iConfirm Church Service Agreement — v2

Reviewed — ready for use 2026-08-23
Effective date: 2026-08-23
Order date: [INSERT]

This Church Service Agreement ("Agreement") is between BIBS Specialty Services, Inc., a Missouri corporation with an address at 735 Scanlan Avenue, St. Louis, Missouri 63139 ("BIBS"), and the church identified in the applicable order or acceptance screen ("Church"). BIBS and Church are each a "Party" and together the "Parties."

The Agreement includes the order, this Agreement, the iConfirm Data Protection Addendum ("DPA"), and incorporated policies. If they conflict, the following order controls: DPA for data-protection matters; order for price and subscription details; this Agreement; incorporated policies.

1. Service

BIBS provides iConfirm, a web application supporting church youth confirmation programs ("Service"). Subject to this Agreement and payment, BIBS grants Church a limited, nonexclusive, nontransferable right to allow its authorized Leaders to use the Service for Church's confirmation program during the subscription term.

BIBS does not promise a formal uptime percentage or service level. BIBS may maintain, modify, or discontinue features, subject to the notice and data-retrieval provisions below.

2. Separate Church and family relationships

Church purchases its Church/Leader seat. Each Parent separately creates and authorizes the Student account and purchases or redeems the Student seat. Church does not obtain ownership of a Student account or private Student content by paying for or facilitating a discount.

Church may invite families to enroll but must not create a Student account, provide consent as the Parent, submit a child's personal information before Parent authorization, or represent that Church can waive Parent rights unless BIBS and qualified counsel approve a separate legally valid process in writing.

3. Authorized Leaders

Church will identify only appropriate, authorized adults as Leaders and will ensure they comply with this Agreement, the Terms, privacy notices, safeguarding rules, and applicable law. Church is responsible for Leader conduct and use of exported information.

Church must notify BIBS promptly at office@iconfirm.app when a Leader's authority changes or access should be removed. Until an in-product removal workflow exists, BIBS will process the revocation manually. Church remains responsible for delay caused by its failure to notify BIBS.

[FLAGGED, not resolved — see change note above] Original text: "Before expanding past the limited St. Paul pilot, implement immediate Leader revocation/session invalidation and test full multi-Church isolation." Whether this gate has already been satisfied by the live multi-church build is a morning question.

Leaders may not request, obtain, reset, or use a Student PIN; impersonate a Student; require a Student to disclose private content; or attempt to bypass role or tenant restrictions.

4. Information visible to Church

Authorized Leaders may receive:

• Student name and nickname;
• attendance;
• lesson progress and completion status;
• content the Student deliberately marks shared; and
• related program-administration information expressly displayed in the Leader account.

Church and Leaders do not receive private reflections, private survey responses, Student PINs, or Parent payment-card details through the Service.

Church may export only information made available to its Leaders. Church will secure exports, restrict them to authorized persons, use them only for the confirmation program, and delete them when no longer needed.

If a Student revokes sharing, Church will delete prior exported copies where feasible after receiving notice. Church will not retaliate against a Student for keeping an entry private or revoking a sharing choice.

5. Church responsibilities

Church will:

• provide accurate organization and Leader information;
• maintain its own safeguarding, emergency, pastoral, and mandatory-reporting procedures, and independently tell its Students how to seek pastoral help outside iConfirm — the Service's own "Need help?" page is informational only and does not replace this;
• supervise Leaders and their interactions with Students;
• use Student information only for lawful confirmation-program purposes;
• obtain any Church-side permissions necessary for Church-created content or communications;
• promptly report suspected unauthorized access, privacy incidents, or prohibited content;
• avoid uploading rosters or child information before Parent authorization;
• not describe private entries as monitored, privileged, or visible to Leaders; and
• comply with the DPA and applicable privacy, consumer, and child-safety laws.

iConfirm is not a substitute for Church safeguarding, counseling, emergency response, pastoral care, or mandatory-reporting processes. Private reflections are not routinely monitored.

6. Photos

Photo uploads are disabled at launch. Church and Leaders may not bypass that restriction. BIBS will not enable photo uploads until reporting, immediate hiding, Parent deletion, authorized takedown, metadata, and escalation controls are operational and the applicable notices/consents are updated.

7. Subscriptions and payment

The order or checkout screen states the price, billing period, renewal date, discounts, and quantity. Church subscriptions automatically renew monthly or annually, as selected, until canceled.

Church may cancel at any time using the Cancel subscription button in Church billing settings, which opens our payment processor's secure cancellation portal, or by emailing office@iconfirm.app as a backup channel. Cancellation prevents future renewal and takes effect after the current paid period. Except where law requires otherwise, fees are nonrefundable and not prorated.

[BUILD QUESTION — see change note above] Confirm whether cancel-church-subscription-link.tsx needs the same Stripe Customer Portal upgrade as the parent-facing cancellation flow.

Church is responsible for taxes other than taxes on BIBS's net income. Late or failed payment may result in suspension and the post-payment data timeline described in the DPA and public policies.

8. Ownership and licenses

BIBS owns the Service, software, original curriculum, design, documentation, and related intellectual property. Church receives only the limited use right stated above.

Church owns Church-created content. Church grants BIBS a limited license to host, process, transmit, and display it only as necessary to provide and secure the Service, support authorized sharing, and comply with law.

Students or their Parents retain ownership of original Student reflections, notebook entries, survey responses, and other Student-created content as described in the Terms. Church receives no ownership interest in Student Content.

Church represents that its submitted content and instructions do not infringe third-party rights. BIBS will use CEB text only if appropriate written permission is retained; otherwise BIBS will use an approved fallback translation.

