Who we are
Data for Good makes software for churches and nonprofits. Tally helps leaders track and understand their ministry metrics. Lumen lets teams ask questions of their own data in plain language. This policy explains what personal data each product collects, why we collect it, and the choices you have. Use the switch above to read the version for the product you use.
This policy also covers this website, dataforgood.com. Its cookies are listed under Cookies, and its sign-up form under Updates by email.
Our role
Data for Good decides how to handle the data we need to run our products and this website: your account, billing, security, and website data. For that data we are the controller.
The data an organization puts into Tally, or connects to Lumen, belongs to that organization. We process it on the organization's behalf, following its instructions and our agreement with it. It may include information about people who never use our products, such as the members, attendees, or donors in a church's records. If you are one of those people and want to see, correct, or delete that information, contact the organization. We will help it respond.
At a glance
- We collect your account details, your organization's metrics and notes, and your conversations with the AI assistant.
- AI features are powered by Google's paid Gemini service, which doesn't use your data to train or improve its models.
- In the app, optional analytics and ad-measurement cookies run only with your consent.
- We never sell your data or use your organization's data for advertising.
- You can delete your own account, and owners can delete their whole organization.
- Lumen reads from the data sources you connect. It only runs read queries and never changes your systems.
- Results of Extract models are copied into a warehouse dataset reserved for your workspace. Live models store nothing.
- AI features are powered by Google's Gemini models on Google Cloud, which doesn't use your data to train its models.
- Lumen uses no analytics or advertising trackers.
- We never sell your data or use it for advertising.
- You can ask us to export or delete your conversations, your account, or your whole workspace, and we complete deletions within 30 days.
Data we collect
We collect the data you provide directly and a limited set of data generated by your use of the app.
- Account data: your name, email address, role, organization membership, and any profile picture you upload.
- Organization data: the organization profile, campuses (including their addresses), service times, metrics, and the counts and notes your team records, including who wrote each note.
- Imported files: CSV files you upload to import metrics, which we keep so we can troubleshoot imports.
- AI interaction data: the questions you ask the AI assistant, your conversation history, and the preferences and goals you save (or the assistant learns) as AI memories.
- Website data: if you provide your organization's website address, the publicly available content of that website, which we analyze to set up your account.
- Usage data: product analytics events (pages viewed, features used) collected to improve the app, subject to your cookie preferences.
- Technical data: error and crash diagnostics, which can include your IP address and browser details, so we can keep the app reliable.
- Billing data: your organization's name, the billing contact's email, subscription status, and seat counts. Card details are processed by Stripe and never touch our servers.
- Account data: your name, email address, role, and workspace. Sign-in is handled by Google Identity Platform, which stores your password; it is never stored in our database.
- Connection credentials: the login or service-account key you give Lumen to reach a data source. Credentials are stored in Google Secret Manager, never in our database, and are deleted when you delete the connection.
- Catalog data: the names, types, and descriptions of the tables and columns in your connected sources, plus any descriptions and settings your team adds.
- Data from your sources: the results of the models your team builds. See Your connected data below.
- Conversations: the questions you ask, Lumen's answers, the steps and assumptions behind each answer, the data it used, and any charts, which include the rows behind them. Conversations with the modeling and dashboard assistants are kept the same way.
- Attachments: files you attach to a question, which Lumen reads to answer it.
- Feedback: flags your team raises on answers, and the answers your team saves as verified.
- Activity records: a log of account and administrative actions, such as who invited or removed a member, deleted a conversation, or exported data, and when. It records what happened, never the content of your data.
- Technical data: error diagnostics, so we can keep Lumen reliable. Error reports are scrubbed of your data, credentials, and IP address before they leave our servers.
- Billing data: your workspace name, the admin's email, and subscription status. Card details are processed by Stripe and never touch our servers.
How we use your data
We use your data to run the product for you: signing you in, showing your organization its own data, powering the AI features described below, sending the emails you need (such as invitations and reminders), processing billing, and improving the product.
