Prepara — Privacy Policy
Last updated: August 10, 2026
DRAFT — NOT YET LEGALLY REVIEWED. This document is a working draft prepared for internal review and for gathering feedback from prospective users. It must be reviewed by a licensed attorney before Prepara accepts payment or before any organization relies on it. Bracketed items require completion.
1. Introduction
This Privacy Policy explains how [ENTITY NAME], a [STATE] limited liability company ("Prepara," "we," "us") collects, uses, stores, shares, and protects information in connection with the Prepara platform (the "Service").
Prepara is used by organizations — primarily churches and similar nonprofits — to document their operational readiness practices. This means the Service holds information that is often sensitive, including records relating to staff and volunteers. We treat it accordingly.
If you have questions, contact team@getprepara.com.
2. Who controls the information
Your Organization controls the information it puts into Prepara. Prepara stores and processes that information on your Organization's behalf and at its direction.
We do not decide what your Organization uploads, who it shares a portfolio with, or how long it keeps records. Those decisions are the Organization's. Our role is to hold and process the material so the Service can function.
Where required by law, this makes your Organization the data controller and Prepara the data processor with respect to the material you submit.
3. Information we collect
3.1 Account information
When an account is created, we collect: the email address used to register, an encrypted representation of the password (we never see or store the password itself), the organization name, and basic account timestamps.
3.2 Assessment and readiness information
Answers your Organization provides in the readiness assessment, the resulting scores, improvement roadmap items and their completion status, and the standard operating procedures you draft using our templates.
3.3 Documents and files you upload
Files your Organization uploads to the Evidence Vault or attaches to records — along with any title, description, category, and dates you provide.
These files may contain sensitive personal information about individuals, including background-check results, certifications, training records, and personnel details. We do not inspect, analyze, index the contents of, or otherwise read the documents you upload. They are stored so that you can retrieve and organize them.
3.4 Organizational records
Information you enter about insurance policies (carrier, policy number, coverage types, premium, dates, broker contact details), personnel (names, roles, certifications, background-check status and dates, group assignments), and equipment (type, location, condition, inspection dates).
3.5 Technical information
Standard information generated by using a web application: IP address, browser and device type, and timestamps of requests, retained by our infrastructure providers for security, debugging, and abuse prevention.
We do not currently use analytics, advertising, or behavioural-tracking tools on the Service. If we introduce analytics in future, we will update this Policy and describe what is collected before doing so.
3.6 Payment information
Prepara is currently free. When paid subscriptions are introduced, payment card details will be handled directly by a third-party payment processor. Prepara will not receive or store full card numbers. We will receive only limited transaction information, such as whether a payment succeeded and the last four digits of a card.
4. How we use information
We use information to:
- provide, operate, secure, and support the Service;
- authenticate users and protect accounts;
- generate scores, roadmaps, calendars, portfolios, and archives at your direction;
- send transactional emails (account confirmation, password reset, service notices);
- respond to support requests;
- diagnose problems, prevent abuse, and improve reliability and functionality;
- comply with legal obligations.
We do not sell your information. We do not share it with advertisers. We do not use the contents of your uploaded documents for marketing, and we do not use them to train machine-learning models.
5. Aggregated and de-identified data
We may create aggregated, de-identified statistics from use of the Service — for example, the average readiness score across organizations, or how frequently a particular practice is documented — and use them to improve the Service, publish benchmarks, and support research and marketing.
Aggregated data will never identify your Organization, any individual, or the contents of any document. It is produced and presented only in a form that cannot reasonably be traced back to a specific organization or person. We will not publish your Organization's individual score or any of its documents.
6. Who we share information with
We share information only in the circumstances below.
6.1 Service providers who operate the platform
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database, authentication, and file storage | All account data, records, and uploaded documents |
| Vercel | Application hosting and delivery | Requests to the Service; technical logs |
| Email delivery provider | Sending transactional email | Email addresses and message contents (account confirmation, password reset) |
| Payment processor (when paid plans launch) | Processing subscriptions | Billing contact and transaction details; card data handled by them directly |
These providers process information on our instructions, for the purpose of operating the Service. They are not permitted to use it for their own purposes.
