Who operates Dovestead?
Dovestead is operated by Yannick Meyer, a German sole proprietor trading under the name Dovestead. The public postal address is stated in the Legal Notice. For privacy questions, write to hello@dovestead.com.
Information and purposes
When you visit the Dovestead marketing site, the server necessarily receives the technical information needed to deliver the requested page. The marketing site does not use analytics, advertising pixels, or embedded third-party media.
When an authorized church representative creates or uses an account, we process account and sign-in details, organization and membership information, website settings and content, uploaded media, domain settings, support requests, and operational/security data needed to provide, protect, and troubleshoot the service. We use this information to create and administer accounts, host church websites, provide the dashboard, respond to support, prevent misuse, and meet legal obligations.
For Dovestead subscriptions, Stripe Checkout collects billing information including a billing address and business name, and allows a tax identification number to be provided. Dovestead receives the payment and subscription references and statuses needed to manage the account. Stripe handles payment credentials through its own payment service; Dovestead's application does not receive full payment-card numbers.
If a church enables online giving, donations are processed through Stripe Connect for that church's connected account. The church is the intended recipient of the donation. Dovestead receives the transaction and status information needed to operate the giving feature and may receive the configured 1% platform application fee. Do not send donor payment-card details to Dovestead by email or form.
If an administrator connects YouTube, Dovestead uses the read-only YouTube API permission requested in the connection flow to identify the channel and retrieve active or upcoming broadcast information. The OAuth credential is stored encrypted so the feature can continue to work; administrators can disconnect the integration in Watch Live. If Google reports that authorization has been revoked, Dovestead removes the local connection and its YouTube status cache.
Dovestead uses Brevo to send transactional account and service messages, including verification, activation, recovery, and other account notices. These are operational messages, not marketing newsletters.
Prospective customers and direct outreach
Dovestead may use church or organization names, public website details, business contact details, source information, and demo references to assess whether the service may be relevant and to prepare a private demo. The Sales flow records limited server-side events needed to operate the demo, trial, and purchase steps. A referral reference is used only when included in the existing server-side demo record or explicitly supplied in the current link; the optional browser tracking cookies described in the Cookie Notice are not used. Where permitted by applicable law, Dovestead may send a tailored business introduction or follow-up. A person may object to direct marketing at any time by contacting hello@dovestead.com; Dovestead will stop using that person's contact details for direct marketing and may retain the minimum information needed to honor the objection and comply with law.
Our role and church visitor data
Dovestead acts for its own purposes when administering platform accounts, subscriptions, security, and customer support. A church decides whether to publish contact, prayer, pastoral-care, ministry-sign-up, or other forms and why it wants to receive those submissions. Depending on the actual service and instructions, the church may be controller and Dovestead may be processor for some submitted information. The roles must be assessed for each activity and documented in the applicable customer agreement and, where required, a completed Data Processing Agreement.
A form submission may contain a person's name, email, phone number, postal address, and free-text message. Prayer or pastoral-care messages may reveal religious beliefs or other sensitive information. The church is responsible for its visitor-facing notice, collection choices, access decisions, and response to submissions. Dovestead's platform Privacy Policy is not a church's privacy notice and does not determine the church's legal basis or any special-category condition.
Legal bases where the GDPR applies
For authorized representatives' account administration, sign-in, security, and support, Dovestead relies on its legitimate interests in providing and protecting the service used by the customer's organization (Article 6(1)(f) GDPR). Where an individual is personally a contracting customer, processing necessary to take steps at that person's request or perform that contract may instead rely on Article 6(1)(b). Billing records are processed to administer the subscription and, where applicable, to comply with legal obligations (Article 6(1)(c)). The church's visitor submissions are processed on the church's documented instructions where Dovestead acts as processor; the church determines and provides the legal basis for that processing.
For church-prospect research and tailored business outreach, Dovestead relies on its legitimate interests in assessing whether its service may be relevant to a church or organization and communicating with its business contacts (Article 6(1)(f)), subject to the person's rights and any applicable direct-marketing rules. This does not itself authorize unsolicited electronic marketing where separate consent or another permission is required. Contact details are obtained from public church or organization websites and other publicly accessible organization sources, including published staff/contact pages and directories, or are supplied directly by an organization representative. Categories include organization name and address, publicly listed contact name, role, work email or telephone, source URL, and related business correspondence or suppression information.
If you object to direct marketing, Dovestead will stop using your personal data for that purpose. The right to object is explained below. We retain only the minimum suppression information needed to respect that objection.
Service providers and processing locations
OVHcloud hosts the Customer application, database, and uploaded assets in Beauharnois, Québec, Canada (region BHS6). OVHcloud's Canadian contract materials include a Personal Information Protection Agreement for customer data processed on instructions. Stripe handles Dovestead subscription billing and Stripe Connect giving; Stripe's DPA describes Stripe's processor and controller roles separately and identifies transfers to Stripe, LLC in the United States and transfers by affiliates and subprocessors in other jurisdictions. Brevo sends transactional account and service email. Brevo states that its database hosting is within the European Union, using OVH infrastructure in France and Germany and Google Cloud in Belgium; its DPA is included in its service terms. Google provides the optional YouTube API connection. Google's published transfer framework describes the EU-U.S. and Swiss-U.S. Data Privacy Framework and the UK extension, and its terms apply to Google processing under that service. Provider contracting entities, selected products, roles, and applicable transfer safeguards depend on the relevant account agreement and processing path; the Customer Processing Schedule records those details for church visitor-data processing. Public provider documents: OVHcloud contracts (https://www.ovhcloud.com/en-ca/terms-and-conditions/contracts/), Stripe DPA (https://stripe.com/legal/dpa) and Data Transfers Addendum (https://stripe.com/legal/dta), Brevo DPA information (https://help.brevo.com/hc/en-us/articles/15403782599570-Where-can-I-find-the-Data-Processing-Agreement-DPA) and data-location statement (https://help.brevo.com/hc/en-us/articles/360001005510-Data-storage-location), and Google's transfer framework (https://policies.google.com/privacy/frameworks?hl=en_GB).
