Privacy Policy

1. Who We Are

SermonBridge is a real-time multilingual captioning and translation service for churches and other houses of worship. It is operated by AM8 B.V., registered in the Netherlands (Chamber of Commerce / KVK no. 83209905), hereinafter referred to as "SermonBridge", "we", "us", or "our".

Our infrastructure is hosted in the European Union (Germany, via Hetzner Online GmbH). For questions about this policy or your personal data, see Section 12.

SermonBridge is currently in a testing phase with invited churches. This policy applies in full during testing. Where a feature described here is still being completed, the relevant section says so.

2. Controller and Processor Roles

SermonBridge as controller

SermonBridge acts as the data controller for the account and user data it collects directly - name, email address, hashed password, and OAuth identifiers - for the purpose of providing and securing access to the platform.

Your church as controller; SermonBridge as processor

When a church creates and manages sessions, the church (the "operator") is the data controller for any personal data that flows through those sessions - including session transcripts, church membership records, and any personal information of congregation members. SermonBridge processes that data solely on the operator's documented instructions, acting as a data processor under Article 28 GDPR.

3. Data We Collect

Account and identity data

• Name and email address - collected at registration for account management and transactional email.
• Password hash - passwords are never stored in plain text; we store a bcrypt hash only.
• OAuth provider identifiers - if you sign in via Google or Microsoft, we store the unique identifier from that provider alongside your email address. We do not receive or store your OAuth password.
• Profile avatar - optionally uploaded as a data URL; stored in the database. You may remove it at any time.

Church and organization data

• When you join or create a church on the platform, a membership record linking your account to that church is created and stored in our database.
• Church logo and display settings - church administrators may upload a church logo and configure church-specific display text. The logo and settings are stored in the database and are used solely to display the church's branding within the service.

Billing data

• Subscription data - selected plan, subscription status, billing email, renewal date, and Stripe customer and subscription identifiers.
• Checkout data - billing name, billing address, tax identifier where applicable, and payment-method details are collected by Stripe and Link. Purchases through Managed Payments are sold through Link, which handles payment, tax collection, invoices, and transaction support. SermonBridge does not receive or store full card or bank-account details.
• Usage data - monthly session and translation usage is retained to show plan consumption and support billing reconciliation.

Waitlist data

The SermonBridge marketing site collects email addresses from people requesting early access, to notify them when access opens. Legal basis: consent (by submitting the form). You can request removal from the waitlist at any time by contacting privacy@sermonbridge.com.

Session and audio data

• Live audio - the host's microphone audio is streamed in real time to our speech recognition and translation sub-processor (Soniox). SermonBridge does not persist audio - it is streamed in real time and never saved. Soniox processes audio and resulting transcript text in transit under the data processing agreement described in Section 6, which provides that Soniox does not store audio or text by default and does not use customer data to train models serving other customers. Once a session ends, no audio data is retained by SermonBridge.
• Session transcripts (captions) - the text output of transcription and translation is stored in our database. See Section 7 for retention periods.
• Session metadata - session identifiers, start/end timestamps, selected languages, and host/participant connection events are logged for operational purposes.

Technical and log data

• Standard server access logs (IP address, browser user-agent, request path, response code, timestamp) are generated automatically for security and operational purposes.
• We do not use third-party web analytics. No tracking pixels, no fingerprinting.
• The caption viewer sends limited operational diagnostics to our own server: connection attempts, timeouts, retries, connection close codes, and periodic confirmation that captions arrived. Reports contain relative timings, online and page visibility states, the service identifier, and the viewer software bundle identifier. A random diagnostic identifier exists only in page memory and changes when the service changes or the page reloads. Diagnostics do not include caption text, raw error messages, full URLs, browser fingerprints, or account/contact details. Up to 20 events are buffered in memory during an outage and discarded when the page closes. Received reports follow the server-log retention period in Section 7.

Support and feedback messages

• When you send optional feedback during or after a service, we store your rating (if provided), comment, operator or listener role, whether the service was live, session identifier, interface language, submission identifier, and the email address you choose to provide for a reply. Operator feedback is linked to your account; listeners do not need an account. We do not add your browser user-agent or IP address to feedback records. We also email this feedback, including any comment and reply address you provide, to our support mailbox so we can review it and reply.
• Emails you send to our support or privacy addresses are kept in that mailbox for as long as needed to resolve your request.

4. Legal Bases for Processing

We rely on the following legal bases under GDPR Article 6 (and Article 9 for special-category data):

Performance of a contract (Art. 6(1)(b))

Processing your account data (name, email, hashed password, OAuth identifiers) and operating sessions (forwarding audio to Soniox, storing transcripts) is necessary to deliver the service you have contracted for.

