Legal
Subprocessors
Providers that help us deliver and support On Christ's Mission.
Provider register
This register draws on CSA Annex II and Privacy Policy section 5. PostHog is included for marketing-site analytics.
Plaid, Inc.
- Purpose
- Connection of Customer bank accounts and retrieval of bank transaction data
- Data processed
- Account holder names, bank account information, and transaction descriptions
Payabli, Inc.
- Purpose
- Payment processing for donations and other payments; merchant onboarding; payouts
- Data processed
- Payer names, email addresses, billing addresses, tokenized payment details, transaction history; identity and ownership information of Customer principals provided for merchant onboarding
Clerk, Inc.
- Purpose
- User authentication and account management
- Data processed
- Names, email addresses, telephone numbers, sign-in credentials and identifiers, multi-factor authentication data, device and session information, IP addresses
Amazon Web Services, Inc.
- Purpose
- Cloud hosting of the Services, including application servers, primary database, caching, file storage, logging, backups and encryption key management
- Data processed
- All categories of Customer Personal Data held in the Services, including names, contact details, giving and payment history, staff account data, vendor data, student and family records, uploaded documents, and IP addresses
Vercel, Inc.
- Purpose
- Hosting and delivery of the Services' web applications
- Data processed
- IP addresses, browser information, and Customer Personal Data displayed to authorized users in transit
Cloudflare, Inc.
- Purpose
- Domain name services, network security and traffic routing; bot and fraud prevention on public forms; encrypted database backup storage
- Data processed
- IP addresses, browser and device information, and data in transit to the Services; encrypted backup copies of Customer Personal Data
Anthropic, PBC
- Purpose
- AI Features (Section 1.1.5)
- Data processed
- Customer Content optionally submitted to AI Features, which may include financial, donor, and payment information
Resend, Inc.
- Purpose
- Delivery of transactional email, including giving statements and notifications
- Data processed
- Recipient names and email addresses, and email contents
650 Industries, Inc. (Expo)
- Purpose
- Delivery of push notifications to the OCM Giving mobile application
- Data processed
- Device push notification identifiers and notification contents
PostHog
- Purpose
- Product analytics on the marketing site
- Data processed
- Non-identifying usage events only (no email or contact details)
- Location
- United States
AI providers
The approved documents name the following provider for optional AI-assisted features:
- Anthropic, PBC: AI Features (Section 1.1.5). Customer Content optionally submitted to AI Features, which may include financial, donor, and payment information.
Subprocessor change notices
Provider will inform Customer at least 10 business days in advance and in writing of any intended changes to the Approved Subprocessors whether by addition or replacement of a Subprocessor, which allows Customer to have enough time to object to the changes before the Provider begins using the new Subprocessor(s).