6.2 Integrations you choose to connect
The Service may allow you to connect third-party platforms your Organization already uses. If you connect one, you direct us to exchange data with it as needed for that integration. Once data reaches a third-party platform, that platform's own privacy practices govern it. We are not responsible for how a connected service handles data.
You control which integrations are connected and may disconnect them.
6.3 People you share with
When you generate a portfolio or export an archive, you decide who receives it. Anything you send to a broker, board member, or other recipient is outside our control from that point on. The Service provides curation controls so you can choose what to include, exclude, or mark as available on request.
6.4 Legal requirements
We may disclose information where required by law, subpoena, or court order, or where we reasonably believe it necessary to protect the rights, safety, or property of Prepara, our users, or the public. Where permitted, we will notify the affected Organization first.
6.5 Business transfer
If Prepara is acquired, merged, or sells substantially all its assets, information may transfer as part of that transaction. We will give notice before your information becomes subject to a materially different privacy policy.
7. Where information is stored
Information is stored in the United States, in Supabase's us-east-2 region [and with hosting infrastructure operated by Vercel].
If you access the Service from outside the United States, you understand that your information will be stored and processed in the United States.
8. Security
We take reasonable measures to protect information, including:
- Row-level security in the database, so an organization's records are accessible only to that organization. This is enforced at the database level with per-operation policies, not merely in application code.
- Private file storage, with uploaded documents held in non-public storage accessible only through short-lived, signed links generated for authorized users.
- Encryption in transit (HTTPS) and encryption at rest as provided by our infrastructure providers.
- Passwords stored only as salted hashes; we never see or store passwords.
- Automated isolation testing run against the platform before changes ship, verifying that one organization cannot read, modify, or delete another's data.
No system is perfectly secure. We cannot guarantee absolute security, and you use the Service at your own risk. If we become aware of a breach affecting your information, we will notify you as required by law and without undue delay.
9. Retention and deletion
While your account is active, we retain your information and do not proactively delete it.
After cancellation or termination, we retain your information for 90 days, so you can export it or reactivate. After that period, it is deleted from active systems. Residual copies may remain in encrypted backups for a limited additional period before being overwritten in the ordinary course.
You may export your information at any time while your account is active.
Because we cannot guarantee the Service's indefinite availability, do not rely on Prepara as your Organization's only copy of any record you are required to retain.
10. Your choices and rights
You may:
- access and correct your Organization's information directly within the Service;
- export your information;
- delete individual documents and records, or close your account entirely;
- contact us at team@getprepara.com with any privacy question or request.
Depending on where you are located, you may have additional rights under law — including rights to access, correct, delete, or restrict processing of personal information, and to object to certain processing. We honour these rights where they apply. To exercise them, contact us at the address above; we will respond within the time required by applicable law.
Because much of the personal information in the Service concerns individuals whose Organization uploaded it — staff and volunteers, not our own users — requests from such individuals will generally be directed to the Organization that uploaded the information, which is the party that controls it. We will assist that Organization in responding.
11. Information about individuals who are not our users
Your Organization may upload information about staff, volunteers, and others who do not themselves use Prepara.
Your Organization is responsible for having a lawful basis to collect and store that information, and for giving those individuals any notice or obtaining any consent required by law — particularly for background-check results, which are frequently subject to specific legal requirements about how they are obtained, stored, disclosed, and destroyed.
Prepara processes such information only as directed by the Organization.
12. Children's information
The Service is not directed to children and we do not knowingly collect information from anyone under 18. Account holders must be adults acting on behalf of an organization.
Organizations may document practices relating to programs serving minors. Prepara should not be used to store personal information about individual children. If we become aware that information about a specific child has been uploaded, we may remove it and will contact the Organization.
13. Changes to this Policy
We may update this Policy. If a change is material, we will give reasonable notice — by email or through the Service — before it takes effect. The "last updated" date above always reflects the current version.
14. Contact
[ENTITY NAME] [BUSINESS ADDRESS] team@getprepara.com
For privacy questions, requests, or complaints, contact the Prepara management team at the address above.