Privacy Policy

The Luke 10:28 Project LLC

Effective Date: June 10, 2026
Last Updated: June 10, 2026
Version: 4.0

1. Who We Are

The Luke 10:28 Project LLC is a Tennessee limited liability company that operates a Christian formation and wellbeing platform built around The Greatest Commandment Model™. The Platform may include assessments, reports, reflection tools, formation resources, practitioner-supported workflows, church or organizational access, subscriptions, mobile applications, research and validation activities, benchmarking, aggregate reporting, and related services.

References to "The Luke 10:28 Project," "we," "us," and "our" mean The Luke 10:28 Project LLC.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you access or use our websites, applications, assessments, reports, communications, subscriptions, research or validation experiences, and related services (collectively, the "Platform").

This Privacy Policy is incorporated into our Terms of Service.

For purposes of this Privacy Policy:

  • "Assessment Results" means assessment responses, scores, domain results, report outputs, recommendations, narratives, reflections, notes, progress data, reassessment trends, and related interpretations generated through or submitted to the Platform.
  • "Practitioner" means a pastor, coach, counselor, spiritual director, mentor, ministry leader, consultant, or other individual who uses the Platform to support another person, subject to applicable permissions and consent controls.
  • "Organization" means a church, ministry, nonprofit, employer, school, network, denomination, group, or other organization that uses or sponsors access to the Platform.
  • "Aggregate Reporting" means group-level reporting that is designed not to disclose individual participant identities or individual Assessment Results.

Our default privacy rule is simple: individual Assessment Results are private to the individual user unless the user chooses to share them, provides legally valid consent, requests a feature that requires disclosure, participates in a disclosed reporting program, or disclosure is required or permitted by law. Paying for access, issuing an invitation, assigning a seat, creating an access code, sponsoring an assessment, or administering an Organization account does not by itself give a Practitioner or Organization access to individual Assessment Results.

2. Eligibility and Children's Privacy

The Platform is intended for adults age 18 and older. You may not create an account, complete an assessment, participate in research or validation activities, or use the Platform if you are under 18 years old.

The Platform is not directed to children or minors, and we do not knowingly collect personal information from anyone under 18.

If we learn that we have collected personal information from a minor without appropriate authorization, we will review the matter and delete the information where required by law.

Youth, student ministry, school, family, or minor-focused assessment experiences may be offered in the future only under a separate consent, parental or guardian authorization, privacy, and safeguarding framework.

3. Important Notice About Sensitive Information

The Platform may collect and generate information related to spiritual life, religious beliefs, religious practices, discipleship experiences, emotional wellbeing, relational wellbeing, psychological wellbeing, habits, reflections, assessment responses, scores, and reports.

This information can be personal, private, and sensitive. In some jurisdictions, including the European Union and United Kingdom, some of this information may be considered sensitive personal data or special category data.

Where Platform features collect or process Assessment Results or other information that reveals or may reveal spiritual life, religious beliefs, religious practices, emotional wellbeing, relational wellbeing, psychological wellbeing, or other sensitive personal information, we rely on your explicit consent where required by law, including under GDPR/UK GDPR Article 9 where applicable.

If you do not provide required consent, certain assessments, reports, personalization, research, validation, benchmarking, sharing, practitioner-supported, or organization-supported features may be unavailable.

You may withdraw consent where applicable law gives you that right. Withdrawal will not affect processing that occurred before withdrawal, information already shared with recipients at your direction, information we must retain for legal, security, accounting, dispute-resolution, or compliance reasons, or aggregated, de-identified, anonymized, already-published, or otherwise non-identifying information that no longer reasonably identifies you.

The Platform is intended to support spiritual formation, discipleship, reflection, education, research, organizational learning, and wellbeing insight. It is not a medical, mental-health, clinical, diagnostic, therapeutic, counseling, crisis, safeguarding, emergency-response, legal, ordination, employment-screening, leadership-certification, or professional-evaluation service.

Unless we expressly state otherwise in a separate written agreement, the Platform is not designed to store protected health information subject to HIPAA, and users, Practitioners, and Organizations should not submit clinical records, medical records, psychotherapy notes, or other regulated health records to the Platform.

