Privacy

• A church’s roster belongs to that church. We hold it to send their mail.
• We do not sell anything to anybody, and there is no advertising here.
• There is no analytics script on any page of this app. No third party is watching you use it.
• Unsubscribing works immediately, and we never bill a church for someone who left.

For the account itself, we hold:

• Your name, email address, and a hashed password — never the password itself.
• Your church’s settings: its name, mailing address, sending identity, brand, and the newsletters and templates you make.
• Billing details: which plan tier your list puts you on, invoices, and the last four digits and expiry of the card. The card number itself never reaches our servers — it is typed into a form Stripe serves and goes straight to them.
• Basic server logs, kept briefly, for security and for working out why something broke.

For contacts, the church decides what is held and why; we hold it on their behalf and act on their instructions. That is: an email address, a name if the church has one, which lists they are on, whether they are subscribed, and a record of the newsletters sent to them.

If a church connects Planning Center, we read its people and lists to keep the roster in step. We only ever read — nothing is written back to Planning Center, ever.

A church can see whether a newsletter was opened and which links were clicked. That works through a small invisible image and links that pass through us on the way to where they are going. Both are counted as people rather than events, so opening the same email twice is one open.

A church can switch either off in its settings, and when it does, we stop — the image and the redirect are simply not put in the email. The public archive copy of a newsletter never carries either, because a public page has no particular reader to record.

Only the companies that make the product work, each doing one job:

• Resend — delivers the email, and tells us when one bounces or is marked as spam.
• Stripe — takes the payment and holds the card. We never see the card number.
• Planning Center — only if a church connects it, and only read.
• Google — only if somebody chooses “Continue with Google” to sign in.
• [hosting and database provider] — runs the servers the data sits on.

We will also hand something over if the law actually requires it. If a court asks us for a church’s data, we will tell that church unless we are forbidden to.

Only the ones that keep you signed in and protect the sign-in form from being submitted from somewhere else. No advertising cookies, no tracking cookies, and nothing that follows you to another site — which is why this app has no cookie banner to click away.

Account and roster data is kept while the account is open. Close the account and ask us to delete it, and we will. Sent newsletters and the delivery records behind their reports are kept while the account is open, because a report about a send that no longer has any record of it is not a report.

Backups roll off on their own schedule, so deleted data can persist in a backup for a short period after it is gone from the app.

You are here because a church sent you a newsletter through Butter. Your relationship is with that church: they chose to hold your address, and they decide what is on their list.

• To stop the emails, use the unsubscribe link at the bottom of any newsletter, or the unsubscribe button your mail app shows beside the sender’s name. It works immediately and you do not have to explain yourself.
• To see, correct, or delete what is held about you, ask the church — it is their roster. Write to us at support@butterhq.com if you cannot reach them or they do not act, and we will help.
• Depending on where you live you may have further rights over your data — to a copy of it, to have it corrected, or to object to it being held at all. We will honour them. [confirm which regimes apply]

Butter is not meant for children to sign up to. If a church holds a young person’s address, that is between the church and their family, and the usual rules about a parent’s permission apply to them rather than to us.

If we change something that matters, we will email the billing contact on each account before it takes effect. For anything on this page, write to support@butterhq.com, or to [legal entity name, registered address].