Privacy Policy

Version 1.0 — Last Updated: July 23, 2026

1. Who This Policy Covers

This Privacy Policy describes how BCA Group Inc. ("BCA Group," "Manna Media," "we," "us," or "our") collects, uses, shares, and protects information in connection with the Manna Media platform (the "Service"). It applies to two groups, described throughout as applicable:

- Organizations — churches and their staff who create accounts to use the Service, governed together with the Manna Media Terms of Service — Organizations. - Members — congregation members who interact with content, SMS, or an optional account made available by their Church, governed together with the Manna Media Terms of Service — Members.

Where a section applies to only one group, it says so. Sections without that label apply to both.

2. Information We Collect

2.1 Information Organizations provide

- Account and staff information: first name, last name, email address, and role (Owner/Admin or Contributor). Authentication is handled entirely by our authentication provider (see Section 5): church admins sign in by magic link, and Members who choose password authentication have their passwords transmitted directly to that provider and never stored, logged, or cached by BCA Group. Our own database stores no passwords or password hashes. - Church profile information: church name, domain, logo, brand colors, denomination, website URL. - Billing information: billing contact details and a tokenized payment method, processed by our payment processor. We do not store full payment card numbers. - Church Content: sermon audio, video, or transcripts uploaded or linked (including via YouTube/Vimeo URL) for content generation. - Feedback: beta feedback, screenshots, and related text submitted through our internal feedback tool, visible only to BCA Group staff.

2.2 Information Members provide

- Phone number, if you opt in to SMS by submitting it through a Church's sign-up page or by texting a keyword. - Name and email, if you choose to create an optional account. - Quiz answers and private reflection responses, if you engage with those features. If you are not signed in, these responses are held in temporary storage and are discarded — not written to our database — unless you sign in before the session ends. - Engagement data, such as which devotionals or prompts you have viewed or completed, tied to your account if you have one, or to your session if you do not.

2.3 Information collected automatically

Standard technical information such as IP address, device and browser type, and page-load timestamps, collected for security, performance, and fraud-prevention purposes. This information is processed through our hosting infrastructure provider (Railway) as part of operating the Service; we do not currently use separate third-party advertising, analytics, or tracking services. If we add any such service in the future, we will update this Policy and the recipient list in Section 5.

3. How We Use Information

We use the information described above to:

- Provide, operate, and maintain the Service, including generating devotional content from Church Content and delivering it to Members; - Process and deliver SMS messages to Members who have opted in; - Create and manage Organization accounts, billing, and support; - Detect, prevent, and respond to fraud, abuse, or security incidents; - Comply with legal obligations; and - Improve the Service, including by analyzing aggregate, de-identified usage patterns.

We do not sell personal information. We use the AI providers listed in Section 5 to generate content from Church Content. Based on those providers' commercial API terms as we understand them at the effective date of this Policy, data submitted to them through their APIs is not used to train their models; however, those terms are set by the providers and may change, and you should consult the providers' own terms for their current practices. We do not otherwise use Church Content or Member information to train AI models. See Section 7.4 for a specific commitment regarding SMS information.

4. Members: Private Content Is Not Shared With Your Church

Your individual quiz answers and private reflection responses are treated as private. They are not visible to, and are not shared with, your Church's staff or leadership. Your Church may see aggregate or anonymized engagement statistics (for example, how many members completed a given devotional), but not your individual private responses. If a future version of the Service changes this, we will update this Policy and provide notice before the change takes effect.

5. How We Share Information

We do not sell personal information. We share information with the following categories of recipients, each solely to operate the Service:

| Recipient | Purpose | Whose data | |---|---|---| | Stytch (B2B and B2C projects) | Authentication and login for Organization staff and Member accounts | Org staff / Members | | Stripe | Subscription billing | Org | | Anthropic (Claude) | AI-assisted metadata suggestions (title, speaker, series, tags) from sermon content | Sermon content (Org) | | OpenAI | AI generation of devotionals, quizzes, and prompts from sermon content | Sermon content (Org) | | Deepgram | Speech-to-text transcription of uploaded sermon audio/video | Sermon audio/video (Org) | | Resend | Transactional email (magic links, invites, notifications) | Org and Members | | Inngest | Background job orchestration for the content-generation pipeline | Sermon processing jobs (Org) | | Twilio (pending activation) | SMS delivery to Members who opt in | Member phone numbers | | Userback | Internal beta feedback tool, back-office only, never shown to Members | Org staff feedback | | Railway (application hosting, Postgres database, Railway Buckets object storage) | Hosting and storage infrastructure for the Service | Org and Members |

Each of these providers is contractually restricted to using the information only to provide their service to us. We may also disclose information: (a) to comply with law, legal process, or government request; (b) to protect the rights, property, or safety of BCA Group, our users, or the public; or (c) in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to the information transferred.

