ServiceReef, LLC ("ServiceReef," "we," "our," or "us") provides a software platform that helps churches, schools, and non-profit organizations manage service and mission trips, participant registration, and fundraising. This Privacy Policy explains how we collect, use, share, and protect personal information through servicereef.com, the ServiceReef platform, and our mobile applications (together, the "Services"), and the choices and rights available to you.

1. Our role

ServiceReef handles personal information in two capacities:

• As a service provider (processor) to our clients. When a church, school, or other organization (a "client" or "account owner") uses the Services to manage trips and donations, the client decides what information to collect about its participants and donors and how it is used. ServiceReef processes that information only on the client's behalf and according to its instructions. The client is the data controller (or "business") for that information.
• As a controller. ServiceReef decides how to use information about our clients' account administrators, visitors to our website, and people who contact us. For that information, ServiceReef is the data controller.

If you are a trip participant or donor and have questions about how your information is used, please contact the organization that invited you to register or donate. We will assist that organization in responding to you.

2. Information we collect

2.1 Information account owners provide about themselves

When an organization signs up for the Services, we collect:

• Contact information: name, email address, mailing address, and phone number.
• Organizational information: organization name and address.
• Account information: username, account number, and password (stored only in hashed form).
• Billing information: billing contact and address. Payment card details are entered directly into our payment processor's secure payment fields and are never received or stored by ServiceReef (see Section 2.6).

2.2 Information account owners provide about trip participants and donors

Account owners and their authorized users may add or import information about trip participants, donors, and other end users, including contact information, demographic information (such as age, education, and gender), and account identifiers. ServiceReef treats this information as confidential and uses it only to provide the Services to the account owner.

2.3 Information trip participants provide about themselves

Account owners may ask trip participants to register or update their information on the platform. At a minimum, participants provide their first name, last name, and email address. Depending on the account owner's registration forms, participants may also provide contact information, demographic information, emergency contacts, travel details, and other information the account owner requests.

2.4 Information donors provide about themselves

When you make a donation through the Services, we collect your contact information (name, email address, mailing address, and phone number) and the donation amount, date, and designation. This information is stored for use by the account owner receiving the donation. Payment card and bank details are handled as described in Section 2.6.

2.5 Sensitive information

Account owners control the questions on their registration forms and may choose to collect information that is considered sensitive under some laws, such as health or dietary information needed for safe travel, or information that may indicate religious affiliation. ServiceReef classifies this information at its highest sensitivity level and protects it accordingly. Account owners are responsible for collecting sensitive information only where necessary and with any required consent.

2.6 Payment information

Payments and donations are processed by our payment processors, Stripe and Pushpay. Card and bank details are entered directly into their secure, hosted payment fields and sent straight to the processor; they are never received, transmitted through, or stored on ServiceReef's systems. We receive only confirmation of the transaction (such as amount, date, status, and the last four digits of the card). Please review the privacy policies of Stripe (stripe.com/privacy) and Pushpay (pushpay.com/legal-center/privacy) for how they handle your information.

2.7 Information collected automatically

When you use the Services, we and our service providers use cookies and similar technologies to collect:

• Device and browser information: device type, browser type, and operating system.
• Log information: IP address, pages visited, referring and exit pages, and date and time of access.
• Usage information: how you interact with the Services.
• Approximate location: general location derived from IP address.

We use this information to operate, secure, and improve the Services. See Section 10 for details on cookies and analytics tools.

3. How we use personal information

We use personal information to:

• Provide, maintain, and support the Services for account owners and their users.
• Authenticate users, secure accounts, and detect and prevent fraud and abuse.
• Process registrations, payments, and donations through our payment processors.
• Communicate with users about their accounts, trips, and the Services.
• Analyze usage trends to improve the platform and its features.
• Comply with legal obligations and enforce our agreements.

Where data protection laws such as the GDPR apply to information we control, we rely on the following legal bases: performance of our contract with you; our legitimate interests in operating, securing, and improving the Services; compliance with legal obligations; and, where required, your consent. For information we process on behalf of account owners, the account owner determines the legal basis.

We do not sell personal information. We do not use trip participant or donor information for our own marketing, and we do not share it with third parties for their marketing purposes.

4. How we share personal information

4.1 Service providers (sub-processors)

We share personal information with service providers that help us operate the Services. They may use it only to provide services to ServiceReef and are bound by contractual confidentiality and data protection obligations. Our current service providers include:

Provider	Purpose
Microsoft Azure	Cloud hosting, databases, and storage (United States)
Cloudflare	Content delivery, DNS, and security
Stripe and Pushpay	Payment and donation processing
Google Analytics	Website and platform usage analytics
Raygun	Application error monitoring
Freshdesk	Customer support ticketing
Google Workspace	Business email and communications

 

Account owners may request notice of changes to this list by contacting us.

