Privacy Policy

Effective Date: October 16, 2026

Welcome to PraiseMates ("PraiseMates", "we", "our", or "us"). Your privacy is important to us. This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use our website, desktop application, and related services.

Data Controller: Rhema Visions, represented by its sole founder, Bhanu Prakash Taduri, the developer of PraiseMates. Registered address: 1-1-33/11, Budvel, Rajendra Nagar, Hyderabad, Telangana, India. PIN: 500030. GSTIN: 36BBGPT1665J1Z8. Reachable at[email protected].

Encarregado (Data Protection Officer, LGPD): Bhanu Prakash Taduri also serves as the Encarregado for purposes of Brazil's Lei Geral de Proteção de Dados (LGPD), and is the point of contact for data subjects and the Autoridade Nacional de Proteção de Dados (ANPD) regarding this Privacy Policy. Reachable at [email protected].

Grievance Officer (India, Digital Personal Data Protection Act, 2023): Bhanu Prakash Taduri also serves as the Grievance Officer for purposes of India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), and is the point of contact for data subjects raising a complaint or grievance about how their personal data is processed under this Privacy Policy. Reachable at[email protected]. We aim to acknowledge and address grievances within a reasonable time.

By using PraiseMates, you agree to the practices described in this Privacy Policy.

1. Information We Collect

Account Information

When you create a PraiseMates account, we collect:

• Email address (required)
• Phone number (optional)

Your email address is used to create and manage your account, communicate with you regarding your subscription, provide support, and send important service-related notifications.

Providing a phone number is entirely optional. If provided, it may be used for account verification, customer support, or important service communications.

Billing & Tax Information

To determine the correct tax treatment for your purchase, we collect:

• Date of birth (required) — used to verify you meet the minimum age to use PraiseMates in your country.
• Billing country and state/province (required if you are in India, the United States, or Canada) — used to determine the correct tax jurisdiction and rate for your purchase.
• Postal/zip code (collected only in some cases, after your account) — for some US states and Canadian provinces, once our sales there approach the point where local tax registration is required, we ask for your postal/zip code to confirm your tax jurisdiction precisely. This may be required before renewing an existing subscription.

This information is not used for any purpose beyond tax compliance and is not shared except as described in “Sharing of Information” below.

Location Information

When you visit our website or interact with our API — for example, when you check out, or when the desktop application or web dashboard checks your subscription status — we determine the country you are connecting from. Where our network security provider, Cloudflare, can determine this at the network level, we use that. Otherwise, we send your IP address to a third-party IP geolocation lookup service — currentlyipwho.is orip-api.com — to look it up. See “Sharing of Information” below for more on these providers.

We use your detected country to:

• Determine whether PraiseMates is currently available for purchase in your country.
• Show you pricing in the correct currency.
• Record which country a given purchase, trial, or free-plan activation was made from, so we can monitor our sales against the tax-registration thresholds of the countries we sell into.

We do not use your IP address or detected country to individually track or profile your browsing activity beyond these purposes, and we do not use it for advertising.

2. Device Identification for License Activation

To activate PraiseMates on your computer, we generate a unique device identifier based on your operating system's machine identifier (such as a Windows registry identifier).

Before this identifier leaves your device, it is cryptographically hashed. We never receive or store your computer's actual hardware or operating system identifiers. Only the resulting hash is transmitted to and stored on our servers.

We use this hashed device identifier solely to:

• Activate your PraiseMates license on a specific device.
• Enforce the number of devices permitted under your subscription.
• Validate activation and licensing during future authentication or token refresh requests.

This identifier is not used to track your activity, profile your behavior, or serve advertising.

The hashed device identifier is retained only while your account or license remains active. Once your account is permanently deleted or inactive for an extended period in accordance with our data retention practices, the associated device identifiers are also removed from our systems.

