Privacy Policy

Effective as of: 2026-08-22

Status: Draft — placeholder legal entity and contact details below must be completed before this policy is finalized.

1. Who we are and what this policy covers

This Privacy Policy describes how [LEGAL ENTITY NAME] ("Shepherd," "we," "us," or "our"), operating the Shepherd application, collects, uses, and shares personal information about staff users who create or use a Shepherd account.

Shepherd is a CRM product used by coaching and counseling organizations. This policy covers Shepherd as the controller of staff account data only (for example, your login identity, profile, and notification preferences).

This policy does not cover personal information that an organization stores about its contacts, form respondents, households, or payments. That information is controlled by the organization that uses Shepherd. See If you submitted a form to an organization using Shepherd.

2. Information we collect

Account and profile information

When you sign in with WorkOS, we store identity and profile data needed to operate your account, including:

• Email address
• Name (if provided by your identity provider)
• Avatar URL or an uploaded avatar image
• WorkOS user identifier and authentication token identifier
• Organization membership and role (owner, admin, or staff)
• Account creation and last login timestamps
• Optional UI preferences (such as theme or density)
• Optional preferred notification email address and its verification status

Authentication cookies

We use first-party cookies that are strictly necessary to sign you in and protect the login flow. We do not use advertising or analytics cookies.

Local and session storage on your device

Some features store data only in your browser:

• Public form drafts under keys like shepherd-form-draft-{formId} (answers you type before submitting)
• Form builder layout preferences (for example splitter panel sizes)
• Short-lived session storage used when duplicating a form (source title for a one-time notice)

Draft form answers stay on your device until you submit or clear them. They are not uploaded as drafts to Shepherd's servers.

Information we do not collect through Shepherd's application code

To our knowledge, Shepherd's application code does not:

• Load third-party analytics or advertising pixels
• Log visitor IP addresses or user-agent strings for tracking
• Enable open or click tracking on transactional emails we send via Resend

When an organization takes payments on a Shepherd form, card details are entered into fields hosted by Square and go directly to Square. Shepherd receives only a single-use payment token, never card numbers, and does not store card details.

3. How we use information

We use staff account information to:

• Authenticate you and keep your session secure
• Authorize access within your organization based on your role
• Display your profile in the product
• Send transactional and operational email (for example verification messages or staff notifications you configure)
• Maintain security, troubleshoot issues, and improve reliability
• Comply with law and enforce our terms

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

4. Service providers (subprocessors)

We use the following service providers to operate Shepherd. They process personal information only as needed to provide their services to us:

Organizations that take payments connect their own Square account. Square processes those payments for the organization, as the merchant, under Square's own terms and privacy notice; it is not a service provider to Shepherd.

Organizations that connect Google Workspace may cause contact email addresses they control to be synced to Google Groups. That processing is performed for the organization as controller; see the form-respondent section below.

5. Retention

We retain staff account information while your account remains active.

We do not currently run automated purge jobs that delete expired verification or recovery tokens, or that permanently erase all historical records on a fixed schedule. When you request deletion of your staff account data, we will delete or de-identify it as described in Your privacy rights, subject to information we must keep for legal, security, or financial record-keeping reasons.

6. Security

We use industry-standard safeguards appropriate to the nature of the data we hold, including:

• Encrypted connections (HTTPS / TLS) in transit
• HttpOnly, SameSite session cookies for authentication
• Organization-scoped access controls in the application
• Role-based permissions (owner, admin, staff)

No method of transmission or storage is completely secure. We encourage you to use a strong unique password with your identity provider and to notify us promptly of any suspected unauthorized access.

7. Your privacy rights

Depending on where you live (including under the California Consumer Privacy Act / CPRA and similar U.S. state laws), you may have rights to:

• Know what personal information we collect about you
• Access a copy of your personal information
• Correct inaccurate personal information
• Request deletion of personal information
• Opt out of “sale” or “sharing” for cross-context behavioral advertising (we do not sell or share for that purpose)
• Non-discrimination for exercising your rights

How to submit a request: email [PRIVACY CONTACT EMAIL] from the email address registered on your Shepherd account. We may need to verify your identity using that registered email address before fulfilling the request.

We aim to respond within 45 days of receiving a verifiable request, or within the time allowed by applicable law.

8. If you submitted a form to an organization using Shepherd

If you filled out a public form, made a payment, or otherwise interacted with an organization that uses Shepherd, that organization is the controller of your personal information. Shepherd processes that information on the organization's instructions as a service provider / processor.

Please contact the organization that collected your information to exercise privacy rights related to:

• Form answers and free-text responses
• Contact or household records
• Program enrollment
• Payment and receipt records associated with that organization

Payments on forms go to the organization's own Square account. The organization is the merchant: contact it about a charge, a refund, or a dispute (organizations handle disputes in Square). Square's privacy notice applies to the card details you enter. Shepherd does not add a fee to these payments.

Shepherd staff accounts are separate from form-respondent data. This Privacy Policy explains Shepherd's practices for staff accounts; it is not the organization's privacy notice to you.

9. Health information and HIPAA

Shepherd is not a HIPAA-covered entity and does not offer a Business Associate Agreement for protected health information (PHI). Do not use Shepherd to store or transmit PHI or other regulated health records. Organizations are responsible for ensuring their use of Shepherd complies with applicable professional and privacy obligations.

10. Minors

Shepherd staff accounts are not directed to individuals under 18. Organizations that enter information about minors (for example youth-program contacts) are responsible for obtaining any required parental or guardian consent and for their own compliance obligations. Shepherd does not knowingly collect staff account information directly from children under 13.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and post the updated policy at this URL. Material changes may also be communicated through the product or by email when appropriate.

12. Contact us

[LEGAL ENTITY NAME]
[MAILING ADDRESS]
Privacy requests: [PRIVACY CONTACT EMAIL]

If you have questions about this policy, contact us at the email address above.