4. Information We Collect

4.1 Account and Profile Information

When you create an account or use the Platform, we may collect:

  • Name
  • Email address
  • Username or display name
  • Password or authentication credentials, stored in encrypted or hashed form
  • Third-party login identifiers and authentication metadata, if you use Google, Apple, Facebook, or another login provider
  • Organization, church, ministry, or practitioner affiliation, if applicable
  • Account settings, preferences, and consent records

4.2 Information from Login Providers

If you choose to create or access your account using a third-party login provider, such as Google, Apple, or Facebook, we may receive information from that provider, such as your name, email address, provider account identifier, authentication token metadata, and other information you authorize the provider to share with us.

If you use Sign in with Apple, Apple may allow you to share your Apple account email address or use a private relay email address. If you use a private relay email address, communications from us may be sent through Apple's relay service.

We use this information to create, authenticate, secure, and manage your account. We do not control the privacy practices of third-party login providers, and your use of those services is governed by their own terms and privacy policies.

We intend to request only the information needed to authenticate and manage your account, such as name, email address, and a stable provider identifier. We do not intend to request extended social profile data, contacts, friends lists, likes, religious or political views, photos, or similar optional data unless we first provide notice and obtain any required consent.

4.3 Assessment Responses, Scores, Reports, and Reflections

When you complete an assessment or use formation tools, we may collect or generate:

  • Assessment answers and submitted responses
  • Domain scores, overall scores, and report outputs
  • Reflection responses, notes, prompts, or journal-style entries, if offered
  • Formation recommendations, practice suggestions, and progress information
  • Historical assessment results and reassessment trends
  • Report delivery, sharing, access, consent, and versioning records

We use this information to provide your report, personalize your experience, support formation tools, maintain your account, support user-directed sharing, improve the Platform where permitted, and perform other purposes described in this Privacy Policy. We may also maintain versioned records showing which assessment notice, consent language, privacy policy, research notice, and sharing notice applied when you used assessment, research, reporting, or sharing features.

We do not sell assessment responses, scores, reports, or reflections. We do not use them for third-party advertising.

4.4 Research and Validation Information

Assessment participation is separate from research and validation participation. If you choose to participate in research or validation activities, we may collect additional information such as:

  • Validation question responses
  • Follow-up survey responses
  • Feedback about report usefulness or assessment clarity
  • Reassessment or longitudinal research responses
  • Research panel participation information
  • Research consent records and withdrawal records

Research and validation information may be used as described in this Privacy Policy and any applicable research or validation consent notice.

4.5 Practitioner, Church, Ministry, and Organization Information

If a Practitioner, pastor, counselor, coach, spiritual director, church, ministry, organization, employer, school, or other group invites you to use the Platform or purchases access for you, we may collect information related to that relationship, such as:

  • Invitation sender
  • Practitioner, church, ministry, or organization name
  • Access code, seat, credit, subscription, or plan assignment
  • Administrative status, such as whether an invitation was sent, accepted, expired, redeemed, or an assessment was completed
  • Aggregate usage or participation metrics where enabled

Unless we expressly state otherwise and you provide legally valid consent, purchasing access for you does not give the purchaser automatic access to your individual Assessment Results or account content.

Administrative status information may show whether an invitation was sent, accepted, expired, redeemed, or completed, but should not be treated as permission to view individual Assessment Results.

4.6 Church, Organization, Regional, and Benchmark Reporting Information

Where enabled, participants may choose to contribute Assessment Results or related scores to church, ministry, practitioner, organizational, regional, or benchmark reporting programs. These programs are designed to provide aggregated, de-identified, anonymized, or otherwise non-identifying insights, such as church health reports, ministry trend reports, regional benchmarks, comparative formation insights, and validation findings.

Participation in these programs does not mean the church, ministry, practitioner, organization, regional group, or benchmark recipient receives your individual Assessment Results, individual responses, account content, or personal identity unless you separately authorize that disclosure.

There is no fixed minimum church or organization size required for aggregate reporting. Church-level aggregate metrics, trends, benchmarks, and formation insights may be provided even when the total participant count is small, provided the reporting design is reasonably intended to avoid identification of individual participants. We may suppress, combine, generalize, round, withhold, or otherwise limit demographic, subgroup, comparative, or benchmark reporting where presentation of the information could reasonably increase re-identification risk.

4.7 Information You Choose to Share

You may choose to share assessment results, reports, scores, responses, reflections, or related content with a Practitioner, pastor, counselor, coach, spiritual director, church, ministry, organization, family member, friend, or other third party.