4.2 Legal requirements and protection of rights

We may disclose personal information if required by law, such as in response to a subpoena, court order, or lawful request by public authorities, including to meet national security or law enforcement requirements. We may also disclose information when we believe in good faith it is necessary to protect our rights, investigate fraud, protect the safety of any person, or enforce our Terms of Service. Where permitted, we will notify the affected account owner of such requests.

4.3 Business transfers

If ServiceReef is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy.

4.4 Aggregated and de-identified information

We may use and share information that has been aggregated or de-identified so that it no longer identifies any individual, for example in statistical reports.

4.5 With your consent

We may share personal information for other purposes with your consent or at your direction.

5. International data transfers

ServiceReef is based in the United States, and the Services are hosted in Microsoft Azure data centers in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

Where we receive personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our agreements with account owners where required. You may contact us for more information about these safeguards.

6. How we protect personal information

ServiceReef maintains administrative, technical, and organizational safeguards designed to protect personal information, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256).
• Multi-factor authentication and role-based, least-privilege access for ServiceReef personnel.
• Restricted, IP-limited access to production databases.
• Continuous threat monitoring of our hosting environment.
• Encrypted backups and documented incident response procedures.
• Security and privacy training for all personnel at onboarding and annually.

No method of transmission or storage is completely secure. If we become aware of a security incident affecting personal information, we will notify affected account owners without undue delay and, where required by law, affected individuals and regulators.

7. Data retention

We retain personal information for as long as an account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Account owners control the participant and donor information in their accounts and may delete it at any time. When an account owner closes its account or asks us to delete data, we delete it from active systems within a reasonable period; residual copies in encrypted backups are deleted as backups expire, generally within 180 days. Some information may be retained longer where required by law, such as financial transaction records.

8. Your privacy rights

8.1 How to make a request

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. Account owners and users can update much of their information by logging into their accounts.

If your information was provided through a ServiceReef client (for example, as a trip participant or donor), please direct your request to that organization, which controls your information. If you contact ServiceReef directly, we will forward your request to the relevant organization and assist it in responding.

For information ServiceReef controls, contact us at [email protected]. We will verify your identity before responding and will respond within the time required by applicable law. You may use an authorized agent where permitted by law. We will not discriminate against you for exercising your privacy rights.

8.2 European Economic Area, United Kingdom, and Switzerland

If data protection law in these regions applies, you have the rights described above, as well as the right to withdraw consent at any time and to lodge a complaint with your local data protection authority.

8.3 U.S. state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws may have the right to know what personal information is collected, access and obtain a copy of it, correct inaccuracies, request deletion, and opt out of the sale of personal information, targeted advertising, or certain profiling. ServiceReef does not sell personal information or use it for targeted advertising. If we decline your request, you may appeal by replying to our decision, and we will respond within the time required by law.

9. Children and student information

The Services are not directed to children under 16, and we do not knowingly collect personal information directly from children under 16 outside of a client-managed registration.

Some account owners use the Services to register minors for youth trips. In those cases, the account owner is responsible for obtaining verifiable consent from a parent or legal guardian before submitting a minor's information, and ServiceReef processes that information only on the account owner's behalf. If you believe a child's information has been provided without appropriate consent, contact us at [email protected] and we will work with the account owner to address it.

Student records (FERPA). Where a school uses the Services, information from student education records is processed on the school's behalf and under its direction, and is not used or disclosed for any other purpose. Schools are responsible for obtaining any consent required under the Family Educational Rights and Privacy Act (FERPA) before providing student information to ServiceReef.

California minors. California residents under 18 may request removal of content they have publicly posted on the Services by emailing [email protected] with the subject line "California Eraser."

10. Cookies and analytics

We use cookies that are necessary for the Services to function (for example, to keep you signed in) and analytics tools to understand how the Services are used:

• Google Analytics collects usage information through cookies. We do not combine Google Analytics data with personally identifiable information. You can opt out using the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. See policies.google.com/privacy/partners for how Google uses this information.
• Raygun logs application errors to help us fix problems and improve reliability. See raygun.com/privacy.

You can control cookies through your browser settings, but disabling necessary cookies may prevent some features from working.

11. Questions and complaints

If you have a question or complaint about our privacy practices, please contact us using the details in Section 13. We will investigate and respond promptly. If you are in the EEA, UK, or Switzerland, you may also contact your local data protection authority.

12. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will post the updated policy on this page with a new effective date and, for material changes, notify account owners by email or through the Services.

13. Contact us

ServiceReef's Security Officer is responsible for our privacy program. Contact us at:

Email: [email protected] (Attention: Privacy)