We use customer information to run accounts, payments, support, and the integration. We do not sell personal information or use church-submitted content for advertising. Your church controls what its WordPress site and connected Planning Center account collect and publish.
1. Scope and privacy roles
This Privacy Policy explains how PCO Bridge, a company based in Washington State (“PCO Bridge,” “we,” “us,” or “our”), processes personal information through pcobridge.io, customer accounts, checkout, support, the hosted server, connection and update services, and the PCO Bridge WordPress plugin (together, the “Service”).
For account, billing, marketing-list, website, and direct support information, PCO Bridge determines why and how the information is processed.
For information a customer sends from its WordPress site or connected Planning Center account through the hosted server (“Church Data”), the customer controls the purposes and means of processing. PCO Bridge processes Church Data on the customer's behalf to provide, secure, and support the Service. Questions or requests about Church Data should usually go first to the church or organization that collected it.
This Policy does not govern a customer's own website, WordPress host, Planning Center account, forms, or other third-party services.
2. Information we process
Information you provide
- Account information: email address, display name, organization name, membership and role, email-verification status, and the date and version of legal terms accepted.
- Billing and transaction information: selected plan, billing period, organization, optional site URL, transaction amount and currency, payment and subscription status, and identifiers received from Stripe. Stripe collects payment-card and billing details on its checkout page; we do not receive full card numbers.
- Beta applications: your name, email address, optional organization and website, the platform or tech stack your website uses. We use these details to review your application and contact you about beta access and next steps.
- Support information: topic, message, website URL, account details, and any diagnostic log or other information you choose to send.
- Communications preferences: release-email opt-in and, before launch, an email address submitted for a launch announcement.
Information received from the plugin and connected services
- Connection information: account and tenant identifiers, connection status, site URL and environment, plugin version, timestamps, and usage counts.
- Planning Center connection information: authorized scopes, Planning Center user and organization identifiers and identity information, and encrypted OAuth access and refresh tokens.
- Church Data transmitted through the hosted server: requests and responses needed to synchronize selected groups, meetings, locations, images, tags, campuses, enrollment, and similar records. When form feeds are enabled, transmitted data can include names, email addresses, phone numbers, mailing addresses, birthdates, form answers, prayer requests or other notes, custom fields, and Planning Center person and workflow-card identifiers.
The hosted server transmits Church Data between the customer-controlled WordPress site and Planning Center. We do not intentionally store the content of those requests and responses in our account or metering databases, but our infrastructure providers may process request metadata and transient content to deliver and secure the Service. The plugin durably stores allowlisted form answers and delivery progress in a queue in the customer's WordPress database until processing or plugin uninstall. It can also write those answers into Planning Center workflow notes and person records. Those WordPress and Planning Center copies remain under the customer's control and retention settings.
Information collected automatically
- Connection and security data: IP address, request time, requested route, response status, browser or device headers, and security events that our hosting provider or Service may process for delivery, abuse prevention, rate limiting, debugging, and security.
- Authentication data: session tokens, secret keys, and connected-provider credentials. Where our databases retain these credentials, we generally store a cryptographic digest or encrypted value rather than the raw token.
- Usage and reliability data: request identifiers, module, billing period, counts, rate-limit state, error type, and operational timestamps.
3. How we use information
We use personal information to:
- create and authenticate accounts and send magic links;
- provide the hosted server, synchronization, form-delivery, connection, download, update, and account features;
- process purchases, renewals, cancellations, refunds, taxes, and subscription status;
- enforce site and usage limits and prevent replay, fraud, abuse, and unauthorized access;
- answer support requests, diagnose errors, maintain reliability, and improve Service functionality and safety;
- send transactional, security, billing, and Service notices and communications you request;
- send release or launch messages when you opt in, with an unsubscribe method;
- comply with law, enforce agreements, and establish, exercise, or defend legal claims; and
- create aggregated or deidentified operational information that cannot reasonably identify a person or customer.
Where a law requires a legal basis, we rely as applicable on performance of a contract, our legitimate interests in operating and securing the Service, consent, and compliance with legal obligations.
4. How we disclose information
We disclose information only as reasonably needed for the purposes above:
- Cloudflare provides hosting, network delivery, database, object-storage, rate-limiting, and email infrastructure, and the Turnstile security check on our beta application form, which uses browser and device signals to tell people from automated submissions.
- Email delivery and inbox providers transmit magic links, notices, and support requests and retain messages under their own operational and account settings.
- Stripe hosts checkout and processes payments, subscriptions, refunds, tax information, and related fraud controls.
- Planning Center provides OAuth authorization and receives or returns Church Data as directed by the customer.
- Google Fonts may receive connection information such as an IP address and browser headers when a browser requests the fonts used on our public pages.
- Professional advisers and authorities may receive information when reasonably necessary for accounting, insurance, legal advice, audits, legal process, safety, security, or enforcement.
