Cantor

Privacy Policy

Effective date: June 1, 2026 · Last updated: June 1, 2026

1. Who We Are

Cantor is an AI-powered church operations platform operated from Mississippi, USA. We can be reached at privacy@cantor.church. In this policy, “Cantor,” “we,” “us,” and “our” refer to our service.

We take privacy seriously. This policy explains what data we collect, why we collect it, who we share it with, and what rights you have over it. We wrote it to be readable, not just legally defensible.

2. What We Collect

Account Information

When you create an account, we collect your full name, email address, and a hashed password. Church administrators also provide their church name, denomination, size, and service schedule.

Church Operating Data

Cantor stores the data your church team creates and manages in the platform: worship service plans, communications drafts, volunteer schedules, prayer requests, visitor records, and giving summaries. This data belongs to your church — see Section 9.

Usage Data

We collect basic usage information — pages visited, features used, and timestamps — to understand how the product is used and improve it. This data is aggregated and not used to build individual profiles for advertising.

3. How We Use Your Information

  • To provide and operate the Cantor platform
  • To power Ezra, our AI operations agent, using your church's context and history
  • To send service-related communications (account confirmations, security alerts)
  • To improve the platform based on aggregate usage patterns
  • To respond to your support requests
  • To comply with legal obligations

We do not use your data for advertising, we do not sell it to third parties, and we do not use it to train general-purpose AI models without your explicit consent.

4. Data Sharing

We do not sell your personal data. We share data only with the following trusted sub-processors, each governed by data processing agreements:

  • Supabase — database and authentication infrastructure (US-based, SOC 2 compliant)
  • Vercel — hosting and CDN infrastructure (US-based)
  • Anthropic — AI inference for Ezra's responses. Data sent to Anthropic is used only to generate responses and is not retained for training without consent.

We may disclose information if required by law, court order, or to protect the safety of our users.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Church data is retained according to the church administrator's instructions.

6. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

  • Access (GDPR Art. 15) — Request a copy of the personal data we hold about you
  • Rectification (GDPR Art. 16) — Correct inaccurate or incomplete data
  • Erasure (GDPR Art. 17) — Request deletion of your personal data
  • Portability (GDPR Art. 20) — Receive your data in a machine-readable format
  • Objection (GDPR Art. 21) — Object to processing based on legitimate interests
  • CCPA rights — California residents may request disclosure, deletion, or opt-out of sale (we do not sell data)

To exercise any of these rights, use our data request form or email privacy@cantor.church. We will respond within 30 days.

7. Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest, row-level security in our database, and regular security audits. No system is perfectly secure — if you believe your account has been compromised, contact us immediately at privacy@cantor.church.

8. Children's Privacy

Cantor is not directed at children under 13 and we do not knowingly collect personal information from children under 13. If we discover we have inadvertently collected such information, we will delete it promptly.

9. Church Data Ownership

Your church owns all data it creates in Cantor — service plans, member notes, communications, giving records, and everything else. We are a data processor acting on your instructions. You can export or delete your church's data at any time from Settings, or by contacting us.

We will never use your congregation's data to train AI models without explicit written permission from your church administrator.

10. Cookies

We use essential cookies only — session cookies and authentication tokens required to keep you signed in. We do not use advertising or tracking cookies. See our full Cookie Policy.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email and will post the updated policy with a new effective date. Continued use of Cantor after changes constitutes acceptance.

12. Contact

For privacy questions or requests: privacy@cantor.church