We do not sell your personal data, and we never use your organization's data, metrics, or AI conversations for advertising.
Where the law asks us to name a legal basis, we rely on these:
- Contract: to provide the product your organization signed up for.
- Legitimate interests: to keep the product secure and reliable, to prevent abuse, and to improve it.
- Consent: for optional analytics and advertising cookies, and for updates by email if you sign up for them. You can withdraw consent at any time.
- Legal obligation: for example, to keep billing records for tax purposes.
If you consent to marketing cookies, we use Google and Meta advertising cookies for one purpose only: measuring whether our own ads brought you to Tally (for example, counting signups that came from an ad). Declining marketing cookies never limits what the app can do.
Lumen has no advertising or analytics trackers. To fix problems and test improvements, our team may review conversations and answers, and your admins can see and curate the conversations in your workspace.
Your connected data
- Read-only by design. Lumen only runs single read queries, with a limit on how many rows come back, and never writes to your systems. The permissions of the login you give us are up to you, so we recommend one that can only read.
- Extract and Live. An Extract model runs its query and copies the result into a BigQuery dataset reserved for your workspace; each refresh replaces the previous copy. A Live model runs its query each time it is needed and stores nothing.
- Sensitive columns. Lumen flags columns whose names suggest personal or financial information (for example email, phone, date of birth, address, or giving), and admins choose whether each is excluded, hashed, or allowed. Lumen enforces that choice on everything it copies: an excluded column never leaves your source, and a hashed column is replaced with a one-way hash. Lumen checks a model's query against these settings when the model is created or edited, and again every time it copies data. When an admin tightens a column's setting, Lumen rechecks the affected models: any model that now breaks the settings is hidden from the assistant and can't be published until it's fixed.
- You decide what the assistant sees. A new model is hidden from the AI assistant until someone on your team turns it on.
- Direct source queries are off by default. An admin can let the assistant read directly from your default source when nothing else answers a question. Those reads are limited to 100 rows, sensitive columns are masked, and the answer is marked as coming from ungoverned data.
AI features
We only use paid AI services. Every AI provider we use is a paid, commercial service whose terms don't allow it to use your data to train or improve its models. This is a commitment, and it applies to any provider we add later. Providers may keep data for a limited time to detect abuse, as their terms allow.
Tally's AI features are powered by Google's Gemini models, through the Gemini API and Firebase Genkit. We only send the data each feature needs.
- AI insights and chat: when you view AI-generated insights or ask the assistant a question, we send your organization's name and profile, the relevant metric data, team notes and their authors' names, your first name, and your saved AI memories, so it can answer in context.
- Conversation storage: your conversations with the assistant (including AI-generated summaries of them) are stored with your account so you can continue where you left off and so we can improve the chat experience. Feedback you give on AI responses is stored together with the related prompt and response for quality review.
- AI personalization: the assistant personalizes its answers using AI memories: preferences, goals, and instructions you add yourself, plus preferences it picks up from your conversations. You can view, edit, and delete every memory at any time from the Memories tab in your profile.
- Website analysis: if you share your organization's website during onboarding, we read its public pages and use AI to suggest a description, tone of voice, organization type, and a starting set of metrics. You can review and change every suggestion.
- Monitoring: prompts and responses are also recorded in our Google Cloud logs so we can monitor quality and troubleshoot.
- Training: we use Google's paid Gemini API, under which Google does not use your prompts or responses to improve its products.
- Your metric data and conversations are never shared with other organizations or used to advertise to you.
Lumen's AI features are powered by Google's Gemini models on Google Cloud (Vertex AI). To answer a question, the assistant receives:
- your question and the earlier messages in the conversation;
- your workspace's context and guides;
- the names and descriptions of the tables, columns, and models your team has turned on for AI;
- the query results it needs, up to 200 rows at a time;
- any files you attach.
Training: under Google Cloud's terms, Google does not use this data to train its models.
Where AI requests run: the default model runs on Google's global endpoint, so AI requests may be processed outside the United States.
