Privacy Policy

QStone Network, LLC — Parish Operations Platform (POP).
Effective June 1, 2026. This Policy explains how QStone handles personal information in connection with the Software.

In plain terms

QStone provides the Parish Operations Platform to churches. Your parish controls its members' data; QStone processes it on the parish's behalf to run the software.
Donations are processed by Stripe and go to your parish's own account. QStone never stores your card number or the parish's payment secret keys.
We use a small set of trusted service providers (payments, email delivery, error diagnostics, hosting). We do not sell personal information.
If you are a parishioner, your parish is the right contact for access, correction, or deletion of your records.
You can opt out of in-app diagnostics, and a parish can export or delete its data when it leaves.

This summary is for convenience only. The numbered sections below are the full policy.

1. Who we are and what this covers

This Privacy Policy explains how QStone Network, LLC, a North Carolina limited liability company located in Cornelius, North Carolina (“QStone,” “we,” “us”), handles personal information in connection with the Parish Operations Platform (“POP” or the “Software”) — including our web applications, administrative portals, APIs, and the POP mobile applications published on the Apple App Store and Google Play. POP was created by Dalibor Tomić and Rev. Fr. Srebrenko Vidaković and is owned and operated by QStone Network, LLC. This Policy works together with the QStone Master Services Agreement and Terms of Service.

Your data is yours. Our software is ours. This Policy explains how we handle your personal information (which you own). The POP software itself — source code, schemas, templates, and designs — is the proprietary intellectual property of QStone Network, LLC. Copyright © 2026 QStone Network, LLC. All rights reserved. See the Terms of Service for the full intellectual-property and licensing terms.

2. Our role: controller and processor

2.1 Parish data (we are a processor). When a parish uses the Software to manage its members, donations, records, calendar, and communications, the parish decides what information to collect and how it is used. The parish is the controller of that information, and QStone processes it on the parish's behalf and under its instructions to provide the Software.

2.2 Our own data (we are a controller). For information we collect to run our business — a parish's account and administrator details, billing information, support requests, and visitors to our public websites — QStone is the controller.

2.3 Parishioners. If you are a parishioner or member, your parish is your primary point of contact for your personal records. Requests about that information are best directed to your parish, and we will support the parish in responding.

3. Information we process

Account information: name, email, password (stored hashed), phone (optional), mailing address, date of birth, Slava (patron saint), and language preference.
Family / household: household name, spouse and children names and dates of birth that a member voluntarily adds.
Sacramental records: baptism, chrismation, marriage, funeral, and memorial information submitted through service-request forms. Some of this content may relate to minors; the parish controls it and is responsible for any required consents.
Giving records: donation amount, date, fund, and Stripe payment-confirmation IDs. Card numbers are never stored on our servers — they go directly to Stripe.
Communications: inquiries, Bible-study / catechesis questions, and replies between a member and the priest, plus transactional email we send on the parish's behalf and related delivery information.
Usage & diagnostics: limited technical data needed to operate, secure, and improve the Software — log data, device/app information, and error reports. Our diagnostics are configured to minimize personal data, and the mobile app lets you turn diagnostics off.
Cookies: our web applications use cookies that are necessary to sign you in, keep your session secure, and remember basic preferences. We do not use them to sell your information or build advertising profiles.

4. How we use information

To provide, operate, secure, maintain, and support the Software — your account, family, calendar, readings, and giving history.
To support sacramental life: deliver service requests to your priest, generate certificates, and schedule visits.
To process donations through the payment processor and send transactional email on the parish's behalf (magic-link logins, receipts, inquiry replies, parastos/Slava reminders, certificate delivery).
To authenticate users and protect against fraud, abuse, and security incidents.
To improve the Software using de-identified, aggregated data that does not identify any parish or individual.
To comply with law and enforce our agreements.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with a limited set of trusted service providers (subprocessors) who process it on our behalf under contracts requiring appropriate protection:

Stripe, Inc. — donation and payment processing.
SendGrid (Twilio Inc.) — delivery of transactional and operational email on the parish's behalf.
DigitalOcean — hosting, storage, and delivery of the Software (US data centers).
Error-diagnostics provider — application error and stability monitoring (configured to minimize personal data).
Apple and Google — mobile app distribution and push notifications.

Information a parishioner provides through the Software is shared with, and controlled by, that parishioner's parish. A parish's priest and staff (priest or admin role) can see records pertaining to their pastoral work; they cannot see another parish's data. We may also disclose information if required by law or to protect the rights, safety, and security of users, the public, or QStone; and if QStone is involved in a merger or sale of assets, information may transfer as part of that transaction, subject to this Policy.

6. Children's and sensitive information

The Software is provided to parishes, is not marketed directly to children, and is not intended for a child to sign up on their own. A parish may, under its own authority, enter records relating to minors (for example, sacramental records). The parish is the controller of that information and is responsible for obtaining any consents the law requires. Children under 13 do not have their own accounts.

7. Retention, export, and deletion

Account information: kept while your account is active, plus 30 days after a deletion request.
Giving records: 7 years (US IRS retention for charitable-giving substantiation).
Sacramental records: retained per Orthodox canonical and parish-archival practice, generally for the life of the parish.
Email logs: 12 months, then purged. Magic-link tokens: deleted within 7 days (automated daily).

During the term and for thirty (30) days after termination, a parish may request an export of its data in a commonly used format; after that period, QStone may delete it, subject to law and reasonable backup cycles. The mobile app also offers an account-deletion option for parishioner accounts.

8. Security

We use commercially reasonable safeguards: passwords are hashed (never stored in plain text), all traffic is over HTTPS, database access is restricted to each parish's own data via per-parish isolation, and daily server snapshots are kept for disaster recovery and rotated after 30 days. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your information, or to object to or restrict certain processing. Because much of the information in the Software is controlled by your parish, please direct requests about parishioner records to your parish; QStone will support the parish in responding. For information QStone controls, contact us at the address in Section 12. You may also opt out of in-app diagnostics in the mobile app's settings, and unsubscribe from non-essential email at any time (transactional messages like receipts and security notices are not opt-out).

10. Where information is processed

QStone is based in the United States, and information is processed and stored in the United States. If you access the Software from outside the United States, your information will be processed in the United States, where data-protection laws may differ from those in your location.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, where appropriate, provide additional notice. Your continued use of the Software after an update takes effect means you accept the updated Policy.

12. Contact us

Questions or requests about this Policy or your information: info@qstonenetwork.com. If you are a parishioner, your parish is also a primary contact for your records, and for pastoral matters you can reach your priest directly through the parish.