Privacy Policy

Last updated: October 7, 2026

Who we are

Shepherd and the other services at extant2000.com are operated by Extant 2000 LLC (“we,” “us”), the company behind Shepherd, Hitt Hosting, and related products. Questions about this policy or your data can be sent to privacy@extant2000.com.

Postal mail: Extant 2000 LLC, 7051 Brookfield Plz, Springfield, VA 22150, USA.

Our role: controller and processor

When a church or organization uses Shepherd to manage their members’ information, that organization is the data controller and Extant 2000 LLC acts as their processor: we store and process the data on their instructions and do not use it for our own purposes or sell it. Members should direct requests about their data to their church, and we assist the church in fulfilling them.

Shepherd is a software platform, not a church. Extant 2000 LLC is a for-profit company and does not solicit tax-deductible donations. Where a congregation collects gifts through Shepherd, those gifts go directly to that congregation through its own account.

Information we collect

Account and contact details for people who sign up.
Billing information: payments are handled by Stripe; we do not store full card numbers.
Usage and log data (such as IP address, pages viewed, and timestamps) used to operate and secure the services.
Information organizations enter into Shepherd, which, where a church enables those modules, may include member records and sensitive information such as children’s medical or allergy details, volunteer background-check results, and notes submitted to pastoral staff.

Analytics and error reports

Shepherd counts visits with Pulse, analytics software Extant 2000 runs at crm.hitthosting.com: it records the pages you view, the page that sent you, your browser, device, language, screen size and time zone, and how long you stay, stores codes that reset each day and each month instead of your IP address, sets no cookie of its own, and ignores browsers that send Global Privacy Control or Do Not Track. If you clicked a link in one of our emails in the last 30 days, a cookie set by that click lets Pulse match your visits to our record of you.

Shepherd sends error reports to Sentry, and Sentry’s Session Replay records about 10% of visits to this site and every visit in which an error occurs.

Sensitive information

Sensitive modules are available only when a church enables them, and access within a church’s account is limited to the roles that church authorizes. We handle this information solely to provide the service to the church.

The Shepherd mobile app

If you use the Shepherd mobile app, it may access additional information on your device, always with your permission:

Camera and photos: only when you choose to take or upload a photo (for example, a member or child profile photo, or a check-in). We do not access your camera or photo library in the background.
Face ID and biometric unlock: if you enable it, your device uses Face ID or Touch ID to unlock the app. This happens entirely on your device, and we never receive your biometric data.
Push notifications: if you allow them, we store a device push token so we can send notifications you have opted into. You can turn these off in your device settings.
Crash and diagnostic reports: to keep the app working, we collect crash and error diagnostics through Sentry (a United States service provider); these are used to fix problems, not to advertise to you.

Where your data is hosted

Your data is stored and processed in the United States, on infrastructure we operate in Warrenton, Virginia. We do not store your data outside the United States.

How we secure it

Encryption in transit: all connections use TLS/HTTPS.
Encryption at rest for the most sensitive records: confessions and pastoral responses are encrypted in the database with a key held outside it, so they are unreadable in a database backup or a stolen copy of the database. We hold that key, so this is encryption at rest, not end-to-end encryption: our systems can still decrypt these records to show them to authorised church leaders, and we could be compelled to disclose them.
US-based hosting: data is stored on infrastructure we operate in the United States, with restricted administrative access.
Role-limited access: within a church’s account, sensitive modules are limited to the roles that church authorizes.
Payments: where a church collects gifts, card payments are processed by Stripe (PCI-DSS Level 1); full card numbers never touch our systems.
Backups: data is backed up regularly.

We do not claim SOC 2, ISO 27001, HIPAA, ITAR, FedRAMP, or PCI certification. No method of transmission or storage is completely secure.

Service providers (subprocessors)

We share data only with the service providers needed to run the service, under contract and only as required:

Stripe: payment processing (US).
OVH US: server hosting in Virginia.
Cloudflare: DNS.
Sentry: error reports and session recordings (US).

Email is sent from our own mail servers; we do not use a third-party email provider. We do not sell personal data, and we may disclose data if required by law.

Retention

We keep personal data while an account is active and as needed to provide the service and meet legal obligations, after which it is deleted or anonymized. A church can request export or deletion of its data at any time.

Your rights

You may have rights to access, correct, delete, or export your personal data. For information held in a church’s Shepherd account, contact your church; for information Extant 2000 LLC controls directly, contact privacy@extant2000.com.

Your US state privacy rights

If you live in California, Virginia, Colorado, Connecticut, Texas, Oregon, or another US state with a consumer-privacy law, you have the right to know what personal data we hold about you, to request its correction or deletion, and to receive a copy. We do not sell your personal data, and we do not share it for cross-context behavioral advertising. Exercising these rights will not get you worse treatment. To make a request, email privacy@extant2000.com; we may need to verify your identity first.

Changes

We will post changes on this page and update the date above.