get billed, but can still safely view and access your existing staged data.
• No Refunds: As all paid subscriptions begin only after a mandatory 14-day free trial period (allowing you to evaluate the Service at no cost before any billing occurs), all payments collected after the trial ends are non-refundable. We do not provide refunds, partial credits, or pro-rated adjustments for early cancellations, unused subscription periods, or plan downgrades.

3. Platform Warranty & CCLI Indemnity Disclaimer

The Service is provided on an "as is" and "as available" basis without warranties of any kind, either express or implied, including warranties of merchantability, fitness for a particular purpose, or non-infringement. We make no warranty that the Service will be uninterrupted, bug-free, or compatible with future Planning Center Online API updates.

WorshipFlow AI provides automated CCLI streaming license suggestions for guidance purposes only. These suggestions do NOT constitute legal counsel. You assume sole responsibility for maintaining active, correct CCLI licences inside your physical and digital worship services, and you agree to fully indemnify the Operator against any copyright or licensing claims brought against your organization.

4. Governing Law & Jurisdiction

These Terms of Service shall be governed by and construed in accordance with the laws of England and Wales. You agree that any legal actions or disputes arising out of or related to these terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.

GDPR & Privacy Policy

Last Updated: June 2026. WorshipFlow AI (the "Service") is operated by Chris Renshaw (the "Operator", "we", "us", or "our"), trading as a sole trader in the United Kingdom. We are committed to protecting the privacy of church staff, administrators, and volunteer musicians in accordance with the UK Data Protection Act 2018 (DPA 2018), the UK General Data Protection Regulation (UK GDPR), and the EU General Data Protection Regulation (EU GDPR).

1. Roles: Data Controller vs. Data Processor

Under the GDPR, your church/organization is the Data Controller of the personal data of your volunteers, congregation members, and staff. WorshipFlow AI acts strictly as a Data Processor when syncing planning data (such as rosters, teams, and plans) from Planning Center Online (PCO). By using this Service, you warrant that you have obtained all necessary consents, notices, and legal bases required under applicable laws to process and transfer this data to our Service.

2. Information We Process

We process:
• Administrative Credentials: Names, email addresses, payment tokens (handled securely via Stripe), and OAuth access tokens.
• Church Directory and Planning Meta-Data: Repertoire song lists, arrangement keys, BPM tempo records, sermon outlines, and team schedule role classifications (e.g., Soprano, Bass, Keys) synced from PCO Services.
• Roster Limits: The total number of active members in your team list is tracked solely to enforce plan billing thresholds. We do NOT collect or store volunteer telephone numbers, addresses, or other sensitive personal data.

3. Data Isolation & AI Safety Rules (Gemini LLM Boundaries)

To prevent volunteer data leaks, the Service enforces strict data boundary isolation:
• No Personally Identifiable Information (PII)—such as volunteer names, emails, or personal contact details—is ever sent to third-party artificial intelligence engines or the Google Gemini API.
• Only anonymous, metadata-level descriptors (e.g. musical key transpositions, band instrumentation profiles, and sermon notes) are processed via LLM models to generate matches.

4. International Data Transfers & Server Location

WorshipFlow AI is hosted on secure Google Cloud Platform infrastructure. Data is stored in databases physically located in the UK/EU (specifically europe-west3). For organizations located outside the UK/EEA (such as in the United States), data transfers are protected under Standard Contractual Clauses (SCCs) and comply with cross-border data transfer directives.

5. Regulatory Registration

As a UK-based sole trader, the Operator registers and maintains compliance with the Information Commissioner's Office (ICO) in the United Kingdom to govern all data processor operations legally.

6. California Consumer Privacy Act (CCPA/CPRA) & US State Rights

For users and organizations based in California and other US states with consumer privacy regulations, we verify that:
• No Sale or Sharing of Personal Info: WorshipFlow AI does NOT sell, rent, or share personal data (such as names, emails, or schedules of volunteers) for monetary value or cross-context behavioral advertising.
• Data Minimization: We only collect names, emails, and role classifications to facilitate matching and scheduling features.
• US Consumer Rights: If you wish to request access to or deletion of your church's roster data, contact us at .

7. Data Retention & Deletion Policy

We retain personal data only for as long as necessary to provide the Service, or as required by law:
• OAuth Credentials: Access tokens to Planning Center Online are deleted immediately upon user logout, PCO token revocation, or when the user deletes their account.
• Staged Repertoire & Schedules: All song libraries, matched setlists, and schedule data are stored in Firestore and retained as long as your account remains active.
• Account Deletion: Users can request complete deletion of their account and all associated Firestore data at any time via the "Delete My Account" button in their Settings/Profile, or by emailing . All data will be permanently and securely deleted from active databases within 30 days of the request.

PCO Auditor Security Guide: Data Isolation Shield

This guide provides church administrators and Planning Center Online security auditors with technical details on how WorshipFlow AI isolates and protects sensitive church and volunteer data.

1. Zero PII Shared with Gemini API

WorshipFlow AI strictly separates structural planning data from personally identifiable information (PII). When analyzing setlist compatibility or generating team rehearsal briefs, we strip all volunteer names, emails, and contact details. Only anonymous metadata (such as the target musical keys, scheduled roles, and sermon outline notes) is passed to the Gemini API.

2. Database Isolation & Regional Hosting

All synchronized PCO data and generated setlists are hosted within secure Google Cloud Platform (GCP) Firestore databases physically isolated in the United Kingdom/European Union (specifically the europe-west3 Frankfurt region). Data is encrypted at rest and in transit.

3. OAuth 2.0 Token Lifecycle & Revocation

We access the Planning Center API via standard OAuth 2.0. Access tokens are stored securely in Firestore and updated via encrypted token rotation. Administrative users can audit or immediately revoke all access permissions directly from their Planning Center dashboard at any time, which automatically terminates token validity on our side.