Privacy Policy

ChurchNest is software that helps churches and ministries look after their people: members and families, groups, attendance, giving records, events and pastoral care. This Policy explains how Inspiring-Life Technologies Pvt. Ltd. ("ChurchNest", "we", "us") handles personal data when you visit our website, when you sign in to the Services as part of a church team, and when a church uses the Services to manage information about its congregation.

Two roles. For church staff who sign in, and for visitors to our website, we decide how personal data is used (we are the "controller"). For information a church stores about its members, the church decides and we act on its behalf (we are its "processor" or "service provider"). The Church controls its Church Data. We process it only to provide the Services, on the Church's documented instructions. We do not sell it, and we do not use it to advertise to anyone. Each Church sees only its own records. If you are connected with more than one Church, one Church cannot see your records at another, or that you are connected with another Church at all. Members: if your information is in a church's ChurchNest account, please contact your church about it. We will help the church respond to you. Questions: [privacy@churchnest.com].

For this group we are the controller. Personal Data we collect: • Account details: name, email address, phone number, role, the Church you belong to, and profile preferences. • Sign-in and security data: credentials (stored in protected form), authentication events, and security logs. • Billing details: billing contact, invoice details and subscription plan. Card details are handled by our payment provider and are not stored by us. • Support communications: messages, attachments and call or chat records when you contact us. • Usage and device data: IP address, browser and device type, pages and features used, timestamps and error logs. How we use and share it: • To create and secure your account, provide the Services, process payments, provide support, and send service and security notices. • To understand how the Services are used, fix problems and improve features. • To detect and prevent abuse, fraud and security incidents. • To send product news and offers to business contacts, where the law allows. You can opt out at any time. • To comply with legal obligations and enforce our Terms. Shared with: your Church (its administrators can see your account details and activity within its workspace); service providers that help us run the Services (see Section 10); professional advisers; authorities where legally required; and a successor in a merger or sale of our business.

For this group we are the processor (service provider). The Church is the controller and decides what to collect, why, and who can see it. Personal Data that may be in Church Data (depends on what each Church chooses to record): • Contact and identity details: name, address, email, phone, photo, date of birth or age. • Household and family connections, membership status and key dates. • Participation: groups, ministries, volunteer roles and event registrations. • Attendance at services, groups and events. • Giving and contribution records (amounts, dates and designations). ChurchNest records these; it does not move money. • Pastoral care information: prayer requests, care notes and follow-up reminders. • History of messages sent to the Member through the Services. Church Data can reveal sensitive information, such as religious beliefs, health or family circumstances, and can include information about children. See Sections 4 and 5. How we use and share it: • Only to provide the Services to the Church and to follow its documented instructions, including our agreement with the Church. • For operations that the Services need in order to work safely: hosting, backups, security monitoring, abuse prevention, and support provided at the Church's request. • We do not use Church Data for our own purposes. We do not sell it, use it for advertising or marketing profiles, use it to train general-purpose AI models, or combine it with data from other Churches. The only exception is statistics about how the Services perform (for example, how often a feature is used) that contain no Personal Data, where our agreement with the Church allows it. • Our staff access: ChurchNest staff do not routinely view Church Data. They access it only to provide support the Church has requested, to fix a problem, or to keep the Services secure, and only to the extent needed. This access is logged. Shared with: the Church and its authorized Church Users; an Organization, only as described below; our sub-processors (Section 10); and authorities only where the law requires, in which case we tell the Church unless we are legally prevented. Members connected with more than one Church: A person may be a Member of, or attend, more than one Church that uses ChurchNest. Each Church's records about that person are kept separately and are visible only to that Church. This includes attendance, giving, membership history, notes and prayer requests. One Church cannot see a person's records at another Church, or learn that the person is connected with another Church, unless the person chooses to share it. Organizations: A Church may link to an Organization, such as its denomination or network. By default, an Organization receives only aggregated reports, such as attendance totals, membership counts and growth figures, that do not identify individuals. A Church may choose to share limited identifiable information with an Organization for a specific purpose. The Church decides this, and must have a legal basis to do so. Where religious or other special-category data would be disclosed outside the Church's legal body, the Church must identify an appropriate Article 9 condition for that disclosure (where the GDPR or UK GDPR applies). If the Church relies on Article 9(2)(d), identifiable data cannot be disclosed outside the religious body without the individual's consent. Organizations never receive pastoral notes, prayer requests or children's records by default. The Church's responsibilities: Each Church is responsible for having a lawful basis for the data it collects, for giving its Members a privacy notice, for obtaining any consent that is required, for keeping Church Data accurate, and for deciding which Church Users can access what. The Church's own privacy notice governs its use of Church Data. Where the GDPR or UK GDPR applies, the Church must identify both a lawful basis under Article 6 and, for religious, health or other special-category data, a condition under Article 9. Consent is not the only option. For example, Article 9(2)(d) may allow a not-for-profit religious body to process data about its members, former members and people in regular contact with it, in the course of its legitimate activities. It has limits: it does not cover the data being disclosed outside the body without consent, and it may not cover first-time visitors, outreach contacts or information about third parties. The right condition depends on the person and the purpose, and the Church should confirm it with its own adviser. How we help Churches: As the Church's processor, we help it meet its obligations. This includes responding to individuals' requests, providing security information, notifying it of breaches, and supporting data protection impact assessments. We provide [a DPIA support pack] describing how the Services process data.

