Cardinal — Terms of Service

Effective date: [EFFECTIVE DATE]
Operated by: [FOUNDER LEGAL NAME], an individual doing business as Cardinal, operating in [STATE]
Contact: [CONTACT EMAIL]

Cardinal is church management software operated by [FOUNDER LEGAL NAME], an individual doing business as Cardinal ("Cardinal," "we," "us"). These terms are an agreement between us and the church that uses Cardinal (the "Church," "you"). These terms take effect when an authorized representative of the Church accepts them or when the Church first uses the service, whichever comes first; the person accepting them represents that they are authorized to bind the Church.

The short version

This summary is here to help you read the terms; it is not the agreement itself — the numbered sections below are.

Cardinal helps a church manage its people, events, volunteers, groups, giving records, forms, and bulletins. The Church is our customer; staff and members use Cardinal under the Church's account.
Cardinal is currently a free pilot, built and run by one person. It works well, but we make no uptime guarantees and hold no third-party certifications. We say so plainly below rather than dressing it up.
Your church owns its data. We host and process it to run the service, and for no other purpose. Each church's data lives in its own separate database — not mingled with any other church's.
If you leave, you can ask for a complete copy of your data, and we destroy your database. Some things are deliberately permanent while you use the service (giving records, change history) — that is a feature of a system of record, and we explain it below.
The Church is responsible for having the right to enter its members' — and especially children's — information, and for the accuracy of any consent records it keeps.

1. What Cardinal is

Cardinal is a church management system: a directory of people and households, events and volunteer scheduling, small groups, giving records, forms, communications, and bulletins, for a single church.

Cardinal is provided to the Church as an organization. Individual accounts (for staff, volunteers, or members) exist under the Church's use of the service, are created by the Church's own administrators, and act on the Church's behalf. There is no self-service public signup: every login is created by church staff through an invitation. The Church is responsible for who it invites and for what its users do in the service.

Cardinal is a tool, not a compliance service. The Church remains responsible for its own legal obligations — charitable-receipt rules, employment law, child-protection requirements, communications laws, and record-retention duties — and nothing in Cardinal is legal, tax, or accounting advice.

2. The pilot phase

Cardinal is currently offered as a free pilot. Free does not mean informal: these terms apply in full.

During the pilot:

We charge no fees. If we introduce pricing later, we will give the Church advance written notice and a genuine opportunity to leave with its data (Section 12) before any charge applies.
The product is under active development. Features may change, and we may modify or discontinue features. For material removals of functionality the Church relies on, we will give reasonable advance notice.
We may ask for feedback. The Church is not obligated to provide it, but any feedback, suggestions, or ideas you do share may be used by us to improve Cardinal without restriction or compensation.

3. Accounts and access

The Church designates its own administrators, and those administrators control which staff, volunteers, and members get logins and what each role can see and do.
Users must keep their passwords private and must not share accounts. The Church will tell us promptly at [CONTACT EMAIL] if it suspects an account has been compromised.
The Church is responsible for deactivating users who leave its staff or should no longer have access. Deactivating a user takes effect immediately, including against sessions that are already signed in.

4. Your congregation's data: ownership and our role

The Church owns its data. Everything the Church and its users enter into Cardinal — people, households, notes, attendance, giving records, files — belongs to the Church. We claim no ownership of it.

Our role is to host and process that data on the Church's behalf, to provide the service — and for no other purpose. We do not sell congregant data, use it for advertising, or share it except with the service providers we need to run Cardinal (hosting, database, storage, email delivery), as described in our Privacy Policy.

How we process data for the Church. We process congregational data only on the Church's instructions as expressed through the service and these terms, and for no other purpose. We keep it confidential. We use only the outside services (subprocessors) listed in the Privacy Policy, under terms materially as protective as these, and we will update that list and tell the Church before any new service starts receiving personal data. We will notify the Church of any security incident affecting its data (Section 11), and of any legal demand for its data before complying, unless the law forbids it. At the end of the relationship, Section 12 governs the return and deletion of the Church's data.

