Privacy Policy

1.1 Information you provide

• Account data: name, email address, church name, password (hashed), role, time zone.
• Sermon content: audio/video files, titles, descriptions, transcripts, speaker notes, scripture references, and any images or graphics you upload.
• Billing data: handled by Stripe. We receive a customer ID, the last four digits of your card, card brand, and expiration; we do not store full card numbers.
• Support messages you send us.

1.2 Information from third parties

• OAuth tokens & profile metadata from platforms you connect (Google/YouTube, Meta/Facebook, Instagram, TikTok, X/Twitter, Spotify). We store access and refresh tokens encrypted so we can publish content on your behalf.
• Publishing metadata (post IDs, timestamps, view counts) returned by those platforms after publish.

1.3 Automatically collected

• Usage data: pages visited, actions taken, pipeline runs, error logs.
• Device & connection data: IP address, browser, operating system.
• Cookies & similar technologies for authentication, preferences, and analytics.

We use information to:

• operate the Service — transcribe sermons, generate clips, captions, graphics, and email copy, and schedule and publish to the platforms you’ve connected;
• authenticate you, secure the Service, prevent abuse, and enforce our Terms;
• process payments and manage subscriptions;
• provide support, send service announcements, and (with consent) product updates;
• improve the Service — measure performance, debug errors, and evaluate new features.

We do not sell your personal information. We do not use Your Content or transcripts to train third-party AI models for anyone other than you.

To generate content, we send relevant portions of Your Content to AI sub-processors under data processing terms that prohibit them from training on your data. Our current sub-processors include:

• OpenAI — transcription (Whisper) and completions.
• Anthropic — captions, summaries, and editorial generation (Claude).
• Google — image generation (Gemini) and YouTube publishing.
• ElevenLabs — optional voice/podcast generation, when enabled.
• Stripe — billing and subscription management.
• Resend — transactional and product email.
• Railway, Cloudflare R2 — hosting and object storage.
• Sentry — error monitoring and diagnostics.
• PostHog — product analytics.
• Meta, TikTok, X, Spotify — only when you connect those accounts for publishing.

The current list of sub-processors may change; we’ll update this page when it does.

We share information only:

• With the sub-processors above to deliver the Service on your instructions;
• With platforms you connect — the content you choose to publish is sent to those platforms under their own terms;
• For legal reasons — when required by law, subpoena, or to protect rights, safety, or property;
• In a business transfer — in the event of a merger, acquisition, or asset sale, subject to this Policy continuing to apply.

SermonFlow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data (including YouTube tokens and channel metadata) solely to provide the publishing features you’ve requested. We do not transfer Google user data to third parties except as necessary to provide or improve the Service, and we do not use it for advertising. You can revoke access at any time at myaccount.google.com/permissions.

SermonFlow uses YouTube API Services to publish the videos you choose to your own channel. By connecting YouTube, you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

Our use of information received from Meta (Facebook and Instagram) follows Meta’s Platform Terms. We store Page and Instagram Business access tokens only to publish content you’ve explicitly scheduled, and we delete tokens when you disconnect the integration from Settings.

The SermonFlow application on TikTok (the “SermonFlow TikTok App”) is the TikTok integration operated by SermonFlow LLC as part of the SermonFlow Service. When you authorize the SermonFlow TikTok App, we receive and store only the data required to publish the content you’ve explicitly scheduled, including:

• your TikTok OAuth access and refresh tokens (stored encrypted);
• your TikTok user ID, display name, avatar, and the list of accounts you’ve authorized for publishing;
• post IDs, timestamps, and basic engagement metrics (view/like/comment counts) returned by TikTok after a successful publish.

The SermonFlow TikTok App does not read your TikTok inbox, DMs, private videos, or any content you have not explicitly scheduled through SermonFlow. We do not sell TikTok data, do not use TikTok data to train AI models, and do not share TikTok data with any third party other than the sub-processors listed above that are strictly necessary to operate the Service. Our use of information received from TikTok complies with the TikTok Developer Terms of Service and the TikTok Platform Data Use Policy. You can disconnect the SermonFlow TikTok App at any time from Settings → Integrations, which deletes the stored TikTok tokens immediately, or by revoking access directly at tiktok.com/setting/manage-permissions.

We keep account data for the life of your account and for up to 90 days after deletion to support reversal. Sermon uploads, transcripts, and generated content are retained for the life of your account unless you delete them sooner. Billing records are retained as required by tax law (typically 7 years). Server logs are retained for up to 90 days.

We use industry-standard safeguards: TLS in transit, encryption at rest for OAuth tokens, access controls, audit logs, and least-privilege access for staff. No system is perfectly secure; you are responsible for keeping your password and connected accounts safe.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information; object to or restrict certain processing; and withdraw consent. You can exercise these rights at any time by emailing privacy@sermonflow.app. We’ll respond within the timelines required by applicable law (typically 30 days).

California residents (CCPA/CPRA): we do not sell or share personal information for cross-context behavioral advertising.

EEA/UK residents (GDPR/UK GDPR): the legal bases for processing are contract performance, legitimate interest (security, service improvement), consent (marketing, optional integrations), and legal obligation. Our representative in the EU/UK can be reached at the email above.

SermonFlow is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided information to us, email privacy@sermonflow.app and we will delete it.

We operate in the United States. If you are accessing the Service from outside the U.S., you understand that your information will be processed in the U.S. and in other countries where our sub-processors operate. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

We may update this Policy from time to time. For material changes, we’ll notify you by email or in-app notice at least 14 days before they take effect.

Privacy questions: privacy@sermonflow.app
General support: support@sermonflow.app
Mailing address: 11044 Bismark Place, Hollywood, FL 33026, USA