Skip to content
Cross Exchange

PRIVACY POLICY

Last Updated: October 23, 2026
Effective Date: November 22, 2026

Cross Exchange International Ministries Inc. (“Cross Exchange,” “we,” “us,” or “our”) runs a Christian work-exchange marketplace. Travelers trade work for room and board with Hosts (Christian families, churches, and ministries). This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights you have over it. “You” means anyone who visits our sites or uses our services.

This policy applies together with our Terms and Conditions. If you have a question, email us at support@crossexchange.org.

1. Who We Are and What This Policy Covers

1.1 Who We Are

Cross Exchange International Ministries Inc. is a Delaware corporation registered in California, at 1937 Klauber Ave, San Diego, CA 92114, USA. We decide how and why your personal information is processed. Under European and UK law, that makes us the “controller” of your personal information.

1.2 What This Policy Covers

This policy covers:

  • our marketing site at www.crossexchange.org, including the contact form and the AI assistant;
  • our member portal at go.crossexchange.org, where members sign up, build profiles, publish listings, message each other, and leave reviews;
  • emails, WhatsApp or SMS messages, and video calls between you and our staff.

You must be 17 or older to create an account, and 18 or older to go on a Stay. Membership is free. We collect no payment information. If we ever start charging for a service, we will update this policy before we collect any payment information.

2. Information We Collect

2.1 Information You Give Us

Account information. When you create an account, we collect your first name, last name, email address, and password, and your answers to sign-up questions such as your age, your sex, and how you heard about us. If you sign in with Google, see section 2.3.

Profile information. You can add a profile photo, a bio (for example, your skills and travel experience), languages, faith background, home location, Instagram username, and an emergency contact. You can also give a phone number and choose to get message alerts by WhatsApp or SMS.

Host information. If you register as a Host, we collect details about your home, church, or ministry: its name, address, contact details, photos, the kinds of work you offer, and who lives in or serves at the home.

Host confirmation call. Each Host joins a Google Meet video call with a Cross Exchange staff member, who confirms the Host’s identity and that the opportunity is real. You book the call through Calendly. We do not record the call unless you agree to a recording beforehand. Staff may keep written notes of the outcome.

Health information (optional). You can choose to tell a Host or us about allergies, medical conditions, or other health facts that matter for the work or the stay. Section 5.1 explains how we handle it.

Messages and reviews. We store the messages you send through the member portal and the reviews you write.

Contact form. When you use the contact form on the marketing site, we collect your name, email address, the topic, and your message.

Communications with us. When you email us, answer a survey, or talk with staff, we keep what you send us.

AI assistant. You type questions into the AI assistant. We do not store them. Section 6 explains how the assistant works.

We do not collect credit card, bank account, or other payment information. We do not collect government ID documents or biometric data. If we start to verify Traveler identity with ID documents, we will update this policy before we collect them.

2.2 Information We Collect Automatically

Usage data. We record how you use the marketing site and the member portal: pages you visit, buttons you click, and actions such as sending a message or starting an inquiry.

Device and log data. When your browser contacts our servers or our providers’ servers, they receive your IP address, browser type, operating system, and the time of the request. Our hosting providers keep server logs. When the member portal has an error, our error-monitoring provider receives technical details of the error, your member ID, and your IP address.

Approximate location. We use your IP address to estimate your country or city. In the member portal, our map provider receives the city or place names you search for and the area of the map you view.

2.3 Information From Third Parties

  • Google. If you choose “Sign in with Google,” Google gives us your name, email address, and Google account ID.
  • Calendly. When you book a Host confirmation call, Calendly gives us your name, email address, and the booking details.
  • Other members. Other members may write about you in messages or reviews.

3. How We Use Your Information

3.1 Purposes

We use your information to:

  • run the platform: create and manage your account, publish profiles and listings, and let Travelers and Hosts find and message each other;
  • keep members safe: verify Hosts, detect and stop fraud, spam, and abuse, enforce our Terms and Conditions, and block removed members from signing up again;
  • support your stay: pass on health information you choose to share, as section 5.1 explains;
  • communicate with you: send account emails, message alerts by email, WhatsApp, or SMS, reminders, and replies to your questions;
  • send news (with your permission): send newsletters and updates about opportunities and events, which you can turn off at any time;
  • improve the platform: measure how people use our sites, fix errors, and understand which features help members;
  • meet legal duties: comply with law, respond to lawful requests, and defend legal claims.