Each church's data is held in its own separate database — there are no shared data tables between churches, and a request to an unknown or inactive church address is refused rather than served another church's data. A login for one church does not work at another.

The Church's responsibilities for its data:

The Church confirms it has the authority and any legally required permissions to enter and manage the personal information of its members, attenders, and their children in Cardinal.
The Church is responsible for the accuracy of the information it enters — including consent records. For example, Cardinal lets you record a household's photo permission, but it stores what you record; it does not currently prevent a photo from being used contrary to that record. Acting on recorded consents is the Church's responsibility.
The Church is responsible for using its member directory and communication tools consistently with what it has told its congregation, including in any privacy notice the Church maintains.

5. Children's information

Information about children enters Cardinal only through church-authorized channels: staff data entry, staff-operated check-in, and staff-run imports. Cardinal has no child-directed signup or data-collection surface.

What Cardinal does, as built:

Any bulk communication addressed to a person the system knows to be a minor (under 18, based on a recorded birth date) is delivered to that child's guardians rather than to the child directly.
Child check-in and pickup records are restricted to a dedicated safeguarding permission narrower than general staff access, and pickup security codes are treated as secrets.
A child cannot be assigned to a volunteer role the Church has marked adults-only.

What Cardinal does not do, stated plainly:

Cardinal performs no age verification of any kind. A person with no recorded birth date is treated as an adult. Keeping birth dates accurate is the Church's responsibility.
Cardinal has no parental-consent workflow. Obtaining any consent required for a child's information, account, or communications — under child-privacy law or the Church's own policies — is the Church's responsibility.
The member directory does not automatically exclude minors; a child recorded as a member or attender is visible to fellow members like anyone else (birth dates are never shown). The Church controls what it records and its own directory practices.

6. Acceptable use

The Church and its users agree to use Cardinal only for lawful church-administration purposes, and agree not to:

scrape, harvest, sell, or repurpose congregant data for any purpose outside the Church's own ministry and administration — the directory and communication tools are not a marketing list (this does not limit the Church's right to export its own data under Section 12);
probe, disable, or circumvent security features, or attempt to access another church's data or another user's account;
upload or distribute unlawful content, or content the Church has no right to use;
use the communication tools to send spam or messages to people who have no relationship with the Church, or in violation of applicable communications laws;
resell, sublicense, or provide Cardinal to third parties.

We may suspend access that we reasonably believe threatens the security of the service or other users' data, or that materially breaches these terms. We will tell the Church what happened and work to restore access as soon as the issue is resolved.

7. Communications sent through Cardinal

The Church authors and is responsible for the content of the messages it sends. Cardinal automatically appends an unsubscribe link and the Church's name and postal address to every bulk email, but lawful use of the tools remains the Church's responsibility.
A recipient's unsubscribe from a mailing list is honored automatically. Essential account and record messages (such as password resets) are separate from bulk mail and may still be delivered.
Text messaging (SMS) is not currently offered as a live delivery channel. If we enable it in the future, we will notify the Church, and additional consent obligations may apply.

8. Online giving and payments (when enabled)

Online giving is not currently enabled in production. If and when it is enabled for the Church:

Payments will be processed by Stripe. Card and bank details are entered directly with Stripe and go to Stripe — Cardinal never receives or stores card numbers or bank account details. Cardinal keeps the Church's giving ledger: amounts, funds, dates, and statuses.
The Church's relationship with Stripe — including its Stripe account, Stripe's fees, and payouts — is governed by Stripe's own terms, which the Church accepts separately with Stripe.
Cardinal is not a bank, money transmitter, or payment processor; donated funds flow through Stripe to the Church, never through us.