If you share information through Platform features, we process that sharing at your direction and make the selected information available to the recipient you designate. We may record the recipient, scope of information shared, timestamp, consent or sharing-notice version, expiration date, revocation status, and related audit information.

At launch, report sharing may include static PDF reports delivered by email or downloaded by the user. Once a report has been downloaded, printed, exported, emailed, forwarded, screenshotted, saved, discussed, or otherwise shared outside the Platform, we may be unable to control, revoke, retrieve, delete, restrict, or prevent further use, retention, copying, distribution, or disclosure of that report by the recipient.

If you share information outside the Platform, that sharing is controlled by you and not by us. We are not responsible for how recipients use, store, protect, disclose, interpret, copy, forward, or otherwise handle information after you share it.

Sharing a report does not transfer ownership of the report, assessment content, assessment methodology, scoring logic, benchmarks, frameworks, or related intellectual property to the recipient and does not grant the recipient unrestricted rights to redistribute, publish, license, commercialize, or disclose participant information.

4.8 Payment and Transaction Information

If you purchase a subscription, assessment credit, seat, access code, practitioner plan, organizational plan, in-app purchase, or other paid service, payment and subscription processing may be handled by third-party providers such as Stripe, RevenueCat, the Apple App Store, Google Play Store, or another app store, marketplace, or payment provider.

We do not store full credit card numbers, bank account credentials, or complete payment credentials on our servers. Payment providers, app stores, marketplaces, and subscription management providers process payment, receipt, transaction, entitlement, and subscription information under their own terms and privacy policies.

Deleting your Platform account or deleting the app may not cancel subscriptions purchased through Apple, Google, another app store, or a third-party marketplace. Those subscription providers may continue to process billing and subscription records under their own policies unless you cancel through the applicable purchase channel.

We may collect or receive transaction-related information, such as:

  • Billing name and email
  • Billing address, if required
  • Subscription status
  • Plan type
  • Payment status
  • Invoice and receipt information
  • Last four digits of payment card, card brand, expiration date, or similar limited payment metadata
  • App user ID, entitlement status, app-store receipt metadata, transaction identifiers, renewal status, trial status, cancellation status, and related subscription metadata

4.9 Technical, Device, Usage, and Security Information

When you use the Platform, we and our service providers may collect:

  • IP address or derived/pseudonymous network information
  • Device type, operating system, browser, and app version
  • Pages viewed, features used, clicks, and session activity
  • Referring URL or marketing source
  • Error logs, crash reports, diagnostics, and performance data
  • Authentication, security, and fraud-prevention logs
  • Cookie and similar tracking information

In our own systems, we may avoid retaining raw IP addresses where feasible and may convert IP addresses into a one-way hash or other pseudonymous identifier. Some service providers may process IP addresses as part of standard infrastructure, security, analytics, or error-monitoring services.

4.10 Communications

If you contact us, subscribe to updates, request support, submit feedback, participate in surveys, opt in to future research contact, or otherwise communicate with us, we may collect:

  • Your name and email address
  • Message content
  • Support history
  • Feedback, suggestions, and survey responses
  • Communication preferences
  • Future research contact preferences

Agreeing to future research contact does not require you to participate in any future study.

5. How We Use Information

We use personal information for the following purposes:

  • Provide, operate, maintain, and secure the Platform
  • Create and manage user accounts
  • Generate assessment results, reports, scores, visualizations, narratives, and recommendations
  • Deliver PDF or digital assessment reports
  • Support Christian formation, discipleship, reflection, education, and wellbeing tools
  • Enable user-directed sharing with Practitioners, pastors, counselors, coaches, churches, ministries, organizations, or other recipients
  • Support participant-authorized church, ministry, practitioner, organizational, regional, and benchmark reporting
  • Manage subscriptions, billing, access codes, assessment credits, seats, and organizational accounts
  • Provide customer support and respond to requests
  • Send transactional emails, service notices, security alerts, report delivery emails, billing notices, and administrative messages
  • Send future research contact communications where you have opted in
  • Improve, validate, and develop the Platform, including The Greatest Commandment Model™, assessment logic, scoring systems, reports, recommendations, benchmarks, formation pathways, research methods, AI-assisted features, and related tools, where permitted by law and applicable consent settings
  • Conduct research and validation activities where you have consented or where another lawful basis applies
  • Prepare, publish, present, license, distribute, or use aggregated, de-identified, anonymized, or otherwise non-identifying research findings, benchmarks, validation studies, trend analyses, and derived insights
  • Maintain consent, policy-version, sharing, entitlement, reporting, research, withdrawal, and audit records
  • Analyze aggregate, de-identified, anonymized, or pseudonymous usage trends
  • Prevent fraud, abuse, security incidents, and misuse
  • Enforce our Terms of Service and other agreements
  • Comply with law, legal process, and regulatory obligations
  • Protect the rights, safety, and property of The Luke 10:28 Project, users, and others

