Children’s data.

Churches use Holy to keep records of the children in their care — for Sunday school, youth groups, events and check-in. The church decides what to record and is responsible for it; Emito Consulting Service LLC stores and processes those records on the church’s behalf, under our Data Processing Addendum.

Holy is not directed at children. A record marked as a child is created by church staff — directly or by importing their existing records — or by a parent or guardian registering their family; we do not ask children to create accounts or to give us information themselves.

• ·Name, date of birth and household — to place the child in the right class or group and to link them to their parents or guardians.
• ·Allergies, medical and care notes the church chooses to record — so the people looking after the child know what they need. These are kept separately, shown to staff the church allows to edit people records, and shown as an allergy alert to the volunteers checking children in.
• ·Check-in and attendance — when the child was checked in and out, and the one-time pickup code that lets only an authorised adult collect them.
• ·Group, class, event and volunteer-schedule membership — to run the ministries the child takes part in.
• ·A photo, if the church adds one — to help staff recognise the child at check-in.

• ·Church staff, according to the permissions the church gives them. Changes made through the app are written to the church’s audit log.
• ·Children are left out of the member directory and of church websites, so other members do not see their details or photos there.
• ·Other members of a group or class the child belongs to can see the child’s name and photo on that group’s member list in the member portal.
• ·Where the church turns on household management in the member portal, a parent or guardian can see their household there.
• ·The services we use to run the platform, each listed with what it receives on our subprocessors page.

• ·Email or text a child under 13. Every email and SMS the platform sends to a person is blocked for a child under 13 — and a child with no date of birth recorded is treated as under 13.
• ·Sell children’s information, use it for advertising, or build profiles of children for any purpose of our own.
• ·Use a church’s data, children’s included, to train an AI model.
• ·Let Holy’s AI features process the personal data of anyone recorded as under 18, or whose age isn’t on file — judged by the date of birth on file or, when none is recorded, by a child record, a school grade from pre-K to 12th, or a household role of child or dependent; someone with no date of birth, no school grade and no household role has no age on file. The AI person summary is refused for them before anything about them is read or sent, and our connector for AI assistants (MCP) leaves their records out. This covers Holy’s own AI features and connector, not integrations a church builds on our REST API. It works from the church’s records: a young person recorded without a date of birth or school grade, not marked as a child, and listed in a household as head, spouse or other is not recognised, and free text about someone else — a note on an adult, or a sermon — is not screened for mentions of a child. The contact email and phone staff type onto an event go to the connector as entered: they are linked to no person record, so there is no age to check.

One optional feature can include a child’s record when a church turns it on, so we name it. The scheduled data export a church can send to its own reporting tools includes children’s records, but never the pickup codes or check-in notes.

• ·While the child takes part. A child’s record stays for as long as the church keeps it active.
• ·When the church deletes it. A deleted record can be restored for 30 days and is then permanently deleted on the church’s retention schedule — 90 days after deletion by default, never sooner than 30 days, and no longer than 10 years if the church chooses a longer period. The child’s attendance and pickup codes, medical notes, household links, memberships, photo and attached files are deleted with it.
• ·If a legal hold is placed. A church may pause deletion while a legal matter requires the records to be kept; deletion resumes when the hold is lifted.
• ·What stays longer. The church’s audit log, which records who changed what and may include a child’s name, is kept for 7 years. In the rare case a child has giving records tax law requires us to keep — a statement, pledge or recurring gift from the last 7 years — the child’s record is kept until that period ends.
• ·Backups. Our database backups are kept for a short rolling window set by our database provider. Copies of deleted photos and files are removed from our encrypted file backup about 90 days after deletion.

If a church closes its account, its records — children’s included — are handled as our privacy policy describes.

A parent or guardian can ask the church to show them what it holds about their child, to correct it, or to delete it. The church acts on the request in Holy; deleting a record starts the schedule above.

Where a law such as the US Children’s Online Privacy Protection Act requires a parent’s consent, obtaining it is the church’s responsibility. Holy supports it: when a parent registers children through a church’s family registration form, the form will not accept the children without the parent’s consent, and we record when and from where it was given; and a child’s record can be linked to their parents or guardians.

If you cannot reach your church, write to privacy@holyplatform.com; we will pass your request to the church and help it respond.