Version 1.0. In effect from November 6, 2026. A church already using Sync stays under Sync’s own documents until it accepts these in the Hub, which it is asked to do from December 7, 2026.

Privacy Policy — wtxLabs Hub, Sync, Shield and Tend

This Privacy Policy ("Policy") applies to the wtxLabs Hub (hub.wtxlabs.com), wtxLabs Sync (sync.wtxlabs.com), wtxLabs Shield (shield.wtxlabs.com) and wtxLabs Tend (tend.wtxlabs.com) (together, the "Services"), and WTXLABS, LLC ("Company") and governs data collection and usage. For the purposes of this Policy, unless otherwise noted, all references to the Company include the Services. The Services are software as a service (SaaS). By using the Services, you consent to the data practices described in this statement.

Until a church that uses Sync accepts these documents in the Hub, Sync's own Privacy Policy at sync.wtxlabs.com/privacy applies to that church. This Policy does not cover:

wtxLabs Watch, our client portal, which has its own at watch.wtxlabs.com/privacy;
wtxlabs.com, our marketing website, which has its own at wtxlabs.com/privacy.

Whose information this is about. This Policy concerns information about the church staff and volunteers who sign in to the Services, and the church's billing contact. Shield and Tend also process information about the people in a church's Planning Center (members, volunteers and children). They do that for the church, under the church's Data Processing Addendum with us, which makes the church the controller and the Company its processor.

The short version

The Services read from the church's own Planning Center account. They never write to it.
The Hub stores no names. Its only stored personal detail is one billing email address per church. Names are looked up live from Planning Center and shown, never saved.
Tend stores no names, email addresses, phone numbers or addresses of anyone. It does store facts about people by their Planning Center id.
Shield stores screening and training status by Planning Center id, the names and email addresses of staff who sign in, and the name and email address on a training-export row it could not match to anyone (deleted 90 days after the row is resolved).
Sync stores the name and email address of the church staff who manage it, and a copy of the Planning Center records the church has marked public, refreshed about every fifteen minutes. It never receives member lists, attendance or form answers, and its embeds set no cookies on the church's website.
We do not sell data, share it for advertising, or use it to train AI. Only Sync's optional website analysis sends anything to an AI provider, and it sends the church's public website, never Planning Center data.
Everything is processed in the United States.

I. Collection of Your Personal Information

In order to better provide you with products and services offered, the Company may collect personally identifiable information, such as your:

First and last name
Email address
Planning Center person identifier In the Hub,

names are never stored and the only email address stored is the church's billing contact. Shield stores the names and email addresses of the staff who sign in to it. The tables below give the detail for each App.

We do not collect any personal information about you unless you voluntarily provide it to us. However, you may be required to provide certain personal information to us when you elect to use certain products or services. These may include: (a) registering for an account; (b) sending us an email message; (c) subscribing to a paid plan. Payment is taken by our payment processor and card details are entered on their pages; the Company never receives or stores your card number. To wit, we will use your information for, but not limited to, communicating with you in relation to services and/or products you have requested from us. We may also gather additional personal or non-personal information in the future. Bank details for ACH payments are entered on Stripe's pages too, and never reach us.

The Hub

What	From	Why
The church's Planning Center organization id and name	Planning Center, at set-up	To know which church an account belongs to
For each team member: their Planning Center person id, Hub role, app roles, and when they first and last signed in	Planning Center (the id) and the church's own choices in the Hub	Sign-in, and deciding who may use which App
Planning Center's own words about the signed-in person: their People permission (for example "Manager"), whether they are a site administrator, and whether they are active. Checked every 15 minutes while signed in	Planning Center, with the person's own login	To keep someone who has left, or lost access, from staying signed in
The signed-in person's own Planning Center login token, encrypted	Planning Center	To look up names live on the People & access page. Deleted when the session ends
Session records: a random session id, times, and keyed one-way codes derived from the IP address and browser (not reversible without our secret key)	The person's browser	Security, and to let a person sign out of other devices
One billing contact email address per church	Owner or Billing, in the Hub	Bills, failed-payment, trial and comp notices, and confirming important changes by email
Plan status, dates, and which Apps are on the plan	Stripe	To know what the church has paid for
Which version of each agreement was accepted, when, and by whom (as a Planning Center id)	The church, in the Hub	A record of what was agreed
An activity log of changes (ids and short codes, no free text)	The Hub	So the Owner, and wtxLabs staff, can see who changed what
Which alerts a person has cleared (ids and codes only)	The person	So a cleared alert stays hidden until it changes
A short daily "at a glance" line from each App: counts only (for example "3 people need action"), never a name or person id	Shield, Tend and Sync	To show it on the Hub's home page. Nothing older than 48 hours is shown

Card and bank details are entered on Stripe's pages and never reach us. Stripe also holds the church's name, billing email address, billing address and any tax id collected at checkout.