When you sign up or update your profile, we copy your name, email address, phone number, country, member ID, age, sex, faith background, bio, Instagram username, and emergency contact into our CRM. We also use contact records in our CRM to show, on our marketing site, a map of the countries our members come from. The map shows countries only, never individual members.

3.2 No Advertising, No Sale, No Sharing

We do not use your personal information for targeted advertising or cross-context behavioral advertising. We do not sell your personal information, and we do not “share” it as California law uses that word (for cross-context behavioral advertising). We have not done either in the last 12 months.

4. How We Share Your Information

4.1 With Other Members

Other members see parts of your account so the marketplace can work:

  • Host listings show signed-in members the Host’s name, photos, approximate location, and description of the opportunity. The map never shows a Host’s exact address.
  • Traveler listings appear in the traveler directory and on the member portal map, which only signed-in members can see.
  • Your public profile shows your first name, photo, bio, and the other profile fields you fill in, to members who view it.
  • Messages are visible to you and the members in the conversation.
  • Reviews you write appear on the profile of the member you reviewed.

We do not show your email address, phone number, or birthdate to other members. You decide what you tell another member in a message.

4.2 Homepage New-Member Carousel

Our public homepage has a carousel of new members, recently active members, and members our team selects. If your profile has a photo, the carousel can show your first name, profile photo, the flag of your country, whether you are a Host, and how long ago you joined or were last active. Each card links to your member portal profile, which only signed-in members can see. To be left out, email support@crossexchange.org and we will remove you.

4.3 With Service Providers

We use service providers to run our sites and services. They process personal information for us, under contracts that let them use it only to provide their service to us and not for their own purposes. The list below names our current providers, what each does for us, and the data each receives. If we add a provider of the same kind (for example, a different hosting company), this policy covers it, and we update the list.

  • Sharetribe: runs the member portal marketplace platform. Receives account, profile, listings, messages, and reviews.
  • Twilio SendGrid (through Sharetribe): sends member portal emails from notifications@crossexchange.org. Receives name, email address, and email content.
  • Render: hosts the member portal web server. Receives IP address, browser details, and server logs.
  • Vercel: hosts the marketing site and the AI assistant, and limits request rates. Receives IP address, browser details, and server logs.
  • Upstash (through Vercel): stores rate-limit counters and a record of operational messages we sent. Receives IP address and a random chat session ID (as counter keys), member IDs and names, last-active times, and the subject and details of each operational message.
  • PostHog: product analytics on both sites, and session replay in the member portal if you accept. Receives usage events, pages viewed, approximate location, and an anonymous or member ID; with your consent in the member portal, screen recordings with form inputs masked.
  • Anthropic: runs the AI model behind the AI assistant. Receives the text of your messages to the assistant.
  • Sentry: error monitoring for the member portal. Receives error details, member ID, and IP address.
  • HubSpot: our contact database (CRM). Receives contact form submissions, and member name, email address, phone number, member portal ID, country, age, sex, faith background, bio, Instagram username, and emergency contact.
  • Resend: sends contact-form and transactional emails from the marketing site. Receives name, email address, and email content.
  • Cloudflare Turnstile: blocks bots on our forms. Receives IP address and browser signals.
  • Calendly: schedules Host confirmation calls. Receives name, email address, and booking details.
  • Mapbox: maps and location search in the member portal. Receives place names you search for, map position, and IP address.
  • Google: “Sign in with Google,” YouTube video embeds, Google Meet for Host confirmation calls, and Google Workspace (Gmail and Google Sheets) for staff email and records. For sign-in, receives name, email address, and Google account ID. For YouTube, receives IP address and browser details, only after you click play. For Meet, receives name, email address, and the video and audio of the call. For Workspace, receives the emails we send and receive and the member records staff keep.
  • ImageKit: delivers images and video on the marketing site. Receives IP address and browser details.
  • Meta (WhatsApp): delivers WhatsApp message alerts. Receives phone number and message content.
  • Twilio: delivers SMS message alerts. Receives phone number and message content.
  • MailerLite: sends onboarding emails after you sign up. Receives name, email address, and whether you joined as a Host or Traveler.
  • Substack: sends our newsletter from newsletter.crossexchange.org. Receives name, email address, and newsletter engagement.
  • Todoist: holds staff follow-up tasks, such as welcoming a new Host. Receives name and email address.
  • Composio: a tool our staff use to look up data in PostHog and HubSpot. Receives the data staff look up.