- A successor or transaction participant may receive information as part of a proposed or completed financing, merger, acquisition, reorganization, bankruptcy, or transfer of all or part of the business, subject to appropriate confidentiality protections.
Information you direct the plugin to store in WordPress or Planning Center is also available to the administrators, hosts, plugins, integrations, and other recipients you authorize in those systems.
No sale or targeted advertising
We do not sell personal information for money, share it for cross-context behavioral advertising, or use Church Data to advertise to individuals. We do not knowingly allow third parties to collect personal information through the Service for their own cross-site behavioral advertising.
6. Retention
We keep personal information only as long as reasonably necessary for the purposes described here, including to provide an account or subscription, maintain security and audit records, meet tax and accounting obligations, resolve disputes, and enforce agreements. Retention varies by record and legal requirement.
- Magic links expire after 15 minutes. Account sessions normally expire after 30 days and are configured not to exceed 90 days. Expired and revoked authentication records are periodically removed.
- Account, connection, billing, and transaction records generally remain while the account exists and afterward as needed for accounting, fraud prevention, disputes, and legal compliance.
- Plugin-owned private full-payload diagnostic files are automatically removed after seven days and can be cleared sooner by an administrator. Hosted infrastructure logs are subject to the retention configured in the hosting account; support records may remain longer as needed to answer the request, maintain a support history, and protect the Service.
- Hosted successful form-delivery content is removed after 30 days and terminal failed delivery content after 90 days. Pending, actively claimed, and operator-review deliveries remain until resolved. Payload-free operator resolution audits remain for 365 days.
- Launch-list records remain until the announcement is sent, you unsubscribe, or the list is retired. An unsubscribe record may be kept so the address is not re-added accidentally.
- Planning Center OAuth tokens and hosted-server installation records remain while the integration is connected or as needed to complete revocation, security, and legal obligations.
Customer-controlled Planning Center copies are subject to the customer's settings and retention practices, not ours. The plugin automatically removes successful local form queue rows after 30 days and terminal failed rows after 90 days, while preserving outstanding or review work. Uninstalling the plugin removes its form-delivery queue, plugin-owned diagnostic trace files, and operational settings. Synchronized WordPress posts remain unless the customer selects the plugin's purge-on-uninstall option. Deletion from active systems may not immediately remove limited copies from backups or records we must retain.
7. Security
We use administrative, technical, and organizational safeguards designed for the nature of the information we process. Current measures include encrypted network connections; encryption of Planning Center OAuth tokens and recoverable connection credentials at rest; cryptographic digests for magic links, sessions, installation tokens, and other credentials where practical; scoped cookies; request-size and rate limits; and redaction of sensitive fields from ordinary plugin logs.
Where we process Church Data on a customer's behalf, the data processing terms in the Terms of Service describe our instructions, confidentiality, subprocessor, assistance, incident-notice, and deletion obligations.
No service, transmission, or storage method is completely secure. We cannot guarantee that information will never be accessed, lost, altered, or disclosed without authorization. Customers should minimize sensitive form fields, restrict administrator access, review diagnostics before sending them to support, maintain backups, and promptly apply updates.
8. Your choices and privacy rights
You can:
- decline optional release or launch emails and use the unsubscribe method in those messages;
- sign out to revoke the current account session;
- disconnect the plugin, revoke a site assignment, or ask us to close an account;
- ask to access, correct, delete, or receive a copy of personal information we control; or
- object to or restrict certain processing, withdraw consent for future processing, or appeal a privacy-request decision where applicable law provides that right.
Send a request to hello@pcobridge.io from the relevant account email and describe your request. We may need to verify identity and authority. We will respond as required by applicable law. We will not discriminate against you for exercising a privacy right.
If the information came through a church's website, form, or Planning Center account, contact that church first. We will assist our customer with a verified request when legally required and technically feasible, but the customer decides how Church Data should be handled.
Authorized agents may submit requests where permitted by law. We may ask for proof of authorization and may verify the request directly with the individual.
9. International use
PCO Bridge is operated from the United States, and we and our service providers may process information in the United States and other countries. Those countries may have different data-protection laws. A customer using the Service to process information protected by international transfer rules is responsible for determining whether additional terms or safeguards are required and should contact us before submitting that data.
10. Children
The Service and customer accounts are for organizations and adults and are not directed to children under 13. We do not knowingly collect personal information directly from a child under 13 through pcobridge.io.
A church may choose to process information about children in its own WordPress forms or Planning Center account. In that situation, the church is responsible for parental notices and consent, appropriate permissions, data minimization, and all other legal requirements. Do not allow a child to submit information directly to PCO Bridge support or account features.
11. Changes to this Policy
We may update this Policy as the Service or law changes. We will post the revised Policy here and change the date above. If a change materially affects how we use information already collected, we will provide additional notice or request consent where required by law.
12. Contact us
For privacy questions or requests, email hello@pcobridge.io. Please do not include secret keys, passwords, full payment-card information, or sensitive Church Data in an ordinary email.