6. Media Processing Tools

Uploaded or linked sermon video is processed using `yt-dlp` and `ffmpeg` on our own infrastructure to extract audio; this processing does not send your content to any third party. Uploaded video is transient and deleted after processing; extracted sermon audio is retained as described in Section 8.

7. SMS-Specific Practices

7.1 How your number is used

If you opt in to SMS, we use your phone number solely to deliver the messaging program you opted into (reminders and links to content from the Church you opted in with), to process opt-out (STOP) and help (HELP) requests, and to maintain a consent record as described below.

7.2 Message frequency and rates

Message frequency varies by Church, up to approximately one message per day depending on the Church's publishing schedule. Message and data rates may apply according to the terms of your mobile carrier. Manna Media and your Church do not charge you for the messages themselves.

7.3 Consent records

When you opt in, we record your phone number, the date and time of your consent, and the disclosure you were shown, in order to document compliance with SMS regulations and carrier requirements.

7.4 Opting out

You may stop receiving messages at any time by replying STOP. We will send one confirmation message and no further messages unless you opt in again. Reply HELP for assistance.

7.5 No sharing of SMS opt-in data

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of information described in this Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, except as necessary to provide the SMS messaging service itself (for example, with our SMS delivery provider, currently Twilio) or as required by law.

8. Data Retention and Deletion

- Sermon audio: retained for the life of your Organization's account, to support content generation and re-generation. - Uploaded or linked sermon video: transient — deleted after audio extraction and processing are complete. - Unauthenticated quiz/reflection responses: held in temporary storage only, discarded at the end of the session unless you sign in before it ends. - Authenticated Member data (account, saved reflections, engagement history): retained for as long as your account is active, and for a reasonable period afterward to allow account recovery, unless you request deletion sooner. - SMS consent records: retained for as long as necessary to demonstrate compliance with SMS regulations, generally for the duration of the subscription plus a reasonable period afterward. - Organization account and billing data: retained for the life of the Organization's account and as required for tax, accounting, and legal recordkeeping afterward.

You may request deletion of your information as described in Section 10 or Section 11, subject to the legal-recordkeeping exceptions above.

9. Children's Privacy

The Service's account-creation features require you to be 18 or older, verified through self-attestation at signup, consistent with the Manna Media Terms of Service — Members. SMS opt-in does not require an account and is not age-verified; it is intended for a general audience. If we obtain actual knowledge that a specific SMS subscriber is under 13, we will unsubscribe that number and delete it from our records. We do not knowingly collect personal information from children under 13 through any part of the Service.

10. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), may give you the following rights with respect to your personal information:

- Right to know what personal information we have collected, used, and disclosed about you in the preceding 12 months; - Right to delete personal information we have collected from you, subject to certain exceptions (such as the recordkeeping needs described in Section 8); - Right to correct inaccurate personal information; - Right to opt out of sale or sharing of personal information — we do not sell or share personal information as those terms are defined by the CCPA; - Right to limit use of sensitive personal information — we do not use sensitive personal information (such as precise geolocation) for purposes requiring this right beyond what is necessary to provide the Service; and - Right to non-discrimination for exercising any of these rights.

To submit a request, contact us at [email protected]. We will verify your identity before fulfilling requests involving your account (for example, by confirming access to the phone number or email on file). If we deny your request in whole or in part, you may appeal by replying to our decision or by contacting us again at the same address.

11. Other State Privacy Rights

Residents of certain other states with comprehensive privacy laws may have similar rights to those described in Section 10, including rights to access, delete, correct, and opt out of certain processing. You may submit requests using the contact information in Section 10 or Section 15, and we will respond consistent with the law applicable to your state of residence.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) setting that sends a signal to websites you visit. There is currently no industry-standard response to DNT signals, and the Service does not currently respond to them differently from any other visit. We describe the information we collect and how we use it in this Policy, and you can exercise the choices described in Sections 7, 8, 10, and 11 regardless of any DNT setting.

13. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction, including encryption in transit, access controls, and hosting through infrastructure providers (Railway) that maintain their own security controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice, such as by email to Organization staff or Members with accounts, or by posting a notice on the Service. Continued use of the Service after the effective date of an updated Policy constitutes acceptance of the changes, consistent with the versioned-consent approach described in the Terms of Service.

15. Contact Us

Questions about this Policy, or requests regarding your personal information, may be directed to:

BCA Group Inc. Attn: Privacy [email protected]

For general legal questions, contact [email protected].