Your own AI provider: if your workspace connects its own AI provider account, using your organization's API key, your workspace's AI requests go to that provider under your organization's agreement with them. That agreement, including whether the provider may use your data for training, governs how they handle it; our paid-services commitment covers the AI accounts we operate.
Using Lumen from Claude: if you connect Lumen to your own Claude account, the questions you ask there and Lumen's answers go to Anthropic under your own agreement with them.
Updates by email
If you sign up for updates on this website, we collect your first name, last name, and email address. We use them only to send you occasional emails from Data for Good about what we're building and learning, and we rely on your consent, which you give by signing up.
- Where they're kept: on our mailing list, which Squarespace hosts. The form sends your details straight to Squarespace; our own servers don't keep a copy.
- Opens and clicks: Squarespace records whether our emails are opened and which links are clicked, so we can see what's useful.
- Unsubscribing: every email has an unsubscribe link. Unsubscribing from updates doesn't affect a Tally or Lumen account, or the emails it needs, such as invitations.
- How long we keep them: while you're subscribed. After you unsubscribe, your contact record stays on the list, marked as unsubscribed, so we don't email you by mistake. To have it deleted, email support@dataforgood.com.
Service providers
We share data with a small set of providers that help us run the service. Each receives only the data needed for its job.
This website (dataforgood.com)
| Provider | What they do for us |
|---|---|
| Hosting, including the sign-up form, and Google Analytics only with your statistics consent. | |
| Amplitude | Website analytics, only with your statistics consent. |
| Meta | Advertising conversion measurement, only with your marketing consent. |
| Cookiebot | Consent management. |
| Squarespace | Our mailing list, only if you sign up for updates: keeps your name and email address and sends the updates, with open and click tracking. |
| Provider | What they do for us |
|---|---|
| Hosting, database, file storage, sign-in (including optional Google Sign-In), analytics (with consent), the Gemini AI models, and logging. Google Ads conversion measurement only with your marketing consent. | |
| Amplitude | Product analytics (with consent), and delivery statistics for our emails (sent, opened, clicked), recorded with a hashed email address. |
| Sentry | Error monitoring. |
| Stripe | Payments. |
| SendGrid | Transactional email, with open and click tracking. |
| Productlane | The in-app feedback widget (with consent). |
| Cookiebot | Consent management. |
| Meta | Advertising conversion measurement, only with your marketing consent. |
| OpenWeatherMap | Receives campus city and coordinates to show weather alongside your metrics. |
| Provider | What they do for us |
|---|---|
| Cookiebot | Consent management. |
| Google Cloud | Hosting, database, data warehouse (BigQuery), file storage, credential storage (Secret Manager), sign-in (Identity Platform), the Gemini AI models (Vertex AI), and logging. |
| Stripe | Payments. |
| Sentry | Error monitoring. Reports are scrubbed of your data, credentials, and IP address before they're sent. |
| SendGrid | Invitation and account emails. |
| Slack | Only if your workspace connects it: lets your team ask Lumen questions from Slack. |
| Your AI provider | Only if your workspace connects its own AI provider account: handles your workspace's AI requests under your organization's agreement with them. |
| Anthropic | Only if you connect Lumen to your own Claude account (see AI features). |
Where your data is stored
TallyTally's data is stored in the United States on Google Cloud. Some of our providers may process data in other countries.
LumenLumen stores your data in Google Cloud's us-central1 region (Iowa, United States). Two exceptions: AI requests may be processed outside the United States (see AI features), and Google Secret Manager keeps copies of credentials in locations Google chooses.
If you use our products from outside the United States, your data is transferred to the United States. Where the law requires, we rely on safeguards such as the Standard Contractual Clauses in our providers' data processing terms.
Data retention and deletion
We keep your organization's data for as long as its Tally account is active.
You can delete your own account at any time from your profile page, and admins can delete a member from the settings page. Deletion anonymizes your personal data (notes you wrote stay with your organization, credited to "Former member"), removes your AI conversation history and AI memories, deletes your profile pictures and the files you imported, asks Amplitude to delete your analytics history, and permanently deletes your sign-in credentials.