We do not sell your personal information. We do not use Assessment Results for third-party advertising. We do not share Assessment Results with data brokers, ad networks, or third-party advertisers for targeted advertising.

6. Research, Validation, Benchmarking, Publication, and Aggregated Insights

Assessment participation is separate from research and validation participation. You may complete the core assessment without agreeing to participate in research or validation activities unless a specific research-only experience clearly states otherwise.

If you consent to research or validation activities, we may use your research and validation information to validate assessment constructs, improve scoring and interpretation methods, develop benchmarks, support product improvement, conduct research, and generate aggregated, de-identified, anonymized, or otherwise non-personally identifying findings.

We may use information collected through the Platform to conduct research, validate assessments, improve our methodologies, develop new products and services, evaluate platform effectiveness, and better understand patterns relating to spiritual formation, discipleship, wellbeing, and human flourishing.

We may create and use aggregated, de-identified, anonymized, pseudonymized, or otherwise non-identifying datasets, analyses, benchmarks, trend reports, validation studies, and research findings.

We may publish, present, license, distribute, or otherwise use such findings in white papers, benchmark reports, academic publications, conference presentations, ministry resources, educational materials, software features, commercial offerings, product validation materials, and similar internal or external uses.

We may also create aggregated benchmark reports and comparative analyses relating to churches, ministries, Practitioners, Organizations, cohorts, demographic groups, regions, denominations, networks, or other populations. We use reasonable measures intended to reduce the risk that individuals or organizations can be identified from published findings.

Research findings, benchmark data, trend analyses, validation studies, derived analytics, and aggregated insights developed from Platform data may be used in commercial products, subscription services, reports, educational offerings, ministry resources, software features, and other offerings provided by The Luke 10:28 Project LLC.

We will not intentionally identify you by name, email address, account identifier, or other direct personal identifier in published research without your separate written permission.

The Luke 10:28 Project LLC retains ownership of aggregated datasets, de-identified datasets, benchmark datasets, normative datasets, validation datasets, longitudinal datasets, research datasets, derived analytics, trend analyses, comparative reports, and related derivative works generated through operation of the Platform, subject to applicable privacy commitments and legal requirements.

7. Legal Bases for Processing — EU/UK Users

If you are located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with similar data protection laws, we process personal data only when we have a valid legal basis.

Depending on the context, our legal bases may include:

  • Contract performance — to provide the Platform, account features, assessments, reports, subscriptions, user-requested sharing, and other user-requested services.
  • Consent — when you consent to assessment processing, optional communications, research participation, validation activities, user-directed sharing, future research contact, or certain cookies.
  • Explicit consent — where required for sensitive personal data or special category data, including information that reveals or may reveal religious beliefs, spiritual practices, spiritual formation patterns, emotional wellbeing, relational wellbeing, psychological wellbeing, or other wellbeing-related information.
  • Legitimate interests — to secure, maintain, improve, analyze, and protect the Platform, prevent misuse, troubleshoot errors, maintain business records, and understand usage, provided those interests are not overridden by your rights and interests.
  • Legal obligation — to comply with applicable laws, tax obligations, accounting requirements, legal process, and regulatory duties.
  • Vital interests or public interest — in rare cases where processing is necessary to protect someone's life, safety, or welfare, or where required by law.

Where required by law, we rely on your explicit consent to process sensitive or special-category information for assessment, reporting, personalization, research, validation, benchmarking, publication, product improvement, and related Platform purposes.

You may withdraw consent where applicable law gives you that right. Withdrawal will not affect processing that occurred before withdrawal, information already shared at your direction, information we must retain for legal, security, accounting, dispute-resolution, or compliance reasons, or aggregated, de-identified, anonymized, already-published, or otherwise non-identifying information that no longer reasonably identifies you.

8. How We Share Information

We share personal information only as described in this Privacy Policy.

