Astray Data Processing Addendum

This addendum forms part of the Terms of Service between Paul Swiech, an individual doing business as Astray in South Carolina ("Astray", "we"), and your organization ("you"). It governs personal information about your congregation that we process on your behalf.

You are the controller of that information. We are the processor. You decide why it is processed; we process it only as this addendum and your instructions allow. Where "controller" and "processor" are not the terms your law uses, the equivalent roles apply — for example service provider and business under California law.

1. Scope and instructions

We process congregational personal information only to provide Astray under the Terms of Service, and on your documented instructions. Your instructions are the Terms, this addendum, and your use of the product's features and settings.

We will tell you if we believe an instruction requires us to break the law. We will not process the information for our own purposes, and we will not use it to train artificial intelligence models.

You are responsible for having a lawful basis to provide us this information and for telling the people it describes how their church uses software like ours. We cannot obtain that basis for you, because we have no relationship with them.

2. What we process

Categories of people. Members, attendees, visitors, donors, and children known to your Planning Center account, together with your own staff and volunteers.

Categories of information.

• Identifiers and contact details from Planning Center
• Membership, attendance, group, service, and check-in records
• Pastoral care notes written by your team, including anything they choose to record about a person's circumstances
• Follow-up flags, next-step assignments, and attention exclusions
• Derived participation rhythms, drift signals, and congregational health metrics
• Minimal giving identifiers and first and last known gift dates

What we do not process. Donation rows, amounts, funds, payment methods, donor names in the giving index, uploaded giving files, card or bank details, or government identifiers.

Sensitive information. Pastoral care notes are free text. Your team may record health, family, financial, or religious circumstances in them. Religious affiliation is inherent to the context. Treat this addendum as covering special category information, because in practice it does.

3. Confidentiality

Our personnel who can access congregational information are bound by confidentiality obligations and are granted access only where their work requires it.

4. Security

We maintain appropriate technical and organizational measures, including:

• tenant isolation enforced in the database, so one organization cannot reach another's data even if application code is wrong
• encryption in transit and at rest
• provider credentials encrypted with keys held outside the database
• multi-factor authentication for administrators, with a recent check required for sensitive actions
• least-privilege access, audited administrative actions, and immutable audit history for security-relevant events

We may change these measures as the product changes, but will not materially reduce the overall level of protection.

5. Subprocessors

You authorize the subprocessors below. Each is bound by terms no less protective than this addendum.

Planning Center is not a subprocessor. It is your own system, which you connect and can disconnect, and your relationship with them is your own.

We will give at least 30 days' notice before adding or replacing a subprocessor. If you reasonably object on data protection grounds, tell us within that period and we will work with you in good faith; if we cannot resolve it, you may terminate the affected part of the service and receive a pro-rata refund of fees paid for the unused period.

6. Helping you meet your obligations

Taking into account the nature of the processing, we will give you reasonable assistance with:

• requests from people exercising their rights, where the answer is in Astray and you cannot get it yourself through the product
• data protection impact assessments and consultations with regulators
• your own security and breach obligations

Most access and correction requests you can satisfy from Planning Center and from Astray directly, because you can see everything we hold about your congregation.

7. Personal data breaches

If we become aware of a breach affecting your congregational information we will notify you without undue delay, and in any case within 72 hours of becoming aware. We will tell you what we know, what we are doing, and what we recommend, and will update you as we learn more.

We will not delay notification because our investigation is incomplete.

8. Deletion and return

You can delete data from Astray yourself while your subscription is active.

When our agreement ends, you may ask us within 30 days for a copy of your congregational data in a machine-readable format. After that period, or once we have provided the copy, we will delete it from live systems within 30 days and from backups within 90 days as backups expire.

We keep only what the law requires us to keep, plus billing and security audit records, which hold identifiers and event types rather than pastoral content.

Restricting access for non-payment is not deletion. We do not delete your data because an invoice failed.

9. Audit

On reasonable written request, no more than once a year unless a regulator or a breach requires otherwise, we will provide the information reasonably needed to show we are meeting this addendum. We may satisfy this with documentation and written answers rather than site access.

10. International transfers

We process in the United States. If you are subject to a law restricting transfers out of your region, tell us before subscribing so we can put an appropriate mechanism in place or agree that Astray is not suitable for you.

11. Precedence

If this addendum conflicts with the Terms of Service on the processing of congregational personal information, this addendum governs.