9. Records that are kept on purpose

Cardinal is designed as a system of record. Three consequences are worth stating plainly, because they are deliberate:

Giving records cannot be edited or deleted — by church staff, or by us acting through the application. Corrections are made by visible counter-entries (voiding a gift, recording a refund). This protects the integrity of the Church's financial records.
Removing a person hides them; it does not erase history. A removed person disappears from every screen and every future action, but their record and history (giving, attendance) are retained in the Church's database. If the Church needs a person's data removed more completely — for example, to honor a legal request — contact us and we will address it with you case by case; some records (the giving ledger, change history) are built to resist alteration, so complete erasure may not be possible while preserving the Church's other records.
Changes are logged. Cardinal keeps an internal, tamper-resistant log of changes to church data, retained for as long as the Church's database exists. Deliberately, member community-board posts are kept out of that log so a withdrawn disclosure is not copied into a second place. Pastoral note contents do appear in the log's change snapshots; no church role can read that log — it is accessible only to us at the database level. This change log records writes; it does not record who viewed a record.

10. Availability, support, and backups

We want to be straightforward about what the Church is getting:

Cardinal is built and operated by one person. Support is by email at [CONTACT EMAIL], answered on a best-effort basis. There is no 24/7 support team.
The service is provided on a best-effort basis with no uptime guarantee or service-level agreement. We work to keep Cardinal reliable, and its architecture is deliberately simple, but outages can happen and may take time to resolve.
Brief interruptions during software updates are normal: updates are applied by migrating the database and then restarting the application. We aim to schedule disruptive maintenance outside typical church office hours.
Backups: each church's database is backed up automatically by our database hosting provider — daily full backups plus a continuous record of changes, retained for roughly 10 days — and a restore affects only that church. These are provider-managed backups; we do not currently operate an additional independent backup system, and there is no self-service backup download yet. We recommend the Church retain its own copies of records it is legally required to keep (for example, giving statements it has issued).

11. Our access to your data

Honesty requires this section. As the operator, we have administrative access to each church's database and files for setting up, maintaining, supporting, and troubleshooting the service. Bounds that exist today:

We access church data only as needed to operate and support the service, or as required by law.
Changes made through the application are attributed and logged. Direct administrative database access is a documented operations workflow and is not itself separately logged today — we will not pretend otherwise.
Stored database credentials are encrypted; connections to databases are encrypted and verified; and administrative destruction of a real church's environment requires deliberate, manually confirmed steps that cannot happen by accident or by automation.
If we confirm a security incident affecting the Church's data, we will notify the Church as described in Section 9 of the Privacy Policy, and we will tell the Church about any legal demand for its data before complying, unless the law forbids it.

12. Leaving Cardinal: your data on the way out

The Church may leave at any time. Here is exactly what happens:

1. Export. On request, we will provide the Church a complete copy of its data. There is no self-service export button yet; today this is a manual export we perform for you, of the Church's full database and uploaded files. Request it before asking us to close your environment.
2. Confirmation. We will not destroy a church's environment without a written request from an authorized representative of the Church, and our direct confirmation back to the Church before anything is destroyed. Destruction is deliberately hard to trigger and cannot be done casually or by an automated process.
3. Destruction. The Church's database is then destroyed immediately and permanently. We then delete the Church's file-storage bucket as a separate, manual offboarding step — the automated destruction does not remove it, so we perform this step ourselves and confirm it to the Church. Copies of the database in our hosting provider's automatic backups age out on their own within roughly 10 days of destruction.
4. What survives. One administrative record survives on our side: an append-only note that the Church's environment existed and was destroyed, identifying the church and its technical coordinates. It contains no congregational data and no credentials.

A caution on financial records: destruction is permanent and includes the Church's giving ledger. Churches typically have their own retention obligations for financial records — make sure you have exported what you need before we destroy anything.