Emails the Hub sends (through Amazon Simple Email Service):

to the billing contact: bills, trial reminders, failed-payment and comp notices, and confirmation links;
to the Owner, about an ownership change, using an address fetched live from Planning Center and not stored;
to a person newly added to the team, a welcome with a sign-in link, using an address fetched live from Planning Center, used once and not stored;
when turned on, to the person a team member asks to do a step (for example the Owner), using an address fetched live and not stored.

Confirmation links are single-use and expire (15 minutes to 72 hours).

Help requests (when turned on). A person can ask wtxLabs for help from the Hub, Shield or Tend. The request (topic, message, name and email address, and the church and person ids if signed in) is not stored by the Hub, Shield or Tend. It is sent straight to Watch, our own support and client system, which records it as a support request, and the person gets a confirmation email. A request from a church that is not a wtxLabs client is kept for up to 12 months after it was last active, unless the church becomes a client in that time. A request from a church that is a client becomes part of that client's record, and is kept for as long as the client relationship and our records require. Email sent to wtxLabs support is handled the same way: Watch keeps only its sender, recipients, subject and a short snippet (never the body or attachments), for up to 12 months unless it belongs to a client's record.

Anonymous visit counting (when turned on). On the signed-out pages of the Hub, Shield and Tend, we count visits and button clicks. We keep the page address (without personal details), the event, the referring site's name, the kind of device (desktop or phone) and a code that changes every day and cannot be reversed. We keep no IP address, browser details, cookie or name. We record nothing from bots, or from visitors whose browser sends Do Not Track or Global Privacy Control. Records are deleted after 90 days.

wtxLabs staff. A small number of wtxLabs staff can open a staff console to support churches, send invitations, grant comps and review records. Every staff action is logged. The console requires the staff member to have two-step verification turned on in Planning Center. The Hub checks that live and does not store it.

The Watch link. If the church is also a client of our services, we may link its Hub account to its Watch client record. The Hub then tells Watch the church's name, its Stripe customer id, and which Apps it has, with their status and trial end. Watch tells the Hub its portal address and its own record id. When the Watch portal is opened through the Hub (when turned on), the Hub tells Watch the person's Planning Center id, name and email address, read live from Planning Center at that moment and not stored by the Hub. Watch's own Privacy Policy covers what Watch keeps.

Sync

This Policy concerns information about you, the church administrator who connects and manages an account. It is not about the visitors to your website: the embeds the Company serves set no cookies and send the Company nothing about the people who view them. The only thing an embed stores in a visitor's browser is which announcements that visitor has dismissed, kept on the church's own site and never transmitted to the Company.

Separately from the personal information above, the Company copies the Planning Center records your church has already marked as public, for example events with open signups, group listings and sermon media, in order to display them on your website. Those records are refreshed automatically about every fifteen minutes, are held only as a cache for that purpose, and are deleted when you disconnect Planning Center. Some of those records contain personal information about members of your congregation: a contact email address for a group, and the names of sermon speakers. The Company does not receive lists of the people who attend events or belong to groups, and does not receive the answers submitted to any form.

What	From	Why
The name, email address and Planning Center person id of each staff member who manages Sync	Planning Center, at sign-in	Sign-in, account notices and support
Public records: events, groups, registrations, sermons and media, form listings, fund names, announcements and setlists, as the church marked them public	Planning Center	To show them on the church's website
A group's location, as the church's Planning Center display preference allows: the exact address only if the preference is "exact", "City, ST" only if "approximate", nothing if "hidden"	Planning Center Groups	To show it on the church's website
The page address on the church's own site where an embed runs, with the query string removed	The embed	To show the church where its embeds are installed
The church's own design settings for its embeds	Staff, in Sync	To style the embeds

Because an embed is served from sync.wtxlabs.com, a visitor's browser sends our server its IP address and browser details, as it would to any web server. We do not use them to identify or profile visitors. When an embed fails to show, a report of what failed and the page path (without the query string) is sent to us, never who was viewing. When a visitor submits a form or makes a payment, Planning Center's own page opens over the church's page and the submission goes straight to Planning Center, never through us.