Customers manage their own domain registration and DNS settings with their chosen provider; Dovestead does not change DNS records on the customer's behalf.
Retention
Account and membership information is kept while the account and organization remain active and for as long as reasonably needed afterward to administer access, address disputes or security issues, and meet legal obligations. Website content and uploaded assets remain available during the service and any recovery or reactivation period. Ordinary subscription cancellation does not itself start permanent account deletion.
Inbox submissions and Sermons that a church explicitly archives are subject to the product's 90-day archive-retention rule. This rule does not cover unarchived submissions or all website content. No fixed period is established for permanent account closure, tenant export, and removal from backups; requests are handled individually, accounting records may be retained for legal periods, and backup copies may persist after active data is removed. Contact hello@dovestead.com to request access, export, or deletion.
Church-prospect contact and private-demo records are reviewed at least quarterly. If there has been no meaningful business interaction for 12 months, and there is no active customer relationship, open request, legal hold, or other documented legal need, we delete or anonymize the prospect's contact details and expire or remove the associated demo records. An objection to direct marketing is acted on promptly; only the minimum suppression information needed to honor the objection may be retained. This review is a manual operational process, not an automatic deletion timer. YouTube API data is handled under Google's applicable API data policies.
Recipients and international transfers
OVHcloud hosts the Customer application, database, and uploaded assets in Beauharnois, Québec, Canada (region BHS6). OVHcloud's Canadian contract materials include a Personal Information Protection Agreement for customer data processed on instructions. Stripe handles Dovestead subscription billing and Stripe Connect giving; Stripe's DPA describes its processor and controller roles separately and identifies transfers to Stripe, LLC in the United States and transfers by affiliates and subprocessors in other jurisdictions. Brevo sends transactional account and service email. Brevo states that its database hosting is within the European Union, using OVH infrastructure in France and Germany and Google Cloud in Belgium; its DPA is included in its service terms. Google provides the optional YouTube API connection. Google's published transfer framework describes the EU-U.S. and Swiss-U.S. Data Privacy Framework and the UK extension. A published framework or provider DPA does not establish that a particular mechanism applies to every Dovestead processing path: the relevant provider entity, selected service, role, recipient, and mechanism are determined by the account agreement and processing flow and are recorded in the Customer Processing Schedule where church visitor data is in scope. Public provider documents: OVHcloud contracts (https://www.ovhcloud.com/en-ca/terms-and-conditions/contracts/), Stripe DPA (https://stripe.com/legal/dpa) and Data Transfers Addendum (https://stripe.com/legal/dta), Brevo DPA information (https://help.brevo.com/hc/en-us/articles/15403782599570-Where-can-I-find-the-Data-Processing-Agreement-DPA) and data-location statement (https://help.brevo.com/hc/en-us/articles/360001005510-Data-storage-location), and Google's transfer framework (https://policies.google.com/privacy/frameworks?hl=en_GB).
Your privacy choices and rights
Depending on the law that applies to you, you may have rights to request access, correction, deletion, portability, restriction, or objection, and to withdraw consent where processing relies on consent. Contact hello@dovestead.com. If your request concerns a message sent to a church, contact that church as well; it determines the purposes for those submissions. We may need to verify a request and retain information where the law requires it. If the GDPR applies, you may complain to a supervisory authority. The competent authority for Dovestead's establishment in Bavaria is generally the Bavarian State Office for Data Protection Supervision (BayLDA); information and its complaint form are available at https://www.lda.bayern.de/de/beschwerde.html. If you connected a YouTube account, you can revoke Dovestead's access in your Google security settings at https://security.google.com/settings/security/permissions. For YouTube API data handling, see the Google Privacy Policy at https://policies.google.com/privacy. You can also disconnect within Watch Live; Dovestead removes the active connection and requests token revocation. An encrypted credential may be retained temporarily where needed to retry a revocation request.
Cookies and similar technologies
The Dovestead marketing website does not use analytics or advertising technologies. The separate app.dovestead.com service uses session, CSRF, and other strictly functional cookies needed for sign-in, account setup, security, and requested dashboard workflows. The optional cookies named dovestead_sales_funnel and dovestead_outreach_ref are disabled and are not read or set; the Sales flow expires legacy copies when a Sales page is requested. Stripe-hosted Checkout may use technologies controlled by Stripe under its own notices and settings.
Church websites may use external video, maps, giving, or other embedded services selected by the church. Those services may use their own cookies or similar technologies. This platform notice does not replace a church's visitor-facing privacy or cookie information; the church should assess the providers and choices on its own site.
You can manage or remove cookies through your browser settings. Blocking necessary account-service cookies may prevent sign-in or other requested features. Dovestead's optional Sales tracking cookies remain disabled; any future analytics, advertising, or other non-essential storage or access will remain disabled until the required legal basis and consent controls are in place. For questions, contact hello@dovestead.com.
Children
Dovestead accounts are intended for adults authorized to act for a church or organization. Church websites may be visited by people of any age, and a church may receive form submissions from minors. The church must decide whether and how it may collect those submissions and provide appropriate information to its visitors.
Updates and contact
We may update this notice when the service or its processing changes. Privacy questions: hello@dovestead.com.