8.1 Service Providers and Processors

We may share information with vendors and service providers that help us operate the Platform, such as:

  • Cloud hosting and infrastructure providers
  • Database and backend service providers
  • Authentication providers
  • Payment processors
  • Transactional email providers
  • Error monitoring and security providers
  • Analytics providers, subject to our cookie and tracking controls
  • Customer support and operational tools
  • Professional advisors, including attorneys, accountants, auditors, and insurers

Our current or expected providers may include Supabase, Vercel, Resend, BugSnag/SmartBear, Stripe, RevenueCat, Google, Apple, Meta/Facebook, and Google Analytics for the marketing site only.

Service providers may process personal information only for the purposes we authorize and subject to applicable contractual obligations.

8.2 Third-Party Authentication, App Store, and Subscription Providers

Some third-party providers, including app stores, payment processors, subscription management providers, and login providers, may process personal information as independent controllers under their own terms and privacy policies, or as processors/service providers depending on the service and configuration.

We may use RevenueCat to help manage mobile subscriptions, in-app purchases, entitlement status, app-store receipt validation, and subscription-related analytics. RevenueCat may process account identifiers, app user identifiers, device/app metadata, transaction or receipt metadata, subscription status, and related technical information. We do not intentionally send assessment responses, scores, reports, reflections, or sensitive spiritual/wellbeing content to RevenueCat.

If you use Google, Apple, or Facebook to log in, those providers may process your information under their own terms and privacy policies. We use the information they provide to authenticate and manage your account.

8.3 Practitioners, Pastors, Counselors, Coaches, Churches, Ministries, and Organizations

We share individual Assessment Results or account content with a Practitioner, pastor, counselor, coach, spiritual director, church, ministry, Organization, employer, school, or other third party only when:

  • You direct us to share it through a Platform feature;
  • You provide legally valid consent;
  • Sharing is necessary to provide a feature you requested and is clearly disclosed;
  • We are required or permitted by law; or
  • Another lawful basis applies under a separate written agreement and applicable consent process.

Practitioners, churches, ministries, and Organizations may receive administrative or aggregate information, such as seat usage, invitation status, credit usage, aggregate participation metrics, or aggregate reports where enabled and authorized. We do not provide individual Assessment Results or account content to a purchaser or sponsoring Organization solely because that party purchased access, issued an invitation, assigned a seat, created an access code, or administers an account.

When Platform sharing controls are available, you should be able to see the recipient and general scope of information to be shared before sharing occurs. Where supported, you may revoke future in-Platform access. Revocation will not affect information already viewed, downloaded, copied, saved, printed, discussed, exported, emailed, forwarded, screenshotted, or recorded by the recipient.

Third parties who receive information from you are responsible for their own privacy, confidentiality, professional, pastoral, legal, safeguarding, recordkeeping, and ethical obligations. We do not control how they interpret or use information after it is shared with them.

8.4 Aggregate Church, Organization, Regional, and Benchmark Reporting

Where enabled and authorized, Organizations may receive aggregate reports that include information derived from participant-authorized Assessment Results. These reports may include church health reports, ministry trend reports, regional benchmarks, comparative formation insights, and similar group-level outputs.

Aggregate reports are designed to provide group-level insights without disclosing individual participant identities or individual assessment responses. Participation in aggregate reporting does not mean the Organization receives individual Assessment Results or account content unless the participant separately authorizes that disclosure.

We may combine participant-authorized data across churches, ministries, Practitioners, Organizations, regions, cohorts, demographic groups, or other populations to generate broader benchmarks, trends, validation findings, research outputs, product insights, commercial reports, or public-facing publications, subject to reasonable safeguards intended to reduce re-identification risk.

8.5 User-Directed External Sharing

If you print, download, email, forward, screenshot, verbally discuss, or otherwise share information outside the Platform, we do not control that sharing and are not responsible for how recipients use, store, protect, disclose, interpret, copy, forward, or otherwise handle that information.