Organization owners can delete their entire organization from the settings page. Organization deletion has a 30-day grace period during which an owner can restore it; after that, all organization data, member accounts, and uploaded files are permanently and irreversibly purged.
Deleted data can remain in encrypted backups for a short time until they expire. We use backups only to recover from a failure, never to bring back data you deleted.
We keep your workspace's data for as long as the workspace is active. To delete a conversation, your account, or your whole workspace, or to get a copy of your data, email support@dataforgood.com from the address you use to sign in to Lumen. We confirm workspace-wide requests with an admin, and we complete deletions within 30 days.
- A conversation: the person who started it, or an admin, can have it deleted. Deletion removes its messages, answers, charts and the rows behind them, the steps and data behind each answer, and its attachments, and removes it from any flags and shared links.
- Your account: you can leave a workspace, which deletes your account (your name and email address) and your sign-in. The conversations you started stay with the workspace, shown as "Former member," unless you ask us to delete them too. A workspace's last admin can leave only after naming another admin.
- Members: admins can remove a member from the Admin console, which deletes the member's account and sign-in. Their conversations stay with the workspace, shown as "Former member," unless an admin asks us to delete them.
- A whole workspace: an admin can have the workspace deleted. It's locked right away, and within 30 days everything in it is permanently deleted: conversations, the catalog, guides, models and the data they copied, dashboards, connections and their stored credentials, member accounts, and our billing records. Stripe keeps its own payment records as the law requires.
- Connections and models: deleting a connection deletes its stored credentials, and deleting a model deletes the data it copied.
- A copy of your data: admins can get an export of the workspace's conversations (including the data behind their charts), table and column descriptions, guides, and model queries. Any member can get an export of their own conversations. Exports are JSON files.
If your subscription ends, your workspace is locked but not deleted, so you can come back to it. Ask us and we will delete it.
After a deletion, copies can remain in encrypted backups and in our cloud provider's recovery systems for up to 14 days, until they expire. We use them only to recover from a failure, never to bring back data you deleted. Activity records (who did what, and when, never the content of your data) are kept after a deletion as a record that it happened.
Security
Your data is encrypted in transit and at rest on Google Cloud, and each organization's data is kept separate from every other organization's.
TallyDatabase rules restrict each organization's data to its own members and roles.
LumenLumen's databases sit on a private network with no public address, source credentials live only in Google Secret Manager, and each part of the system runs with only the permissions it needs.
If a security incident affects your personal data, we will tell the affected organizations without undue delay, and notify you and the authorities where the law requires.
Children
Tally and Lumen are for organizations and the adults who work or volunteer with them. This website and our products aren't directed to children, and we don't knowingly create accounts for, or collect personal data directly from, children under 13. If you believe a child has given us personal data, contact us and we will delete it.
An organization's own records can include information about minors, such as attendance in a children's ministry. The organization is responsible for having the right to share that information with us, and we process it only on its behalf.
Your rights
Depending on where you live, you may have rights to access, correct, export, or erase your personal data, and to object to or restrict certain processing. We respond to verified requests within the timeframes required by applicable law.
TallyYou can exercise deletion directly in the app, and any other right by contacting us.
LumenAdmins can remove members in the Admin console. You can exercise any other right, including access, export, and deletion, by contacting us.
We don't sell personal data. On this website and in Tally, advertising cookies run only if you opt in. They let Meta and Google measure whether our ads worked, which some US state laws call "sharing" personal data for advertising. You can opt out at any time with the Cookie settings link. Lumen uses no advertising cookies.
We won't treat you differently for exercising your rights. If we can't resolve a concern, you may have the right to complain to your local data protection authority.
Changes to this policy
When we change this policy, we will update the effective date at the top. If a change is significant, we will let you know in the product or by email before it takes effect, and Tally and Lumen may ask you to review and accept the new version the next time you sign in. Earlier versions are available on request.
Contact
For any privacy question, or to exercise your rights, email us at support@dataforgood.com.