Explicit consent (Art. 6(1)(a) and Art. 9(2)(a))

Storing church membership records that reveal religious affiliation is processed exclusively on the basis of your freely given, specific, informed, and unambiguous explicit consent. You give this consent when you create or join a church. You may withdraw it at any time by removing your church membership or deleting your account; withdrawal does not affect the lawfulness of processing before withdrawal.

Legitimate interests (Art. 6(1)(f))

We process server access logs and session metadata to ensure platform security, detect abuse, and maintain service reliability. These interests are balanced against your rights; the data is not used for advertising or profiling.

Legal obligation (Art. 6(1)(c))

We may retain certain records to comply with applicable Dutch and EU law, including tax and financial record-keeping requirements.

5. Minors

SermonBridge is a platform for churches; congregations regularly include children and young people. The service account (host/admin) must be held by an adult aged 18 or over.

Viewers who join a session as audience members do not create accounts; they access a session via a code. However, session transcripts may incidentally capture speech from minors present in the service. As data controller for those sessions, the church (operator) is responsible for ensuring its use of SermonBridge complies with applicable obligations regarding the processing of children's data, including informing parents or guardians as appropriate.

If we become aware that we have inadvertently collected personal data from a child via an account registration without appropriate consent, we will delete it promptly. Please contact privacy@sermonbridge.com if you believe this has occurred.

6. Service Providers and International Transfers

The following providers support the service. Providers processing personal data on our instructions are covered by data processing agreements. Stripe and Link also process payment and purchase information for their own purposes, including merchant-of-record services, fraud prevention, and regulatory obligations, as described in Stripe's Privacy Policy and Link's Privacy Policy.

You can obtain a copy of the transfer safeguards listed above by contacting privacy@sermonbridge.com.

We do not sell or share personal data with any third party for advertising, marketing, or profiling purposes.

7. Data Retention

Audio

SermonBridge does not persist audio. Audio is streamed in real time to Soniox for transcription and translation, and is discarded immediately - it is never saved to disk or stored in the database. Soniox processes the audio in transit under contractual data-protection terms (see Section 6). Once a session ends, no audio data remains with SermonBridge.

Session transcripts

Transcripts (captions in all enabled languages) are retained for up to 12 months (configurable via TRANSCRIPT_RETENTION_DAYS) and then automatically deleted by a daily background purge.

Church owners and admins can delete the text of an ended service sooner, under Past services in church settings, or ask us at privacy@sermonbridge.com to do it. Deleting removes the captions in every language. What stays is the record that the service took place: its date, length and languages, who hosted it, the per-service viewer records described under the viewer measurement cookie in Section 8, and who deleted the text and when. Feedback about the service is kept as described under Support and feedback messages below. Deletion cannot be undone. Copies in our backups are deleted within 30 days, except after a restore, as described under Backups below.

Account data

Account data (name, email, password hash, OAuth identifiers, avatar) is retained for as long as your account is active. Account deletion erases your account and associated data immediately. During the testing phase you can request deletion at privacy@sermonbridge.com; a self-service button in your profile is being added. Financial records required by law may be retained for the legally required period.

Church membership records

Church membership records are retained until you leave the church on the platform or delete your account.

Server and access logs

Server access logs are retained for a maximum of 90 days for security and operational purposes, then deleted.

Support and feedback messages

Feedback sent from the app is retained for a maximum of 12 months after it is received, so we can follow up on it and track what testers reported. It is deleted earlier on request. Feedback linked to your account is deleted when your account is deleted. Anonymous listener feedback is not linked to an account.

Backups

We back up the database once a day so the service can be restored after a failure. A backup is a full copy of the database, so it contains the personal data described in this policy. Each daily backup is kept on our server in Germany for 7 days, and an encrypted copy is kept in Cloudflare R2 storage in the European Union for 30 days (see Section 6). A copy taken on our server just before a software update is kept for up to 30 days. Backups are then deleted automatically, so in normal operation data deleted from the service is gone from our backups within 30 days. We use backups only to restore the service, and copies made for a restore are deleted once it is complete.

Restoring a backup is a last resort after a failure. Before a restored backup goes live, we delete from it the text of services that church owners or admins deleted after the backup was taken, as far as our records of those deletions reach. We keep these records (which service, when its text was deleted and by whom, but no caption text) on our server for up to 36 days after the restore, or longer if another restore follows within that time. Accounts and churches deleted after the backup was taken return with it, and we delete them again; this also deletes again the services and text that were deleted together with an account. If our records of deletions were lost together with the server, we email every church owner and admin the time of the backup so they can repeat any deletion made after it. Data that returns with a restore is deleted from our backups within 30 days of being deleted again.

