Skip to content
MyChurchSGO

Privacy Policy

Last updated: 2026-10-03

The SGO Company, LLC (“we”, “us”, “our”), which operates MyChurchSGO, provides a platform for Scholarship Granting Organizations (SGOs), their donors, and scholarship applicants. We take the privacy and security of personal information seriously, especially the sensitive financial and identity information involved in a federal §25F scholarship tax-credit program. This policy explains what we collect, how we use and protect it, who we share it with, and the choices you have.

Information we collect

  • Account information — your email address, role, and organization membership.
  • Donation and payment information — donation amounts and history. Card and bank payments are processed by our payment processor; we do not store full card numbers.
  • Scholarship application information — including sensitive personally identifying information such as Social Security or Taxpayer Identification Numbers, household income, date of birth, and legal names, plus supporting documents (e.g. tax returns and proof-of-income files) you upload.
  • Compliance information — records required to administer and report the §25F program (e.g. donor tax-credit attribution and eligibility records).
  • Technical information — standard server logs (IP address, request timestamps) and essential cookies needed to keep you signed in.

How we use information

We use the information you provide to operate the platform, deliver donor and tax receipts, process and evaluate scholarship applications, comply with §25F federal reporting and recordkeeping requirements, secure the platform and prevent fraud, and communicate with you about your account. We do not sell personal information.

How we protect information

Sensitive identity and financial fields (such as SSN/TIN, income, date of birth, and legal names) are encrypted at the application layer with AES-256-GCM, with the encryption key held in a managed key-management service (AWS KMS) rather than on the application servers. Uploaded documents are stored in encrypted object storage, off the application server, and are accessible only through short-lived signed links. Access to personal information is restricted and audited, and certain filed records (e.g. issued receipts and compliance reports) are written to immutable storage.

How we share information

We share information only as needed to run the service: with service providers (processors) who act on our behalf — payment processing (Stripe), email delivery (Amazon SES), cloud and object storage (Amazon S3, Cloudflare R2), key management (AWS KMS), and content delivery, security, and anti-abuse (Cloudflare) — and where required for legal and §25F compliance (for example, reporting to the relevant tax authority). We do not sell or rent personal information, and we do not share it for third-party advertising.

Postal addresses are handled separately, and are described in full under “Checking postal addresses” below.

QR codes are also handled separately: the one on our share panels is drawn by an outside service, which therefore sees the address of the page and your IP address. It is described in full under “QR codes on shared pages” below.

Checking postal addresses

Each year an SGO reports every §25F donor’s name and address to the IRS, so a mistyped address puts a wrong record in that report. To catch that, the platform can check a US address against the United States Postal Service (USPS), the authority on whether an address is real and deliverable.

As of 2026-10-03, this check is switched off. The platform is built for it, but we hold no Postal Service credentials, so no address is sent to the Postal Service. We will update this page before that changes. The rest of this section describes what happens once it is switched on.

Step by step, when an address is checked:

  1. You add or change an address on your donor profile, or an administrator changes an SGO’s organization address.
  2. Our server — not your browser — sends the address to the Postal Service. Your IP address and browser details are therefore never sent to them, and the request carries the address only: not your name, not your email address, not your account.
  3. The Postal Service tells us whether it can match the address, and returns its standard form of it — for example, the four extra digits of a ZIP+4 code.
  4. We store that standard form next to the address you entered. We never overwrite what you typed, and we never change your state for you: if the Postal Service returns a different state, we keep using the state you entered, and the Postal Service’s version counts only once you change your address yourself to match.

We send an address only when it changes. Saving a form without touching the address — editing your phone number, for example — sends nothing.

Whose addresses. Donor mailing addresses, and the physical and mailing addresses of an SGO organization. Applicant and guardian addresses are not sent to the Postal Service.

What we keep. The standard form of the address stays on the record it belongs to, next to the address you entered, with the date it was checked; it is kept for as long as that record is, under “Data retention” below. We also keep a record that a check happened and what it concluded — that record never contains the address itself. Separately, we hold the Postal Service’s answer — which includes the standard form of the address — in a short-term cache on our own servers for up to seven days, so that saving the same address twice does not send it twice; that cache is indexed by a one-way hash of the address, not by the address. We do not control what the Postal Service does with a request it receives.

Help filling in an address

Filling in city and state from a ZIP code. Address forms can fill in the city and state once you have typed a complete US ZIP code. When you do, your browser sends the ZIP code — its first five digits only, and nothing else you have typed into the form — to our own server, which answers it from a list of ZIP codes and place names we hold ourselves. No third party is involved. A partly typed ZIP code is not sent at all.

We fill a field only when it is empty and the ZIP code has one unambiguous answer for it; where it has several, we show them as buttons and change nothing until you press one. We never replace something you have typed. No ZIP code list ships with the platform, so until an operator loads one this lookup always comes back empty and nothing is filled in or offered.

Street suggestions as you type. The street line of an address form is built to offer suggestions once you have typed a few characters. What you have typed there, together with the state you have chosen, is sent to our own server to ask for them. We have not contracted a suggestion provider, so that request comes back with an empty list and no suggestions appear. We will name any such provider here before it is switched on, because a real one would receive part of your home address.

QR codes on shared pages

A share panel with a QR code in it appears on an SGO’s page in our public directory, on a school fundraising campaign page, and on the panel an SGO administrator sees for their own public page. We do not draw that code. Your browser fetches it as an image from a third-party service at api.qrserver.com, and to do that it has to tell that service which web address to put in the code — the address of the public page the panel is offering to share.

Like any request a browser makes, that one also carries your IP address and the details your browser sends about itself. It does not carry your name, your email address, or your account, and it does not carry anything you have typed. The web address it does carry is a public one: on an administrator’s panel it is the SGO’s own public page, not the administration screen they are standing on.

The image loads as soon as one of those pages opens, so there is no setting that switches it off. A browser or extension that blocks third-party images will stop it, and the rest of the page works without the code.

Data retention

Financial and compliance records are retained for the periods required by IRS and §25F recordkeeping rules; filed receipts and compliance reports are kept in immutable storage for the required retention period. Other personal information is retained for as long as your account is active or as needed to provide the service, after which it is deleted or de-identified, subject to those legal retention obligations.

Your choices

You may request access to, correction of, or deletion of your account information by contacting info [at] mychurchsgo [dot] org. Compliance-required financial records may be retained even after an account is closed, per IRS recordkeeping rules. Marketing emails include a one-click unsubscribe and a preference center; opting out is honored promptly and does not affect transactional messages (such as receipts) you still need.

Applicants who are minors

Some scholarship applicants are minors. A parent or legal guardian represents a minor’s interests on the platform, and we collect a minor’s information only as necessary to administer the scholarship program, with guardian involvement.

Cookies

We use essential cookies to keep you signed in and to protect forms against automated abuse (via Cloudflare Turnstile). We do not use third-party advertising or cross-site tracking cookies.

Updates

We may update this policy from time to time and will post the revised policy with an updated “Last updated” date. We will communicate material changes to registered users by email.

Contact

Questions about this policy or your information: info [at] mychurchsgo [dot] org.

This is an interim policy for the current pre-launch phase; the binding version is being finalized with legal counsel before public launch.