Our message automations run on our own server (n8n, which we host ourselves), so no automation company receives your data.

4.4 For Legal and Safety Reasons

We may disclose personal information when we believe in good faith that the law requires it, to respond to a court order, subpoena, or request from a public authority, to enforce our Terms and Conditions, or to protect the safety, rights, or property of members, the public, or Cross Exchange (for example, to investigate fraud or a threat of harm).

4.5 Business Transfers

If Cross Exchange merges with another organization, is acquired, or transfers all or part of its assets, your personal information may transfer to the new organization. The new organization must follow this policy or tell you about any change, as section 16 describes.

4.6 With Your Consent

We share your personal information in other ways only when you ask us to or agree.

5. Sensitive Information

5.1 Health Information

You do not have to give us any health information. If you choose to add health information to your profile or a message, you give us your explicit consent to process it for the purposes below.

  • Use. We use health information only to support your stay and your safety (for example, so a Host knows about a food allergy).
  • Sharing. A Host sees your health information only if you share it (in your profile or a message) or if you ask us to pass it on.
  • Deletion. You can delete health information from your profile at any time, or email support@crossexchange.org to ask us to delete it.
  • Retention. We keep health information until you delete it or delete your account. Section 8 has the details.

5.2 Religious Information

Cross Exchange is a Christian platform. Joining as a member, adding your faith background to your profile, or registering a church or ministry as a Host may reveal your religious beliefs. We treat this as sensitive information. We use it only to run the platform (for example, to match Travelers with Hosts), and we do not use it for advertising or sell it.

6. AI Assistant

Our marketing site offers an optional AI assistant. It answers questions about our Traveler and Host programs using the content published on our marketing site. It gives information only. It does not provide pastoral care or counseling, it cannot help with your member account, and it never asks for your name, email address, or phone number.

  • We do not store your conversations. We send your messages and the assistant’s replies to Anthropic to generate a reply. We do not write them to any Cross Exchange database. When you close the tab, no transcript exists for us to retrieve.
  • Vercel hosts the assistant and limits how many requests each visitor can make, to stop abuse.
  • PostHog records aggregate statistics, such as how often visitors use the assistant and how fast it replies. These statistics use the same anonymous session identifier as our cookieless analytics and never include the text of your messages.

Do not type sensitive information (such as health details or ID numbers) into the assistant.

7. Cookies and Similar Technologies

7.1 Marketing Site

The marketing site does not use tracking cookies. Our analytics run in a cookieless mode that stores no identifier on your device. PostHog computes a privacy-preserving anonymous identifier on its own servers instead. The AI assistant sets one functional cookie, a random session ID that expires after two hours, to limit how many messages a conversation can send.

7.2 Member Portal

The member portal uses essential cookies to keep you signed in and to make the site work. You cannot turn these off and still use the member portal.

The member portal shows a cookie banner. If you accept, PostHog sets analytics cookies, links your activity to your member ID, and may record your session (a replay of what you see and click, with all text and form inputs masked). If you decline or do not choose, we count your visit without cookies and do not record your session. You can change your choice at any time through the “Cookie settings” link in the member portal footer.

7.3 Embedded Content

Some pages embed content from other companies. YouTube videos use YouTube’s privacy-enhanced mode and load only after you click play. The Calendly booking widget loads when you open it. These companies may set their own cookies when you use their content, and their own privacy policies apply.

7.4 Global Privacy Control

We honor the Global Privacy Control (GPC) signal. We treat it as a request to opt out of the sale and sharing of your personal information (which we do not do anyway).