Shield

Shield reads the church's Planning Center with the access of the one staff member the church nominates (the "sync account"), every night and when someone presses Refresh.

What	From	Why
Background checks: status, whether current, completion and expiry dates, and, for Protect My Ministry checks, Protect My Ministry's sub-status and order id	Planning Center's Background Checks. Checks run by Protect My Ministry and by Planning Center's own checks (provided by Checkr) both appear here	To show who is cleared, expiring or stalled
Child safety training: status, dates and the training order id	Planning Center notes in the church's training category and its training custom field (the note text is read and discarded), or a Protect My Ministry training export the church uploads	To show who is trained
About each person: Planning Center's child flag, active status and the church's membership word	Planning Center People	To leave children out of adult figures, and to apply the church's rules
Serving: who is on each Services team, and the latest and next dates they are scheduled	Planning Center Services	To find people serving without a check or training
Possible duplicates: pairs of person ids only	Worked out from names read in memory and not kept	To suggest profiles that may be one person
Unmatched training-export rows: the name and email address on a row that matched nobody	The uploaded export	So a staff member can match it by hand
Staff who may sign in: name, email address and role	Planning Center, at each sign-in	Sign-in and access. Under the Hub, the Hub sends ids and roles only, and the name and email are added when the person first signs in
Daily counts (how many cleared, expiring, serving without a check, and so on)	Worked out by Shield	Trends over time
Reconcile review marks: who marked an item reviewed, and when (ids only)	Staff	So a reviewed item stops raising the alert
The church's own screening set-up: provider, rescreen interval, whether training expires, whether a minor's clearance runs to 18	Staff, or detected from the church's own checks	To state the church's own policy back to it

What Shield never takes. Shield does not connect to Protect My Ministry or Checkr. It never reads or stores a background-check report, the link to one, a score, a certificate or its link. Names shown on screen are fetched live with the viewer's own Planning Center login and never stored, except in the two cases in the table: staff, and unmatched export rows.

Tend

Tend reads the church's Planning Center with the sync account's access, every night and on Refresh. Other staff members' own Planning Center logins are used only to show names. Tend reads People, and each other Planning Center product the church turns on in Tend (Services, Check-Ins, Registrations, Groups, Calendar, Giving, Publishing, and any product Planning Center adds). Not every row below applies to every product; Tend's Settings show which products it reads.

What	From	Why
About each person in the directory, including children: Planning Center status, the church's membership word, child flag, household and campus ids, record dates, and how many usable email addresses, phones and addresses they have (never the details)	Planning Center People	Data-health findings, such as "can't be reached" or "no household"
Values of the custom fields the church chooses to track (dates, yes/no and choices only) and a history of changes to these facts	Planning Center People	Pathway and data-health figures
Match keys: keyed one-way codes of a normalised email address, phone number and surname-plus-initial, not reversible without our secret key	Worked out in memory from details that are then discarded	To find likely duplicates without storing contact details
Likely-duplicate pairs, and staff decisions about them (ids and reason codes)	Worked out by Tend, and staff	Duplicate review
Engagement: which person checked in, was scheduled to serve (and whether they accepted), submitted a form the church marked, registered for a signup, or belongs to or attended a group, on which day, and for which event or group. Includes children's check-ins and group attendance	Planning Center Check-Ins, Services, People forms, Registrations and Groups, only where the church turns them on	Engagement figures
Giving, off unless an Admin turns it on: whether a person has given, and the date of their most recent gift. Never an amount, a fund, a giving history or a payment method	Planning Center Giving	Finding donor records to fix, such as a likely duplicate whose gifts are split, or gifts on a child's or inactive record. Shown as counts, except on the cleanup list that names the record
Setup (Cleanup): the church's own labels for its setup, such as forms, lists, workflows, custom fields, check-in events, signups, service types, teams, groups, calendar events and requests, rooms and resources, giving funds and campaigns, and publishing channels, with dates, counts and yes/no facts only (for example when a form was last used, or how many members and leaders a group has). Never who is in them	The Planning Center products the church turns on	Finding setup that has gone stale
Access & permissions: for people with any Planning Center access, whether they are an organization or billing administrator, active, and able to log in; whether two-step verification is on; their permission level in each Planning Center app (for Giving and Groups, the level of access only); their last Services sign-in; and whether the account looks shared	Planning Center People (and Services, if used)	A review of who can see the church's data
Counts, monthly reports, and the church's own labels and settings	Worked out by Tend, and staff	The dashboard
Staff who may sign in: Planning Center id and role only	The Hub, or Tend's own list	Sign-in and access

