CMS Cloud is a contact and donation management service provided by Chabad Management Solutions ("we", "us"). This policy explains what information CMS Cloud collects, how we use it, and the choices you have. It applies to the CMS Cloud web application at chabadms.com and its subdomains.

Who controls the data

Organizations ("customers") use CMS Cloud to manage their own records — families, members, donations, bills, forms and communications. Each organization owns and controls the data it enters. We process that data on the organization's behalf to provide the service, and we don't use it for any other purpose.

Information we collect

• Account information for people who sign in to CMS Cloud: name, email address, phone number (used for sign-in verification codes), and role within their organization.
• Organization data that customers enter or import: contact details, addresses, family and member records, donations, bills, notes, form submissions and similar records.
• Technical information needed to run and secure the service: IP address, browser type, sign-in times, and security and error logs.
• Cookies that keep you signed in, remember trusted devices and protect against forged requests. We don't use advertising cookies.

How we use information

• To provide, maintain and secure CMS Cloud.
• To send messages the organization asks the service to send (receipts, letters, reminders, texts).
• To provide support when an organization asks for it.
• To comply with the law.

We don't sell personal information, and we don't use it for advertising.

Google user data (Google Contacts integration)

A CMS Cloud user who has been given access by their organization can choose to connect their own Google account, so the organization's members appear in that user's Google Contacts and contacts the user adds on their phone can be brought into CMS Cloud. When you connect, CMS Cloud asks Google for:

• Your Google account email address and account identifier (scopes openid and email) — to show which Google account is connected and to confirm it belongs to your organization's verified email domain.
• Access to your Google Contacts (scope contacts) — to create, update and remove the CMS contacts in a label called "CMSCloud"; to read changes made to those contacts so they can be checked and, where allowed, applied in CMS Cloud; to read contacts you add so that you can choose whether to add them to CMS Cloud; and to show a contact's Google photo in CMS Cloud when a member has no photo of their own.

How we handle Google user data:

• We use it only to provide the Google Contacts integration you turned on.
• We don't sell it, use it for advertising, or use it to train artificial intelligence models.
• We don't transfer it to others, except as needed to provide or secure the integration, to comply with the law, or as part of a merger or sale of the business with notice to you.
• People don't read it, except with your permission, for security purposes, to investigate abuse, or when required by law.
• Your Google sign-in tokens are stored encrypted.
• Before CMS Cloud first changes your Google Contacts, it saves a backup copy of them so they can be restored if needed. The backup is deleted when you disconnect.
• Contacts you add in Google that aren't in CMS Cloud are kept only to show them to you for review, and are deleted when you disconnect unless you add them to CMS Cloud.
• Google photos aren't copied into CMS Cloud. Only a link to the photo is saved, and the photo is shown only to the user who connected that Google account.

CMS Cloud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting Google and deleting Google data

You can disconnect your Google account at any time in CMS Cloud (Settings → Integrations → Google Contacts). Disconnecting removes the contacts CMS Cloud created in your Google account, deletes your stored Google tokens and sync settings, and revokes CMS Cloud's access. You can also remove access from your Google account at myaccount.google.com/permissions. Contact details you choose to bring into CMS Cloud become part of your organization's records. A history of each change the sync makes (the values before and after) is kept with your organization's records so changes can be reviewed and undone. To ask us to delete Google data we hold about you, contact us as shown below.

Service providers

We use trusted providers to host and operate CMS Cloud — for example hosting, email delivery, text messaging and payment processing. They process information only to provide their service to us and must protect it.

Security

We protect data with encrypted connections, access controls, sign-in verification, encryption of sensitive values such as access tokens, and regular backups. No system is perfectly secure, but we work to protect the information entrusted to us.

Data retention

Organization data is kept while the organization uses CMS Cloud and as needed for its records. When an organization closes its account, its data is deleted or returned according to its agreement with us.

Children

CMS Cloud is a service for organizations and is not directed to children under 13. Organizations may store records about members of any age as part of their own records.

Changes to this policy

We may update this policy. The date at the top shows the latest version; significant changes will be communicated to customers.

Contact us

Sign in to support.chabadms.com and create a ticket.