8. Cookies and Local Storage

SermonBridge uses a minimal cookie footprint. We do not use advertising or third-party tracking cookies. Fonts are self-hosted and do not trigger any third-party requests.

Authentication cookie (auth_token)

A single HttpOnly, Secure cookie named auth_token is set when you sign in. It contains a signed JWT that identifies your session. This cookie is strictly necessary for the service to function and does not require your consent under the ePrivacy Directive. It expires after 7 days or when you sign out, whichever is earlier.

OAuth state cookie (oauth_state)

When you initiate a sign-in via Google or Microsoft, a short-lived (typically a few minutes) oauth_state cookie is set to protect the OAuth flow against cross-site request forgery (CSRF). This cookie is strictly necessary and is deleted as soon as the OAuth flow completes.

OAuth PKCE cookie (oauth_pkce_verifier)

A short-lived oauth_pkce_verifier cookie carries the PKCE code verifier used to harden the OAuth authorization code exchange against interception attacks. It is strictly necessary for OAuth security and is deleted immediately after the OAuth callback completes.

OAuth invite cookie (sb_oauth_invite)

If you follow an invitation link and then choose to sign in via Google or Microsoft, a short-lived sb_oauth_invite cookie (maximum 10 minutes) carries the pending invitation code through the OAuth redirect round-trip so it is not lost. It is strictly necessary for the invitation flow and is deleted as soon as the callback has been processed.

Viewer measurement cookie (sb_viewer)

A signed, random browser-session cookie lets us count multiple caption tabs as one browser profile within a service. It does not contain your name or account details. It expires when the browser session ends. Server records use a different identifier for each service, so those records do not link your attendance across services. Counts describe browser profiles, not individual people. Viewing time counts only while at least one caption connection is open.

No third-party analytics cookies

We do not use Google Analytics, Facebook Pixel, or any other third-party tracking or analytics service. The first-party viewer measurement described above is separate from those services.

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. To exercise any of them, contact us at privacy@sermonbridge.com. We will respond within one month (extendable by two further months for complex requests).

• Right of access (Art. 15) - You may request a copy of the personal data we hold about you and information about how it is used.
• Right to rectification (Art. 16) - You may ask us to correct inaccurate or incomplete personal data. You can also update your name and email directly in your profile.
• Right to erasure / "right to be forgotten" (Art. 17) - You may request deletion of your personal data. Account deletion is available in the app and erases your account and associated data immediately (an in-app button is being added; until then, deletion can also be requested at privacy@sermonbridge.com). Church owners and admins can delete a service's text themselves once the service has ended (see Section 7).
• Right to data portability (Art. 15/20) - You can download a copy of your personal data as a JSON file via the app (GET /api/auth/export-data). You may also contact us at privacy@sermonbridge.com to request a data export.
• Right to restriction of processing (Art. 18) - Under certain circumstances, you may ask us to restrict how we process your data while a dispute is resolved.
• Right to object (Art. 21) - You may object to processing carried out on the basis of legitimate interests. We will cease that processing unless we have compelling legitimate grounds that override your interests.
• Right to withdraw consent (Art. 7(3)) - Where processing is based on consent (in particular, the storage of church membership records that reveal religious affiliation), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Congregation members who are not account holders (e.g. viewers who join a session without creating an account) should direct rights requests to the church that operates the session. The church is the data controller for those individuals.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• All data in transit is encrypted using TLS 1.2 or higher.
• Passwords are hashed using bcrypt with an appropriate work factor; plaintext passwords are never stored or logged.
• Authentication tokens are signed JWTs set as HttpOnly, Secure cookies.
• Database access is restricted to application servers within the private network; it is not exposed to the public internet.
• Infrastructure is hosted on ISO 27001-certified Hetzner facilities in Germany.
• Database backups are encrypted before they leave our server. The key needed to read them is never given to the storage provider and is kept off our server, except briefly while we restore a backup.

No system is perfectly secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, affected individuals without undue delay.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you by email (if you have an account) and update the "effective date" at the top of this page. Continued use of the service after the effective date of an updated policy constitutes acceptance of the changes.

Previous versions of this policy will be made available on request.

12. Contact and Complaints

For all privacy-related questions, data subject requests, or concerns, please contact our privacy point of contact:

Supervisory authority

You have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (AP):

We always prefer to resolve concerns directly. We encourage you to contact us first before filing a complaint with the supervisory authority.