What Tend never takes. Names, email addresses, phone numbers, street addresses and household names are read into memory for one page and discarded. Tend never reads notes, background checks, messages, form answers, a list's results, a workflow's cards, check-in medical or emergency-contact details, or payment details. From Giving it takes at most whether a person has given and the date of their most recent gift, and only if an Admin turns Giving on in Tend; never an amount, a fund, a giving history or a payment method. Names are shown live, only to Managers and Admins, with their own Planning Center access. Viewers see figures only, and any group of 1 to 4 people reads "fewer than 5".

II. Use of your Personal Information

The Company collects and uses your personal information in the following ways:

to operate and deliver the services you have requested.
to provide you with information, products, or services that you request from us.
to provide you with notices about your account.
to carry out the Company's obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
to notify you about changes to the Services or any products or services we offer or provide through them.
to maintain the security of the Company's services and prevent fraud or misuse.
to comply with applicable laws, regulations, legal processes, or governmental requests.
to create and authenticate the user's account, operate and support the service, communicate about the account, and bill the subscription.
in any other way we may describe when you provide the information.
for any other purpose with your consent

The Company may also use your personally identifiable information to inform you of other products or services available from the Company and its affiliates.

The Company does not sell, rent, or lease its customer lists to third parties.

The Company does not sell biometric data to third parties.

The Company shares data only with the service providers necessary to operate the Services, and only to the extent each requires. Those providers are: Amazon Web Services (application hosting and compute, scheduled jobs, secrets storage, application logging, encrypted file storage, and delivery of transactional and support email); Neon (database hosting); Stripe (subscription billing, used by the Hub only — card and bank details are submitted directly to Stripe and are never received or stored by the Company); and Anthropic PBC (Sync's optional website-analysis feature described below). The Company does not use analytics providers, advertising networks, or third-party error-monitoring services.

Website analysis feature. Sync offers an optional feature that analyzes the design of a web address you supply, so that embedded content can be styled to match your existing website. When you use this feature, the publicly accessible content of that web address is transmitted to Anthropic PBC for processing. No Planning Center data is sent to Anthropic. The Company processes that content only for the purposes described in the Terms of Service and uses the privacy and data-use controls available under its agreement with that provider. The Company will not independently use your personal information or AI-generated output to train a general-purpose artificial-intelligence model.

Planning Center is the church's own system and the source of the data, not the Company's sub-processor. GitHub holds the Services' source code and runs their tests. It holds no church data.

All such third parties are prohibited from using your personal information except to provide these services to the Company, and they are required to maintain the confidentiality of your information.

The Company may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Company or the site; (b) protect and defend the rights or property of the Company; and/or (c) act under exigent circumstances to protect the personal safety of users of the Company, or the public.

Where data is processed. All processing is in the United States. The Hub's and Sync's hosting, email and databases are in AWS US East 1 (Northern Virginia). Shield's database is in AWS US East 2 (Ohio). Stripe processes in the United States, with transfers to Stripe affiliates and sub-processors in other jurisdictions as provided in Stripe's own data processing agreement.

IV. Opt-Out of Personal Information to Third Parties

To the extent the California Consumer Privacy Act applies to the Company, the Company does not sell or share personal information as those terms are defined under that Act, and has not done so in the preceding twelve months. The Company does not sell or rent your personal information to any third party. Because the Company does not sell or share personal information, there is no opt-out to exercise. If you believe your personal information has been sold or shared, or you wish to make any other request under the CCPA, contact us at support@wtxlabs.com.

V. Automatically Collected Information

The Company may automatically collect information about your computer hardware and software. This information can include your IP address, browser type, domain names, access times, and referring website addresses. This information is used for the operation of the service, to maintain the quality of the service, and to provide general statistics regarding the use of the Company website. The Hub stores IP addresses and browser details only as keyed one-way codes. The anonymous visit counting described in section I stores neither.

Cookies. The Services set only the cookies needed to sign in, keep a session secure, and complete a sign-in or confirmation step. They load no analytics, advertising or tracking scripts. Shield and Tend also set one cookie that remembers a browser has signed in before, to choose what the signed-out page shows.

