Privacy Policy

Who we are

RM Serviços de Tecnologia LTDA, registered under Brazilian company ID (CNPJ) 53.621.787/0001-75, with registered address at R. Bancário Waldemar de Mesquita Accioly, 1483, CXPST 018, 58.051-420, João Pessoa, Paraíba, Brazil, develops and operates the CélulaHub platform.

Contact: contato@celulahub.com.

What data we collect

We collect different categories of data depending on how you interact with CélulaHub:

Organization and account data. When a church subscribes to CélulaHub, we collect the organization's name, contact email, timezone, country, and billing data processed by Stripe (see "Who we share data with" below).

Member, leader, and supervisor data. The Organization may enter, for each person tied to its cell groups, a name, email, phone number, and birthdate. The platform also records meeting attendance (present/absent, visitor status), meeting reports (lesson, teacher, notes, headcount, and custom fields defined by the Organization), and prayer requests entered by leaders (title and description). Some of these free-text fields may, depending on what is entered, contain sensitive personal data under Brazilian law — for example, religious belief or health information mentioned in a prayer request or report note. We handle the content of these fields with the same confidentiality and role-based access controls described throughout this Policy, regardless of what is entered into them.

Materials and documents. PDF files and other shared materials uploaded by the Organization are stored in an S3-compatible file storage service.

Access requests. When you fill out the "Request Access" form on our website, we collect your name, role, church name, email, phone (optional), and message (optional). This data is used solely to evaluate and respond to your request.

Technical data. As with most online services, our servers and infrastructure providers automatically log basic technical information for each request, such as IP address, browser type, and access timestamp, used for security, abuse prevention, and troubleshooting. We do not use this information to identify individuals beyond that purpose.

Legal basis for processing

We process personal data based on one or more of the legal bases set out in Article 7 of the LGPD: contract performance (to provide the service the Organization subscribed to), compliance with a legal or regulatory obligation, legitimate interest (for example, platform security and fraud prevention), and consent, where applicable.

The platform records the moment each person accepts this Policy, allowing the Organization to demonstrate that consent when needed.

How we use data

• To provide CélulaHub's features to the subscribing Organization (cell group management, reports, materials, role-based permissions).
• To process payments and manage subscriptions.
• To evaluate access requests to the platform.
• For operational account communications (invites, billing notices, security alerts).
• To maintain security, prevent fraud, and comply with legal obligations.

We do not use church members' personal data for advertising, we do not sell it, and we do not share it with advertisers or ad networks — CélulaHub does not work with third-party advertising.

Who we share data with

To operate the platform, we share personal data with carefully selected service providers. For Organization data, where we act as the processor, these providers act as sub-processors, engaged with the controlling Organization's authorization and bound by the same instructions. For data where we are the controller (such as data collected through this site and at signup), they act as processors under our instructions:

• Clerk — Authentication and user account login management.
• Stripe — Payment processing and subscription billing.
• S3-compatible file storage — Storage of documents and PDF materials uploaded by the Organization.
• Cloudflare — Hosting and delivery of the marketing website and the application.
• Railway — Hosting of the backend infrastructure and the platform database.
• Statsig — Internal product usage metrics and gradual feature-launch controls.
• Betterstack — Error and stability monitoring for the platform. Receives technical failure logs, which include the identifiers of the person and organization signed in when the error occurred.

Some of these providers may process data on servers located outside Brazil. In those cases, we require appropriate contractual and technical safeguards to protect the data, in line with Article 33 of the LGPD.

We may also disclose personal data when required by law, court order, or a competent authority, or to protect the rights, safety, or property of CélulaHub, the Organization, or third parties. We do not sell personal data.

Cookies

Our marketing website (celulahub.com) does not use advertising, tracking, or third-party analytics cookies.

CélulaHub's authenticated application uses strictly necessary cookies to maintain your login session, provided by Clerk, our authentication provider. Without these cookies, you cannot access the platform.

How long we keep data

We retain personal data for as long as the Organization's account is active and for as long as necessary to fulfill the purposes described in this Policy, including legal, contractual, tax, and audit obligations.

When a person requests deletion of their data (see "Your rights" below) or when the Organization's contract ends, we delete or anonymize the corresponding personal data, except where the LGPD or other applicable law requires that it be retained for a specific period, such as tax records.

Your rights

Under Article 18 of the LGPD, you have the right to, among others: confirmation that processing is taking place; access to your data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data; data portability; deletion of data processed on the basis of consent; information about data sharing; and withdrawal of consent.

You can exercise the following rights directly within the platform:

• Export your personal data in a readable format at any time.
• Request deletion of your personal data.

If you're a cell group member, keep in mind that the Organization (your church) controls the data entered about you and should be your first point of contact for requests related to that data. For questions about the platform itself, write to contato@celulahub.com.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD) if you believe your rights haven't been properly addressed.

Security

We adopt reasonable technical and administrative measures to protect personal data against unauthorized access and against accidental or unlawful destruction, loss, alteration, communication, or any other form of improper processing, including role-based access control (admin, supervisor, leader, member) and per-Organization data isolation.

A limited group of authorized CélulaHub personnel may access account and Organization data when necessary to operate the platform, provide support, evaluate access requests, and manage invitations. This access is limited to what those purposes require and is subject to confidentiality obligations.

No system is entirely risk-free. If we identify a security incident affecting personal data, we will act as required by the LGPD, including, where applicable, notifying the National Data Protection Authority (ANPD) and affected data subjects.

Children's data

CélulaHub is not directed at children and does not allow minors to create their own platform accounts. However, because the service is used by churches to manage cell groups that may include children and teenagers, the Organization's leaders and supervisors may enter data about minors (such as name and attendance) as part of pastoral care for the cell group. In these cases, the Organization, as the data controller, is responsible for obtaining specific, prominent consent from at least one parent or legal guardian, as required by Article 14 of the LGPD.

Changes to this Policy

We may update this Policy from time to time to reflect changes to the platform or to applicable law. We will post any changes on this page along with a revised update date. For material changes, we will seek additional forms of notice where appropriate.

Contact

Questions, personal data requests, or complaints about this Policy can be sent to contato@celulahub.com. We have not yet appointed a dedicated Data Protection Officer (DPO); until we do, this email is the official channel for exercising rights under the LGPD.