8.6 Legal, Safety, and Compliance Disclosures

We may disclose information if we believe in good faith that disclosure is necessary to:

  • Comply with law, regulation, subpoena, court order, or legal process
  • Enforce our Terms of Service or other agreements
  • Protect the rights, safety, or property of The Luke 10:28 Project, users, or others
  • Prevent, detect, or investigate fraud, abuse, security incidents, or misuse
  • Respond to threats of harm, emergencies, safeguarding concerns, or other safety issues
  • Cooperate with law enforcement or public authorities where legally required or permitted

The Platform is not a crisis-monitoring, counseling, safeguarding, emergency-response, or suicide-prevention service. We do not guarantee that user responses, reports, reflections, journal entries, shared content, or messages will be reviewed by a human or reviewed in time to respond to urgent situations. We are not obligated to monitor user content for crisis, abuse, safeguarding, or illegal activity, but we may review, restrict, preserve, disclose, or report information when we believe it is necessary or appropriate to protect safety, comply with law, respond to legal process, enforce our Terms, investigate misuse, protect the Platform, or reduce legal, security, operational, mission, or reputational risk.

8.7 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, personal information may be transferred as part of that transaction, subject to applicable law and this Privacy Policy.

9. Cookies and Tracking

We use cookies and similar technologies to operate the Platform, authenticate users, remember preferences, secure sessions, analyze usage, and improve performance.

Some cookies are necessary for the Platform to function. Others may be optional, such as analytics or marketing-site cookies.

A full description of our cookie practices is available in our Cookie Policy.

You can manage cookies through your browser settings and, where offered, through our cookie preference tools. Disabling certain cookies may affect Platform functionality.

10. AI-Assisted Features

We may use automated systems, analytics tools, machine learning methods, or AI-assisted features to support assessment scoring, report generation, pattern recognition, personalization, research, quality improvement, product development, moderation, security, and operational purposes.

AI-assisted features are intended to support spiritual formation, reflection, education, research, and product functionality. They are not intended to provide medical advice, mental health treatment, psychological diagnosis, counseling services, legal advice, crisis intervention, pastoral authority, spiritual authority, prophetic guidance, divine revelation, theological judgment, ministry endorsement, or final decision-making about any person.

AI-assisted outputs may be incomplete, inaccurate, inappropriate, biased, theologically limited, culturally limited, or not suited to your circumstances. Narrative interpretations, observations, recommendations, suggested next steps, AI-assisted insights, generated summaries, and similar content are intended to support reflection and discussion. They may not fully reflect a participant's circumstances, experiences, beliefs, motivations, relationships, spiritual life, or wellbeing and should not be treated as factual determinations or authoritative conclusions.

We may use aggregated, de-identified, anonymized, pseudonymized, or otherwise privacy-protective information to improve our assessments, scoring systems, benchmarks, AI-assisted features, research methodologies, reports, products, services, and related technologies.

We do not intentionally use your identifiable Assessment Results to train third-party general-purpose AI models unless we provide additional notice or obtain consent where required by law.

Use of AI-assisted features does not transfer ownership of, or grant rights to reproduce, extract, reverse engineer, recreate, train competing systems from, or otherwise exploit, The Greatest Commandment Model™, assessment methodologies, scoring systems, benchmark methodologies, interpretation frameworks, taxonomies, algorithms, prompts, models, or other Luke 10:28 intellectual property.

11. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on the type of information, the sensitivity of the information, account status, user settings, consent settings, legal obligations, security needs, backup cycles, dispute-resolution needs, research integrity needs, and legitimate business purposes.

General retention approach:

  • Account and profile information — retained while your account is active and for a reasonable period afterward, unless deletion is requested and no exception applies.
  • Assessment responses, scores, reports, and reflections linked to your account — retained while your account is active and for a reasonable period afterward, unless deletion is requested and no exception applies.
  • Consent, policy-version, sharing, reporting, and research records — retained as needed to document consent, withdrawal, legal compliance, audit history, dispute resolution, and platform integrity.
  • Research and validation records — retained as described in applicable research notices, consent records, and retention practices, subject to applicable law and withdrawal rights.
  • Transaction and billing records — retained as needed for tax, accounting, fraud-prevention, dispute-resolution, and legal compliance.
  • Technical, security, and usage logs — retained for a limited period appropriate to security, troubleshooting, analytics, and operational needs, then deleted, aggregated, or de-identified where feasible.
  • Aggregated, de-identified, or anonymized information — may be retained and used for research, validation, product improvement, benchmarking, publication, business analysis, and other lawful purposes.

When you request deletion, we will delete or de-identify personal information unless we need to retain it for legal, security, backup, fraud-prevention, dispute-resolution, accounting, compliance, audit, research integrity, or legitimate business purposes. Deletion from active systems may not immediately remove information from encrypted backups or logs, which may be retained for a limited period and then overwritten or deleted according to backup cycles.