VI. Links

The Services contain links to other sites. Please be aware that we are not responsible for the content or privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of any other site that collects personally identifiable information.

VII. Security of Your Personal Information

The Company maintains reasonable administrative, technical, and organizational safeguards designed to protect your information, including encryption of data in transit, encryption of stored Planning Center credentials at rest, restricted access to administrative functions, and minimization of the personal data stored. Specific technical details are maintained in the Company's internal documentation and are available to customers on request.

When personal information (such as a credit card number) is transmitted to other websites, it is protected through the use of encryption, such as the Secure Sockets Layer (SSL) protocol.

We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100 percent secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet that are beyond our control; and (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through the Services cannot be guaranteed.

VIII. Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:

Delete your personal information from our records; and
Direct any service providers to delete your personal information from their records.

Please note that we may not be able to comply with requests to delete your personal information if it is necessary to:

Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, and provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
Debug to identify and repair errors that impair existing intended functionality;
Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
Comply with the California Electronic Communications Privacy Act;
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
Comply with an existing legal obligation; or
Otherwise, use your personal information internally in a lawful manner that is compatible with the context in which you provided the information.

If you are a church member, the church controls your data. Ask the church to correct or remove it in Planning Center; Shield and Tend pick up the change on their next complete nightly read. If the Company receives such a request directly from an individual, it shall not respond substantively other than to direct the individual to the church, and shall notify the church without undue delay. On the church's request, wtxLabs can also remove a person from Shield or Tend at once.

How long each App keeps data

The Hub.

Sessions end within 12 hours and are deleted 30 days after they end. Planning Center login tokens are deleted when the session ends. Confirmation links are deleted 7 days after they expire. Records of sign-in hand-offs to an App are kept 31 days. Cleared alerts are kept 90 days.
When the Owner deletes the church's account, every subscription is cancelled at once. After 30 days everything above is deleted, including the activity log, except:
- a record that the church existed (its dates; its name is replaced);
- invoices and the customer's billing data, which Stripe keeps.
If the Owner cancels the deletion within the 30 days, the Hub account and its data are kept. Billing does not restart. Shield and Tend stay suspended and delete their copy 30 days after the deletion was requested, unless a plan or comp includes them again before then (see below).
A church that simply stops paying keeps its Hub account and data until the Owner deletes it.

Sync.

Public records are refreshed about every fifteen minutes and held only as a cache. Disconnecting Planning Center deletes the stored Planning Center credentials and every record Sync has cached.
A church that connects but never subscribes, and leaves Sync and its embeds unused for 30 days, is deleted automatically. A church that has paid and then cancels is kept for 60 days after its subscription ends, so it can return, and then deleted on the same 30-day rule.
On disconnecting, the church's own design settings are kept so it can set Sync up again on return. They are deleted on request.
Sync's internal sync logs (its own record of each refresh) are retained for fourteen days, separately from the server logs below.

Shield and Tend.

A person deleted or merged in Planning Center is removed on the next nightly run that reads the whole directory successfully. In Tend this includes their engagement history, and a merge leaves only the surviving record's id, for 180 days. If a night's run cannot confirm the whole directory, it removes nobody. After 36 hours, Shield warns on every screen that deleted people may still be listed.
A person who asks can be removed at once by us, on the church's request, after the church removes them in Planning Center. In Shield this includes any unmatched training-export row carrying their name or email address.
An unmatched training-export row in Shield is deleted 90 days after it is resolved.
When an App stops being included in the church's plan, the App suspends the church 30 days later and deletes the church's data 30 days after that. If the church deletes its Hub account, the App suspends it at once and deletes its data 30 days later, even if the deletion is then cancelled, unless a plan or comp includes the App again before then. An App Admin can also delete it at once from the App's Settings. A failed payment does not start this clock.
What is kept after a church's data is deleted: the church's record, its activity log, and its staff list. Tend's staff list holds Planning Center ids only. Shield deletes its staff's names and email addresses in the same deletion.
If Tend's Planning Center connection is lost, Tend is built to delete the church's data after 7 days. That deletion is switched off, so today the data stays until one of the steps above deletes it.
Sign-in sessions last at most 12 hours and are deleted 7 days after they end.

Server logs (all the Services). Our hosting keeps server and application logs, which can include IP addresses, browser details and account identifiers. Our own log lines carry ids, counts and durations, and redact email addresses, phone numbers, keys and tokens. Logs are kept for security, troubleshooting and record-keeping, for up to 13 months, and then deleted.