9. Confidentiality

Each Party may receive nonpublic business, technical, security, or personal information ("Confidential Information"). The receiving Party will use it only for this Agreement, protect it using reasonable care, and disclose it only to persons who need it and are bound by confidentiality. Confidential Information excludes information lawfully public, already known without restriction, independently developed, or lawfully received from another source.

A Party compelled to disclose Confidential Information will, where legally permitted, give prompt notice and reasonable assistance in seeking protection.

10. Privacy and security

The DPA governs processing of personal information. Each Party will maintain safeguards appropriate to its role and promptly notify the other of a suspected incident affecting the other Party's information.

BIBS's application is designed to isolate Church tenants and prevent ordinary Leader access to private Student content. [FLAGGED, not resolved — see change note above] Original text: "For the Sept. 13 St. Paul pilot, BIBS will verify that no ordinary St. Paul Leader path exposes private reflections or survey responses. BIBS will complete a two-Church authorization suite before onboarding another Church." Per task #28 (LEGAL-09 isolation tests — merged, no gap found) this suite has very likely already run. Confirm and update this paragraph to reflect the actual, already-passed test rather than describing it as a future gate.

11. Term and termination

This Agreement begins when Church accepts it and continues while a Church subscription remains active. Either Party may terminate for material breach not cured within 30 days after notice, except an access/security breach may justify immediate suspension. BIBS may terminate immediately for unlawful use, child-safety risk, deliberate access-control bypass, or nonpayment.

After termination, Church access ends at the conclusion of the paid period unless earlier suspension is permitted. Church will retrieve permitted exports and delete personal information no longer needed. BIBS will handle Student information under the Parent relationship, Privacy Policy, and retention schedule; Church termination does not authorize disclosure of private Student content to Church.

12. Warranties and disclaimers

Each Party represents it has authority to enter this Agreement. BIBS warrants that it will provide the Service materially in accordance with its then-current documentation and use commercially reasonable efforts to correct a reproducible material nonconformity.

EXCEPT FOR THE EXPRESS WARRANTY ABOVE, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, BIBS DISCLAIMS IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. BIBS DOES NOT WARRANT UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE OPERATION.

13. Indemnification

Church will defend, indemnify, and hold harmless BIBS and its officers, employees, and agents from third-party claims, damages, judgments, costs, and reasonable attorneys' fees arising from:

• Church or Leader conduct or violation of this Agreement;
• an unauthorized roster, invitation, account, access designation, or data instruction supplied by Church;
• Church-created content or Church's use/export/disclosure of Student information; or
• Church's safeguarding, supervision, pastoral, or legal responsibilities.

BIBS will promptly notify Church of a covered claim, allow Church to control the defense and settlement, and reasonably cooperate at Church's expense. Church may not settle in a way that admits wrongdoing by or imposes nonmonetary obligations on BIBS without consent.

Reciprocal IP indemnity. BIBS will likewise defend, indemnify, and hold harmless Church from third-party claims that the Service, as provided by BIBS and used as authorized under this Agreement, infringes that third party's intellectual-property rights. This reciprocal indemnity does not cover claims arising from Church-supplied content, Church's modification of the Service, or Church's use of the Service other than as authorized, and is subject to the same notify/control-defense/no-admission structure above and to the liability cap in Section 14.

14. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUE, DATA, OR GOODWILL.

EXCEPT FOR PAYMENT OBLIGATIONS, CHURCH'S INDEMNITY, CONFIDENTIALITY OR DATA-MISUSE OBLIGATIONS, INTELLECTUAL-PROPERTY VIOLATIONS, WILLFUL MISCONDUCT, OR LIABILITY THAT CANNOT BE LIMITED, EACH PARTY'S TOTAL LIABILITY WILL NOT EXCEED THE FEES PAID OR PAYABLE UNDER THIS AGREEMENT DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM.

Claims arising from a privacy or security breach, or a child-safety incident, are excluded from this cap entirely — consistent with the same carve-out in the Terms of Service — rather than folded into the general 12-months-fees limit above.

15. Disputes and governing law

The Parties will first attempt in good faith to resolve a dispute through authorized representatives. Unresolved disputes will be determined by binding individual commercial arbitration administered by the American Arbitration Association in the City of St. Louis, Missouri, under its Commercial Arbitration Rules. Either Party may seek temporary injunctive relief for unauthorized access, confidentiality, or intellectual-property misuse.

The Federal Arbitration Act governs arbitration. Missouri law governs other questions without regard to conflict-of-law rules. If arbitration is unavailable or unenforceable, exclusive venue lies in the state courts located in the City of St. Louis, Missouri, or the applicable federal court.

(Unlike the consumer arbitration clause deleted from the Terms of Service, this B2B clause is kept — per the Aug 21 legal review memo it's between sophisticated parties, enforceable, and costs nothing.)

16. General

Neither Party may assign this Agreement without the other's consent, except BIBS may assign it in a merger, reorganization, or sale of substantially all relevant assets, and Church may assign it to a successor congregation with BIBS's written approval. Neither Party is liable for delay caused by events beyond reasonable control, excluding payment obligations. The Parties are independent contractors. No third party receives enforcement rights except indemnified parties. Amendments must be in writing or accepted through an authorized electronic process. If a provision is unenforceable, the remainder remains effective. Notices go to the order contacts and, for BIBS, office@iconfirm.app.

Order and acceptance

Church legal name: [INSERT]
Church address: [INSERT]
Authorized representative: [INSERT]
Leader account: [INSERT]
Plan/billing: [INSERT]
Start date: [INSERT]

By signing or accepting electronically, each representative states that they are authorized to bind the identified Party.

BIBS Specialty Services, Inc.
Name: Joshua Pittman
Title: [INSERT]
Signature/date: [INSERT]

Church
Name/title: [INSERT]
Signature/date: [INSERT]