Account deletion does not necessarily cancel subscriptions, stop app-store billing, remove information previously shared with third parties, delete records maintained by payment providers or app stores, or require deletion of aggregated, de-identified, anonymized, already-published, or otherwise non-identifying information that no longer reasonably identifies you.

12. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including:

  • Encryption in transit using HTTPS/TLS
  • Infrastructure-level encryption at rest where supported by service providers
  • Access controls and least-privilege practices
  • Authentication and account-security controls
  • Logging, monitoring, and error tracking
  • Separation or minimization practices where feasible
  • Vendor review and contractual safeguards where appropriate

No system is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed by unauthorized persons.

If you believe your account or information has been compromised, contact us immediately at security@luke1028.com.

13. International Data Transfers

We are based in the United States. If you access the Platform from outside the United States, your personal information may be transferred to, stored in, or processed in the United States or other countries that may not provide the same level of data protection as your home jurisdiction.

For EU/UK users, we use appropriate safeguards where required, such as Standard Contractual Clauses, the UK International Data Transfer Addendum or IDTA, adequacy decisions, vendor transfer mechanisms, and related measures.

Service providers and subprocessors may process information in countries outside your country of residence as necessary to provide the Platform and related services.

14. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights:

  • Access personal information we hold about you
  • Correct inaccurate or incomplete information
  • Delete personal information
  • Export or receive a copy of your information in a portable format
  • Object to certain processing
  • Restrict certain processing
  • Withdraw consent where processing is based on consent
  • Opt out of certain communications
  • Lodge a complaint with a data protection authority

To exercise privacy rights, email privacy@luke1028.com with the subject line "Data Rights Request" or use available account settings. If available, in-account tools may allow you to access, export, delete, or revoke sharing of certain information more quickly.

We may need to verify your identity before fulfilling a request. We may decline or limit a request where permitted by law, including where retention is necessary for security, legal compliance, dispute resolution, accounting, fraud prevention, audit history, research integrity, or legitimate business purposes.

14.1 EU/UK Users

EU/UK users may have additional rights under GDPR or UK GDPR, including the right to lodge a complaint with a supervisory authority.

If you withdraw consent for research, validation, aggregate reporting, or future contact, the withdrawal will apply prospectively. It will not require us to retract already-published materials, reconstruct aggregated reports, delete de-identified datasets, or unwind processing that occurred before withdrawal where we are permitted to retain or use the information under applicable law.

14.2 California and Other U.S. State Privacy Rights

We do not sell personal information. We do not use assessment responses, scores, reports, or reflections for third-party advertising.

Some U.S. state privacy laws may provide additional rights, including the right to know, access, correct, delete, port, limit certain uses of sensitive personal information, or opt out of certain sales, sharing, targeted advertising, or profiling. We will honor applicable rights where required by law.

We do not sell personal information or share Assessment Results for targeted advertising. If our practices change, we will update this Privacy Policy and provide any required notices, choices, or consent mechanisms.

15. Email and Communications

We may send service-related communications, including account notices, assessment report delivery, security alerts, billing notices, privacy updates, and administrative messages.

If you opt in to newsletters, marketing updates, formation resources, promotional messages, or future research contact, you may unsubscribe using the link in the email, available account settings, or by contacting us.

You may not opt out of essential service, legal, security, or transactional communications while maintaining an active account.

16. Third-Party Links and Services

The Platform may contain links to third-party websites, services, resources, Practitioners, churches, ministries, or Organizations.

We are not responsible for the privacy practices, content, security, or conduct of third parties. Your interactions with third parties are governed by their own terms and privacy policies.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we update it, we will revise the "Last Updated" date. For material changes, we may notify you by email, in-app notice, website notice, or another reasonable method.

Your continued use of the Platform after an updated Privacy Policy becomes effective means you acknowledge the updated policy, subject to any consent rights required by law.

18. Contact Us

The Luke 10:28 Project LLC
808 Chestnut St, St 1113
Chattanooga, TN 37402
United States

Registered Agent:
United States Corporation Agents, Inc.
5865 Ridgeway Center Parkway, Suite 384
Memphis, TN 38120
United States

Privacy: privacy@luke1028.com
Security: security@luke1028.com

The Luke 10:28 Project™ · The Greatest Commandment Model™ · luke1028.com · privacy@luke1028.com