IX. Data Security and Breach Notification

The Company maintains reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, acquisition, disclosure, or use. In the event of a security incident involving personal information, the Company will promptly investigate the incident and provide notice to affected individuals and, where required, to applicable regulatory authorities in accordance with applicable law.

The Company will provide any required notice in the manner and within the timeframes prescribed by applicable law. For information held for a church, the Company also notifies the church within 72 hours, as its Data Processing Addendum (clause 8) requires.

X. Age and Children

The User must be 18 or older to use the Services. The Company does not knowingly collect personally identifiable information directly from children under the age of thirteen, and does not knowingly permit them to use the Services. If the Company learns that it has collected personal information directly from a child under 13, it will delete that information.

Children's Information. The Services are business services intended for organizations and their authorized administrators. The Services are not directed to children, and children may not create or administer accounts.

Unlike Sync, Shield and Tend do hold information about children: Shield holds a child's screening and serving records if the child serves; Tend holds each child's directory facts and, if the church turns them on, check-ins, serving and group participation. Neither stores a child's name, contact details or birth date. That information reaches the Services only from the church's own Planning Center account, at the church's direction, and never from the child. The church decides what it records about children in Planning Center, and is responsible for obtaining any notice, permission, authorization, consent, or other legal basis required by applicable law. A parent's or guardian's request should go to the church. If it comes to us, we will pass it to the church, and on the church's request we will remove the child from Shield or Tend.

Sync. The Service does not retrieve Planning Center people or member rosters, group-membership lists, individual check-in records, donation records, form-submission content, or private staff notes. Information relating to a minor may nevertheless appear incidentally in a record that a customer has authorized for public use, such as a public event, group, contact, registration, media, or speaker listing. Customers are responsible for deciding which records are authorized for public display and for obtaining any notice, permission, authorization, consent, or other legal basis required by applicable law.

Sensitive information. We treat three kinds of information as sensitive: Shield's background-check statuses, Tend's records of children's check-ins and group attendance, and Tend's records of whether a person has given. Only people the church gives access to that App can see them. We use them only to provide that App to the church, never for any other purpose, and we delete them on the same schedule as the rest of the church's data in that App.

XI. Disconnecting Your Account From Third-Party Websites

You will be able to connect your Company account to third-party accounts. By connecting Planning Center, you authorize wtxLabs to access and cache data your account is permitted to share, solely to provide the Services. You may revoke this authorization at any time in Planning Center. The Services then stop reading from it. Revoking does not by itself delete what Shield or Tend has already copied: the church's data is deleted as section VIII describes, or at once by an App Admin from the App's Settings. In Sync, you may disconnect your Planning Center account at any time by selecting "Disconnect Planning Center" from the account menu in the dashboard. Disconnecting deletes the stored Planning Center credentials and every record the Company has cached from Planning Center.

Removal Requests. Upon the church's written request, the Company will use commercially reasonable efforts to delete specified Personal Data from the Services. The church is responsible for correcting, removing, or changing the source record in Planning Center when necessary to prevent the information from being retrieved again.

XII. Email Communications

From time to time, the Company may contact you via email for the purpose of providing announcements, promotional offers, alerts, confirmations, surveys, and/or other general communication.

If you would like to stop receiving marketing or promotional communications via email from the Company, you may opt out of such communications by contacting the Company at support@wtxlabs.com.

XIII. External Data Storage Sites

We may store your data on servers provided by third-party hosting vendors with whom we have contracted.

XIV. Changes to This Statement

The Company reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you. You may receive a notice by sending an email to the primary email address specified in your account, by placing a prominent notice on our website, and/or by updating any privacy information. Your continued use of the website and/or services available after such modifications will constitute your: (a) acknowledgment of the modification of this Policy; and (b) agreement to abide and be bound by this modified Policy. For the Services, "the primary email address specified in your account" is the church's billing contact.

XV. Contact Information

The Company welcomes your questions or comments regarding this Statement of Privacy. If you believe that the Company has not adhered to this Statement, please contact the Company at:

WTXLABS, LLC
Email Address: support@wtxlabs.com
Mailing address: 4401 Shallowford Rd, Ste 166 PMB 5048, Roswell, GA 30075
Phone number: (470) 223-8233

Effective as of November 6, 2026.