What this system does with your information

What is collected

Your name and email address, a phone number and photo if you add them, the church offices and department memberships you are given, and the planning, reporting and finance records you enter as part of that work — activities, reports, budgets, payment requests and the like. A payment request can hold the bank details of whoever is to be paid, and quotations and receipts are uploaded as files.

The system also keeps a few records of its own: each time you sign in — when, whether with Google or a password, and whether from a phone, a tablet or a computer (that one word, not the details of your device); a log of the reminder emails it sent you and whether they were delivered; a count of how often each screen is opened, which does not record who opened it; and — for a short while, to stop password guessing — a count of failed sign-in attempts. Sign-ins and screen counts are kept for two years.

Signing in with Google

If you choose "Continue with Google", Google shares your email address and basic profile with this system so it can match you to the account the clerk already registered for you — nothing more. Signing in with Google never creates an account by itself; an address the clerk has not registered is turned away and told to contact the clerk instead. This system does not read your Gmail, your contacts, or anything else in your Google account.

Who sees it

People within the church who hold a relevant office — your department's leaders, the elder over your department, the Strategic Planning and Monitoring Committee (SPEMC), the Stewardship & Finance Committee and the board — see the records that office is responsible for. Nobody outside the church has access, and nothing is sold, shared with advertisers, or used for any purpose beyond running the church's own strategic plan and its finances.

SPEMC and the church's administrators can see when each person last signed in, how many people sign in each week and how, which screens are used most, and how much of each department's work is entered here, so they can help people who have not started using the system. That is worked out from the records above and goes nowhere else.

Emails

The system emails reminders and updates about your own work — a quarter's reports falling due, payment requests closing, a request sent back or decided. Every one carries a link to stop them, and you can switch them off on My profile.

Cookies and your browser

The system uses only what it needs to work, and nothing that tracks you, advertises to you or measures you for anyone else:

• A sign-in cookie, which keeps you signed in.
• A security cookie, which stops another website sending forms in your name.
• A "welcome back" cookie, kept for a year, which lets the sign-in page greet a browser that has signed in before. It does not say who you are.
• A short-lived message cookie, which carries notes such as "Saved" from one page to the next.
• Two things kept in your browser itself: whether you keep the menu collapsed, and a report you are writing, so it survives a dropped connection. The report is cleared once it is filed or you sign out.

There are no analytics or advertising cookies, and no pages load anything from other websites.

Services that hold it for the church

The church uses a few outside services to run the system. Each holds your information only to do that one job for the church:

• Render runs the system, from Frankfurt, Germany.
• Supabase keeps the database and the uploaded files.
• Brevo sends the emails.
• Google confirms who you are, only if you choose to sign in with Google.

Some of these keep information outside Zambia.

How it is protected

Every page is behind a sign-in and shows each person only what their office allows. Passwords are stored in a form nobody can read back — not even an administrator, who can only set a new one. Everything travels encrypted, uploaded files are private and open only through links that expire, and repeated wrong passwords lock sign-in for a while.

How long it is kept

Records are kept for as long as they remain part of the church's planning and financial record — ordinarily the life of the current strategic plan and the years after it that reporting or an audit might still reach back into.

When someone leaves an office their account is switched off rather than deleted if their name is on a record — a report they filed or a request they signed — so the record still says who did what. An account that is on no record can be deleted entirely.

Your choices

On My profile you can see your details, change your email address, phone number and password, and switch reminder emails off. To have anything else corrected, or to ask what the system holds about you or for your account to be closed, contact the church clerk.

Questions

Contact the church clerk, or the church office, with any question about your information or this notice.

Last updated 11 October 2026.