For this group we are the controller. Personal Data we collect: • Device and browser information, IP address, pages viewed, referring site and cookie identifiers. • Details you submit in forms: name, email, phone, church name and size, and your message. This includes demo bookings and trial sign-ups. • Newsletter and marketing preferences. How we use and share it: • To respond to enquiries, arrange demos and set up trials. • To run, secure and improve our website, including analytics. • To send marketing where you consent or where the law otherwise allows. Shared with: service providers such as hosting, analytics, scheduling and email tools (Section 10).

• Directly from you when you register, fill in a form, or contact us. • Automatically through cookies, logs and similar technologies when you use the Services. See our Cookie Policy. • From your Church, for example when an administrator invites you or imports your details. • From other sources, such as referrals or publicly available business information.

We use the Personal Data of Church Users and Visitors to provide and maintain the Services; to keep them secure; to support you; to communicate with you; to measure and improve the Services, using aggregated or de-identified information where possible; to meet legal obligations; and for any other purpose you have agreed to. Church Data is used only as described in Section 1.2.

• Sub-processors and service providers that work under written contracts and only on our instructions. • Your Church, as described above. • Authorities, courts and regulators where required by law or to protect rights, safety and security. • A buyer or successor in a merger, acquisition or sale of assets, with notice where required. • Aggregated or de-identified information that cannot reasonably identify you. We do not sell Personal Data and we do not share it for cross-context behavioral advertising.

We use essential cookies to run the Services and, where you allow it, analytics and similar cookies. Where the law requires consent (for example in the EEA and UK), we ask before setting non-essential cookies. We honor the Global Privacy Control signal for residents of US states that recognize it. For full details, see our Cookie Policy.

You can unsubscribe from our marketing emails using the link in each email. We will still send service, security and billing notices. Messages from a Church are controlled by that Church (see Section 6).

Depending on where you live, you may have the right to: • Access your Personal Data and receive a copy. • Correct inaccurate or incomplete Personal Data. • Delete your Personal Data. • Restrict or object to certain processing, including processing based on legitimate interests and direct marketing. • Receive your Personal Data in a portable format. • Withdraw consent at any time, without affecting earlier processing. • Opt out of the sale or sharing of Personal Data and of targeted advertising. We do not sell or share Personal Data in this way. • Not be discriminated against for exercising your rights. • Complain to a supervisory authority or your state attorney general.

Your own account or the website (we are the controller): use your account settings or email [privacy@churchnest.com]. We may need to verify your identity. We respond within one month (extendable where the law allows) under GDPR and within 45 days (extendable once) under most US state laws. Your information is in a Church's data (we are the processor): contact the Church. If you contact us, we will direct you to the Church or pass your request on, and we will help the Church respond within the timeframe in our agreement. Appeals (US): if we decline your request, you may appeal by replying to our response. If you are still unsatisfied, you may contact your state attorney general. Authorized agents: you may use an authorized agent where your state law allows. We will ask for proof of authority.

We use technical and organizational measures designed to protect Personal Data. These include: • Encryption in transit and at rest. • Separation between Churches' data, enforced on our servers and at database level, so one Church cannot see another's data. • Role-based permissions within each Church, including restricted access to pastoral and financial records (Section 4). • [Multi-factor authentication] for our staff and available to Church Users. • Logging of access to Church Data by our staff. • Monitoring, regular backups, confidentiality commitments for our staff, and checks on our providers. No system is completely secure. Please use a strong, unique password and keep it private. If a breach affects Church Data, we will tell the affected Church without undue delay, so the Church can meet its own obligations. Where we are the controller, we will notify regulators and individuals as the law requires.

We may keep data longer where the law requires or where we need it to resolve a dispute or defend a legal claim.

Controller: Inspiring-Life Technologies Pvt. Ltd., #308, Webel IT Park, P1 Taratala Road, Kolkata 700088, India. For Church Data, the Church is the controller and we are its processor under a data processing agreement. EU and UK representatives: [name and address, if appointed]. Privacy lead: [name and title] is responsible for privacy at ChurchNest and can be reached at [privacy@churchnest.com]. Data protection officer: [name and contact, if appointed]. Automated decisions: we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Complaints: you may complain to your local supervisory authority (in the UK, the Information Commissioner's Office), as well as to us.

This part applies to residents of US states with privacy laws, including California. For Account, billing and website data we act as a "business" or "controller". For Church Data we act as a "service provider" or "processor" for the Church, and the Church's notice applies to that data. Categories of Personal Data we handle:

Purposes and retention: we use each category for the purposes described in Section 1 for your type of relationship with us, and keep it for the periods in Section 8. This Section serves as our notice at collection. Sale and sharing: in the past 12 months we have not sold Personal Data or shared it for cross-context behavioral advertising. We honor the Global Privacy Control signal. Your rights: to know and access, correct, delete, receive a portable copy, opt out of sale, sharing and targeted advertising, limit the use of sensitive information, and not be discriminated against. Some states also give the right to opt out of profiling. We offer these rights to all US users, even where a state's thresholds do not require it. How to use them: see Section 7(c). We do not use sensitive personal information for purposes beyond providing the Services. Children: we do not knowingly sell or share the Personal Data of anyone under 16.

We publish additional regional notices for countries where we offer the Services and local law requires specific information. These are listed at [regional notices URL]. If you live in a country without its own notice and its privacy law gives you rights not described here, contact us and we will respond in line with that law.