8. How Long We Keep Your Information

We keep personal information only as long as we need it for the purposes in this policy, or longer if the law requires it.

  • Account and profile: while your account exists, then deleted or de-identified as section 9.2 describes.
  • Messages: while your account exists. After you delete your account, the other member’s copy of the conversation stays, without your name.
  • Reviews you wrote: stay on the reviewed member’s profile after you delete your account, with your name removed.
  • Health information: until you delete it, or until we delete your account.
  • Record of removed members: as long as needed to stop them from signing up again.
  • AI assistant conversations: not stored by us.

9. Deactivating and Deleting Your Account

9.1 Deactivating Your Account

To deactivate your account, email support@crossexchange.org. We hide your profile and listings from other members and from our homepage, and keep your information so you can reactivate later.

9.2 Deleting Your Account

To delete your account, use “Manage account” in your member portal account settings, or email support@crossexchange.org. When you delete your account, the member portal deletes your account, profile, and listings at once. We then delete or de-identify your personal information in our other systems (such as our CRM and email lists) within 30 days, with these exceptions:

  • Backups. Copies in our providers’ backups are overwritten on their normal backup cycle.
  • Legal, safety, and fraud prevention. We keep information we need to comply with law, resolve disputes, prevent fraud, or keep members safe. For example, we keep a record of members we removed for breaking our Terms and Conditions so they cannot sign up again.
  • Reviews and conversations. Reviews you wrote stay on the other member’s profile, and messages you sent stay in the other member’s copy of the conversation, without your name.
  • De-identified data. We may keep data that no longer identifies you, for research and statistics.

10. How We Protect Your Information

We encrypt data between your browser and our servers with Transport Layer Security (TLS). We limit staff access to personal information to the people who need it, require sign-in for staff tools, apply a Content Security Policy on our sites, and keep our software updated. No method of storage or transmission is completely secure, and we cannot guarantee the security of your information.

If a data breach affects your personal information, we will notify you and the regulators the law requires, without unreasonable delay.

11. Your Rights and Choices

11.1 Your Rights

Wherever you live, you can ask us to:

  • access the personal information we hold about you;
  • correct information that is wrong or incomplete;
  • delete your personal information (section 9.2 lists what we must keep);
  • give you a copy of your information in a portable, machine-readable format;
  • stop sending marketing emails (section 11.2);
  • withdraw consent you gave us, such as for health information (section 5.1) or portal analytics cookies (section 7.2). Withdrawing consent does not affect what we did before you withdrew it.

Depending on where you live, you may have more rights, described in sections 12 and 13. We will not treat you differently, deny you service, or give you a worse service because you used any of these rights.

11.2 Communication Preferences

You can stop marketing emails and newsletters by using the unsubscribe link in any of them. To stop WhatsApp or SMS alerts, choose “No Text Notification” in your member portal profile settings, or reply STOP to any SMS. We still send essential messages about your account, such as security notices and confirmations.

11.3 How to Make a Request

Email support@crossexchange.org from the email address on your account. We will check your identity before we act, and we may ask for more information to do so. You can also ask an authorized agent to make a request for you. We will ask the agent for your signed permission and may ask you to confirm your identity directly.

We respond within one month if you are in the EEA, UK, or Switzerland, and within 45 days if you are in California. If we need more time, we will tell you why, and the law lets us extend by up to two more months (EEA, UK, Switzerland) or 45 more days (California).

11.4 Appeals

If we refuse your request, we will tell you why. You can appeal by replying to our decision or emailing support@crossexchange.org with “Privacy appeal” in the subject line. We will answer your appeal within 45 days. If you are not satisfied, you can contact your state attorney general or your data protection authority.

12. California Privacy Rights

This section applies to California residents and adds to the rest of this policy.

12.1 Categories of Personal Information

In the last 12 months, we collected these categories of personal information (as the CCPA defines them). Section 2 lists the sources, section 3 the purposes, and section 4 the recipients. Each entry gives examples, then who we disclosed them to for a business purpose.