Exception — trial abuse prevention: if a device has been used to start a free trial, we keep a permanent record of that device’s hashed identifier and the date the trial began, even after the associated account is deleted. This record is used solely to prevent the same device from claiming a new free trial under a different account, and is not used for any other purpose.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account.
• Authenticate your identity.
• Activate and validate your software license.
• Provide customer support.
• Notify you about subscription expiry or important account-related updates.
• Improve the reliability, security, and performance of PraiseMates.
• Comply with applicable legal obligations.

We do not sell your personal information.

4. Legal Basis for Processing

If you are located in the EU, UK, or Brazil, the legal basis we rely on depends on the purpose:

• Performance of a contract — account creation, authentication, license activation, and payment processing.
• Legal obligation — payment records and other compliance requirements, such as tax or fraud prevention.
• Legitimate interest — customer support, service communications, and keeping PraiseMates secure and reliable.
• Consent — analytics and advertising cookies (Google Analytics, Meta Pixel), given through the cookie banner described in “Cookies, Local Storage & Tracking Technologies” below.

Where processing relies on consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

5. Payment Information

Payments for PraiseMates subscriptions are processed by trusted third-party payment providers, includingRazorpay.

We do not store your complete debit card, credit card, UPI PIN, banking credentials, or other sensitive payment information on our servers.

Any payment information you provide is handled directly by the applicable payment provider in accordance with their own privacy policies.

6. Sharing of Information

We do not sell, rent, or trade your personal information.

We may share information only when necessary, and only with these categories of recipients:

• Payment processing —Razorpay, to process purchases.
• Email delivery — Resend, to send account, subscription, and support-related emails.
• Hosting — Linode, LLC, an Akamai Technologies company, which hosts the server that stores and processes your information.
• Network security and performance —Cloudflare, which sits in front of our servers to protect against abuse and improve performance. Cloudflare sees your IP address, and the country it resolves from that address, for every request.
• Location lookup — when Cloudflare cannot determine your country, we send your IP address toipwho.is and/orip-api.com to look it up. See “Location Information” above.
• When required by law or legal process.
• To protect our rights, users, or the security of our services.

Any third-party service providers receive only the information necessary to perform their services.

7. International Data Transfers

PraiseMates is operated from India, and our server is hosted with Linode, LLC (an Akamai Technologies company) in India. Some service providers we use, such as Resend for email delivery, may process information outside India (for example, in the United States). Cloudflare, which we use for network security and performance (see “Sharing of Information” above), operates a global network and may process your connection metadata — including your IP address — at a data center outside India as part of providing that service. If you access PraiseMates from the EU, UK, Brazil, or elsewhere, your information may therefore be transferred to and processed in a country with different data protection laws than your own.

Where required by law, we rely on appropriate safeguards for such transfers — such as standard contractual clauses or equivalent mechanisms offered by our service providers — to protect your information.

8. Data Security

We take technical and organizational measures to protect your information, including:

Technical measures

• Passwords are never stored in plain text — we use Django’s built-in password hashing (PBKDF2), and enforce minimum length and reject common or purely numeric passwords at account creation.
• Authentication uses short-lived access tokens (15 minutes) paired with longer-lived refresh tokens (7 days), rather than indefinite sessions.
• The desktop application identifies your device using a SHA-256 hash computed on your device; we never receive or store the underlying hardware identifier.
• Authentication tokens cached by the desktop application are encrypted at rest — with Windows DPAPI (bound to your OS user account) or AES-256-GCM on Linux/macOS — never stored in plain text on your device.
• All communication between our applications (desktop app, web dashboard) and our API takes place over HTTPS.
• Password reset and email verification links use cryptographically signed, single-use, time-limited tokens, and expire after 1 hour.
• Payments are verified independently with Razorpay — we cryptographically verify the payment signature, re-confirm the payment status and amount directly with Razorpay’s API, and verify incoming Razorpay webhook requests using a signed HMAC comparison — rather than trusting data submitted by a browser or app.
• Payment and subscription updates are performed inside database transactions, so a failure partway through cannot leave your payment processed without your access being updated.
• Cross-origin requests to our API are restricted to an explicit allowlist of trusted origins.
• Rate limiting is applied to sensitive endpoints, such as sign-up and password reset, to reduce abuse.
• API keys, signing keys, and other credentials are stored as environment variables and are never committed to our source code.

