Privacy policy.

Two parties handle personal data here, and the distinction decides who a member should ask for what.

• ·The church is the controller. It decides which members to record, what to record about them, and for how long. A member’s request about their own record goes to their church first.
• ·Emito Consulting Service LLC is the processor. We hold the records on the church’s behalf and act on its instructions. We do not decide what a church collects, and we do not use one church’s records for our own purposes.

The terms of that arrangement are set out in our Data Processing Addendum, which any church may execute with us.

As a controller — that is, for our own account — we collect only what is needed to run the business:

• ·Account details for the people who administer a church: name, email address, and the church they belong to.
• ·Billing information. Card details are entered directly with Stripe and never reach our servers; we hold only the last four digits, the card brand, and the invoice history.
• ·Correspondence you send us — this website’s contact form, and any email that follows from it.
• ·Server and security logs: request metadata, IP address, and error traces, kept to operate and defend the service.

As a processor, on a church’s instruction, the platform holds whatever that church chooses to record about its members — contact details, households and relationships, attendance and engagement, giving history, group and event participation, form submissions, and pastoral notes. What is collected is the church’s decision, not ours.

• ·We do not sell personal information. Not to anyone, not ever, and not under any definition of "sale" — including the broad one in the California Consumer Privacy Act.
• ·We do not share one church’s records with another. A diocese sees its own parishes and nothing else.
• ·We do not use member data to train or fine-tune AI models, and we use no retrieval index built from customer data.
• ·We run no advertising networks and no behavioural analytics on this site.

This marketing site sets no advertising cookies and runs no analytics tracker. Two features load third-party code, and only on the pages that use them:

• ·Cloudflare Turnstile, on the contact form, to tell a person from a bot. It may set a strictly functional cookie for that purpose.
• ·Cal.com, on the booking page, to show our calendar and record an appointment you choose to make.

Both are named in our subprocessor list. The signed-in application at app.holyplatform.com uses cookies only to keep you signed in.

Retention is set by the record’s kind, not by our convenience:

• ·Operational records — for as long as the church’s subscription is active.
• ·Deleted records — restorable for 30 days, then purged 90 days after deletion by default; a church can shorten that to no less than 30 days or lengthen it.
• ·Giving records and audit logs — 7 years, as US tax substantiation rules for charitable contributions require (IRS Publication 1771).
• ·Communication delivery logs — 1 year. Form submissions — 2 years.
• ·Sessions — 30 days from last activity.
• ·A closed account — when the church’s Owner deletes the church, its data is kept for 90 days so it can be restored if the church asks us, then permanently deleted. Donation records are kept in anonymized form, the audit log for 7 years, and our own billing records for financial compliance. Cancelling a subscription is not closing the account: the church moves to the Free plan and nothing is deleted.

Wherever you live, the platform supports access, correction, export and erasure. Under the GDPR these are Articles 15, 16, 17 and 20; under the CCPA they are the rights to know, to delete, to opt out of sale, and to non-discrimination.

• ·Access and portability — a church may export every record it holds, in CSV and JSON, at any time and without asking us.
• ·Correction — members with portal access may correct their own details; an administrator may correct any record.
• ·Erasure — we acknowledge a deletion request within 48 hours and complete it within 30 calendar days. Giving entries are anonymized rather than removed, because the law requires the church to keep them; the audit log cannot be altered, so its entries stay until they reach the end of their 7-year retention.
• ·Objection and restriction — a member may be marked do-not-contact, which stops every outbound email and text.

Because the church is the controller, address a request about a member’s record to that church. If you cannot reach them, write to privacy@holyplatform.com and we will help.

Churches record children, and the platform treats those records with additional restriction. A parent who registers children through a church’s registration form must give consent, which is recorded; a parent or guardian may ask the church to see, correct or delete their child’s record; children are left out of the member directory; and the platform blocks email and text messages addressed to a child under 13. A child record with no birth date on file is treated as under 13 until one is supplied. Separately, Holy’s AI features don’t process the personal data of anyone recorded as under 18, or whose age isn’t on file — judged by the date of birth on file or, when none is recorded, by a child record, a school grade from pre-K to 12th, or a household role of child or dependent; someone with no date of birth, no school grade and no household role has no age on file. This covers Holy’s own AI features and connector, not integrations a church builds on our REST API. Our children’s data statement sets out what is kept, why and for how long.

Records are encrypted in transit and at rest, access is controlled by role and permission, and every change to a record is written to an audit log. The controls are described in full on our security page, candidly, including what we have not yet done.

We use trusted third parties to operate the platform — hosting, database, payment processing, email and text delivery, error monitoring, bot protection and AI assistance. Each is bound by a written agreement, processes data only on our instructions, and receives no more than its function requires. The full list, with what each receives and where it processes it, is at holyplatform.com/legal/subprocessors, and we give at least 30 days’ notice before adding one.

If personal data is exposed, we contain it, assess it, and notify. Where the GDPR applies we notify the supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the risk to them is high. Affected churches are told what happened, what data was involved, and what we did about it.

When this policy changes materially we update the date at the head of this page and notify account administrators by email. Superseded versions are available on request.

Privacy and data-protection questions: privacy@holyplatform.com. Anything else: support@holyplatform.com. By post: Emito Consulting Service LLC, Monroe, North Carolina, United States.