  • Identifiers: name, email address, phone number, member ID, IP address, Google account ID. Disclosed to service providers, and to other members (name only).
  • Customer records: address of a Host home, emergency contacts, contact-form messages. Disclosed to service providers, and to other members (Host listing details).
  • Protected classifications: age, sex, religion (if you disclose it). Disclosed to service providers, and to other members (if in your profile).
  • Internet or network activity: pages viewed, clicks, session replays (portal, with consent), error reports. Disclosed to service providers.
  • Geolocation (approximate): country or city from IP address, map searches. Disclosed to service providers.
  • Audio and visual information: profile and listing photos, Host confirmation video call (not recorded unless agreed). Disclosed to service providers, and to other members (photos).
  • Professional or employment information: skills and work experience in your profile. Disclosed to other members and service providers.
  • Inferences: none.
  • Sensitive personal information: health information, religious beliefs (if you disclose them), account sign-in. Disclosed to service providers, and to Hosts (health, only as section 5.1 describes).

12.2 No Sale or Sharing

We do not sell or share (for cross-context behavioral advertising) personal information, and we have not done so in the last 12 months. We do not sell or share the personal information of anyone under 16.

12.3 Sensitive Personal Information

We use sensitive personal information only for purposes the CCPA permits (for example, to provide the services you ask for and keep members safe). We do not use it to infer characteristics about you. For that reason we do not offer a “Limit the Use of My Sensitive Personal Information” link.

12.4 Shine the Light

California Civil Code §1798.83 lets California residents ask which personal information we disclosed to third parties for their direct marketing. We do not disclose personal information to third parties for their direct marketing.

13. Users in the EEA, UK, and Switzerland

13.1 Controller

The controller of your personal information is Cross Exchange International Ministries Inc., 1937 Klauber Ave, San Diego, CA 92114, USA, support@crossexchange.org.

13.2 Lawful Bases

We rely on these lawful bases:

  • Contract (to provide the service you signed up for): create and run your account, publish profiles and listings, deliver messages, and send account and service emails and message alerts.
  • Explicit consent (Art. 9(2)(a)): health information you choose to share.
  • Explicit consent (Art. 9(2)(a)), or our legitimate activities as a not-for-profit religious body (Art. 9(2)(d)): religious information.
  • Consent: portal analytics cookies and session replay, and newsletters and marketing emails.
  • Legitimate interests: Host confirmation calls (member safety); the homepage new-member carousel (showing that the platform is active); CRM records (keeping in touch with members); cookieless analytics and error monitoring (keeping the sites working and improving them); fraud prevention, abuse prevention, and rate limiting (member safety and security); replies to the contact form and support requests (answering you); the AI assistant (answering visitor questions).
  • Legal obligation, and legitimate interests (defending claims): compliance, legal requests, and legal claims.

Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds to continue.

13.3 Complaints and Representative

You have the right to complain to the data protection authority where you live or work, or where you think a breach of your rights happened. We ask that you contact us first so we can try to resolve it.

We have not appointed a representative in the EU or the UK.

14. International Data Transfers

Cross Exchange is in the United States. We and our service providers store and process your personal information in the United States and in other countries where our providers operate. These countries may not have the same data protection laws as your country.

When we transfer personal information from the EEA, the UK, or Switzerland, we rely on safeguards the law recognizes: the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU-U.S. Data Privacy Framework (with its UK and Swiss extensions) where the provider participates in it. You can ask for a copy of the relevant safeguards by emailing support@crossexchange.org.

15. Children

You must be 17 or older to create an account. Members aged 17 can use the member portal to plan and prepare a Stay, but must be 18 or older on the day the Stay begins. We do not knowingly collect personal information from children under 17. If you think a child has given us personal information, email support@crossexchange.org and we will delete it.

Some Travelers travel with their children, and some Hosts have minors living in the home. Please share only the information about children that the stay requires (for example, that minors live in the home, or their ages). Do not upload photos of a child unless you are the child’s parent or guardian, or have their permission.

16. Changes to This Policy

We may update this policy. When we do, we change the “Last Updated” date at the top. If a change is material, we will email you at least 30 days before it takes effect.

17. Contact Us

If you have a question about this policy or want to use your rights, contact us:

Cross Exchange International Ministries Inc.
1937 Klauber Ave
San Diego, CA 92114, USA
support@crossexchange.org