Organizational measures

• Access to production systems and data is limited to the data controller named above.
• We do not store your complete payment card details on our servers — see “Payment Information” above.

While we strive to protect your data, no system connected to the Internet can be guaranteed to be completely secure.

9. Data Retention

We retain your personal information only for as long as necessary to:

• Maintain your account.
• Provide the services you request.
• Comply with legal obligations.
• Resolve disputes.
• Enforce our agreements.

When information is no longer required, we securely delete or anonymize it where reasonably practicable.

In particular, transaction and subscription records — including the country we detected for a given purchase, trial, or free-plan activation — are financial records, and we retain them for as long as required under applicable Indian financial and tax record-keeping laws, and in any case no longer than necessary to resolve disputes or defend legal claims.

10. Your Privacy Rights

You may always:

• Update your account information.
• Choose whether to provide a phone number.
• Contact us to request deletion of your account, subject to legal or operational requirements.

Deleting your account may permanently remove access to your licenses, subscriptions, and associated services.

Depending on where you live, you may also have some or all of the following rights:

• Access — request a copy of the personal information we hold about you.
• Rectification — request correction of inaccurate or incomplete information.
• Erasure — request deletion of your personal information, subject to legal or operational requirements.
• Restriction — request that we limit how we use your information in certain circumstances.
• Portability — request your information in a structured, commonly used, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing already carried out.

To exercise any of these rights, contact us using the details in “Contact Us” below. We may need to verify your identity before responding.

If you are in India, you may raise a grievance with our Grievance Officer named above; if it remains unresolved, you may escalate it to the Data Protection Board of India under the DPDP Act.

If you are in the EU, UK, or EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the “sale” or “sharing” of personal information. We do not sell personal information. Our use of advertising tools such as the Meta Pixel may be considered “sharing” for cross-context behavioral advertising under the CPRA; declining our cookie banner, or browsing with the Global Privacy Control (GPC) signal enabled, opts you out of this.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination for exercising any of these rights.

To exercise these rights, contact us using the details in “Contact Us” below.

12. Children's Privacy

PraiseMates is intended for use by churches, organizations, and individuals who are at least 18 years of age (or the higher age of majority required by the laws of their country). We do not knowingly collect personal information from children, and verify date of birth against the applicable minimum age at signup.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When material changes are made, we will publish the revised version on this page and update the Effective Date above.

Your continued use of PraiseMates after changes become effective constitutes acceptance of the updated Privacy Policy.

14. Cookies, Local Storage & Tracking Technologies

We use Google Analytics and the Meta Pixel to understand how visitors use our website and to measure the effectiveness of our advertising. These are third-party services and are each governed by their own privacy policies.

Neither service is loaded until you accept our cookie banner. If you decline — or if your browser sends a Global Privacy Control (GPC) signal, which we honor automatically — no analytics or advertising cookies are set, and this has no effect on your ability to use the website.

In addition to cookies, we use your browser's local storage to remember your cookie-consent choice across visits so you are not asked again, and a small amount of session-only storage (cleared when you close your browser tab) to support the “manage cookie preferences” flow below. Neither is used for tracking or advertising, and both are cleared if you withdraw consent or clear your browser's site data.

You can change your choice at any time:Manage cookie preferences

15. Contact Us

If you have any questions about this Privacy Policy or how your information is handled, please contact us at:

Email: [email protected]

This includes requests under the GDPR, LGPD, CCPA/CPRA, or other applicable privacy laws.

For general product or billing questions unrelated to privacy, contact[email protected] instead — see ourTerms of Service.