13. Termination and suspension

By the Church: at any time, for any reason, by emailing [CONTACT EMAIL]. Section 12 then applies.
By us: we may terminate this agreement with at least 30 days' written notice to the Church — including if we discontinue Cardinal itself. During that notice period, Section 12's export process is available in full.
For cause: we may suspend or terminate immediately if the Church materially breaches these terms, if continued operation would create a security or legal risk, or if we are required to by law. Even then, we will provide the Church's data export unless the law prevents us.
We may also suspend a church's environment (access blocked, data intact) as an intermediate step while an issue is worked out.
If the Church goes silent: if this agreement ends and the Church has not requested export or destruction, we will retain the Church's environment for [60] days after termination, with export available throughout; after that we may suspend it and, on written notice to the Church's last known administrator address, destroy it under Section 12.

14. The demo site

Our public demo (demo.cardinalchms.com) exists so churches can evaluate Cardinal. It contains only fictional, anonymized data. It is provided for evaluation only, with no warranty, and we may reset or change it at any time. Do not enter real congregational data into the demo.

15. Disclaimer of warranties

CARDINAL IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED — INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT DATA WILL NEVER BE LOST. Section 10 describes our actual backup posture; the Church should not rely on Cardinal as its only copy of legally required records.

16. Limitation of liability

To the fullest extent permitted by law:

NEITHER PARTY IS LIABLE TO THE OTHER FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUES, OR DATA, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE.
OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE IS CAPPED AT THE GREATER OF (A) THE AMOUNTS THE CHURCH PAID US FOR THE SERVICE IN THE 12 MONTHS BEFORE THE CLAIM AROSE, OR (B) US $100.
Nothing in these terms limits liability that cannot be limited by law, including for a party's willful misconduct.

17. Indemnity

The Church will defend and indemnify us against third-party claims arising from (a) the data the Church enters into Cardinal, including claims that the Church lacked the right or consent to collect or use it, or (b) the Church's use of the service in violation of law or these terms. In plain words: if someone sues us because of data the Church entered or how the Church used the service, the Church stands behind that claim, not us. This indemnity is deliberately narrow because the pilot is free; we do not ask the Church to indemnify us for our own failures. It is conditioned on our prompt notice of the claim, the Church's control of the defense, and our reasonable cooperation at the Church's expense; the Church may not settle a claim in a way that admits fault on our behalf without our consent.

18. Governing law

These terms are governed by the laws of the State of [STATE], without regard to conflict-of-laws rules. The parties will first try in good faith to resolve any dispute informally by contacting each other; any claim that cannot be resolved informally will be brought in the state or federal courts located in [STATE], and both parties consent to their jurisdiction.

19. Changes to these terms

We may update these terms. For material changes we will give the Church at least 14 days' notice by email before the change takes effect. If the Church does not agree to a change, it may terminate under Section 13 before the change takes effect and leave with its data under Section 12. Continued use after the effective date of a change constitutes acceptance.

20. General

Entire agreement. These terms (with the Privacy Policy) are the entire agreement between us about the service and supersede prior discussions. If these terms and the Privacy Policy conflict, these terms control as between us and the Church.
Assignment. The Church may not assign this agreement without our consent, except to a successor church organization. We may assign this agreement to Cardinal LLC upon its formation, or to a successor in a merger or sale, with notice to the Church.
Notices. Formal notices under these terms go by email — to the Church at its designated administrator address, to us at [CONTACT EMAIL] — and are deemed given when sent, absent a delivery failure.
Severability; waiver. If a provision is unenforceable, the rest remains in effect. Not enforcing a provision is not a waiver of it.
No third-party beneficiaries. These terms are between us and the Church. Individual users, members, and congregants are not parties to this agreement and acquire no rights under it. How we handle their information is described in our Privacy Policy.
Survival. Sections 4 (ownership), 9, 12, and 15–20 survive termination.

21. Contact

Questions about these terms: [CONTACT EMAIL]

[FOUNDER LEGAL NAME], doing business as Cardinal