Privacy Policy

We collect information in three ways: information you provide directly, information generated by your use of the Service, and information from your devices.

Account and Church Information

• Name and email address (required to create an account)
• Church name, logo, and branding preferences
• Payment information (processed by Stripe — we never store full card numbers)
• Profile information you choose to add (phone number, birthday, anniversary)

Church Content

• Sermons, transcripts, and YouTube links you upload
• Announcements, events, and group posts you create
• Giving methods and financial display information
• Devotional content and prayer requests

Member Data

• Member names, email addresses, and phone numbers
• Prayer requests and group activity
• First-timer information submitted through your church's public form
• RSVP and engagement data

Usage and Technical Data

• Pages and features visited within the platform
• Browser type, operating system, and device type
• IP address and approximate location (country/region)
• Error logs and performance data (via Sentry)

In the mobile app

• A push notification token for your phone (through Google Firebase), only if you turn notifications on
• The camera, only while you scan a QR code (for example a church code or children's check-in). Images are not saved or uploaded

Children's check-in (churches that use it)

Parents, or the church's children's team at the check-in desk, can add: each child's name and date of birth; notes the team should know, such as allergies or medical needs; the people allowed to collect the children, with their phone numbers; and each check-in and pickup (time, room and who checked the child in or out).

• Notes about allergies and medical needs are encrypted before they are stored
• Only the children's team scheduled for that service, and church admins, can see a child's details, and only while they are serving. Every view is recorded
• Parents can change or delete their children's details at any time in the app
• Records are deleted automatically 18 months after a child's last check-in

We use the information we collect only to provide, maintain, and improve RhemaConnect. Specifically:

• Providing the core platform functionality (member app, admin dashboard, AI features)
• Sending transactional emails: account confirmation, password reset, billing receipts, member invites
• Processing payments and managing subscriptions via Stripe or Paystack
• Generating AI devotionals and content using your sermon material
• Sending push notifications you have explicitly enabled
• Displaying birthday and anniversary reminders to church admins
• Monitoring platform performance and diagnosing technical issues
• Communicating important service updates and security notices

SMS Communications

By submitting a first-timer visitor form at a RhemaConnect-powered church and ticking the optional SMS checkbox, you consent to receive text messages from that church via RhemaConnect: a follow-up after your visit and updates about service times and events. Message frequency varies by church. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for assistance. The RhemaConnect text messaging program is run by Axiira Media LLC. For support contact hello@getchurchspace.com.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Full details of the SMS program: rhemaconnectapp.com/sms.

We do not use your information for advertising, behavioral profiling, or sale to data brokers. We do not run advertising networks or use your data to target ads.

We share your information only with the following trusted third-party services, solely as required to operate RhemaConnect:

We may also disclose information if required by law, court order, or government request, or when necessary to protect the safety of users or the public.

We never sell your data to third parties. We never share your data for advertising purposes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We take data security seriously and implement multiple layers of protection:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• All data stored at rest is encrypted using AES-256 encryption
• Database access is protected by row-level security (RLS) — each user can only access data they're authorized for
• Authentication tokens are short-lived and regularly rotated
• We perform regular security reviews and dependency updates
• We use Sentry for real-time error monitoring and anomaly detection

In the event of a data breach affecting your information, we will notify you and applicable regulatory authorities within 72 hours of becoming aware of the breach, as required by applicable law.

While we implement strong security measures, no system is 100% secure. You are responsible for maintaining the security of your account credentials.

Active accounts. We retain your data for as long as your account is active and you are subscribed to RhemaConnect.

Cancelled accounts. After you cancel or your account is terminated, we retain your data for 30 days to allow you to export it or reactivate your account. After 30 days, all church and member data is permanently and irreversibly deleted.

Backup data. Deleted data may persist in encrypted backups for up to 90 days before being permanently purged from backup systems.

Deleting your account. You can delete your account yourself at any time: in the app under Profile → Delete my account, or at rhemaconnectapp.com/delete-account. Your profile, group memberships, posts, replies, prayer requests, messages, notifications and devices are deleted straight away. Records your church keeps, such as attendance and check-ins you did as a volunteer, stay without your name.

Deletion requests. If you can't sign in, email privacy@rhemaconnectapp.com from the address on your account and we will delete it within 30 days.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and all associated data
• Export: Download your church data in CSV or JSON format from your dashboard
• Opt-out: Unsubscribe from non-essential emails at any time
• Restriction: Request that we limit processing of your data in certain circumstances
• Portability: Receive your data in a structured, machine-readable format

EU/EEA users (GDPR). If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local supervisory authority.

California residents (CCPA). California residents may exercise rights under the California Consumer Privacy Act, including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, email privacy@rhemaconnectapp.com with your request. We will respond within 5 business days.

RhemaConnect uses a minimal set of cookies, all of which are essential for the platform to function:

• Authentication token: Keeps you logged in during your session
• Session identifier: Links your browser to your active session on our servers
• Theme preference: Remembers your light/dark mode preference
• CSRF protection token: Protects against cross-site request forgery attacks

We do not use advertising cookies, cross-site tracking cookies, or any third-party analytics cookies. We do not participate in advertising networks or behavioral profiling systems.

Because our cookies are strictly necessary for the platform to function, you cannot opt out of them while using RhemaConnect. However, you can clear cookies from your browser at any time, which will log you out of the platform.

RhemaConnect is a platform designed for church administrators and adult congregation members. The Service is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13.

Churches using RhemaConnect may have minor members in their congregations. Churches are responsible for obtaining appropriate parental consent before adding minors to RhemaConnect and for ensuring compliance with applicable laws regarding children's data.

Children's check-in details are added by a parent (who agrees to a consent statement first) or by the church's children's team with the parent present. Children do not have accounts and do not use the app themselves. See “Children's check-in” in section 1 for what is stored and who can see it.

If you are a parent or guardian and believe your child under 13 has provided us with personal information without your consent, please contact us at privacy@rhemaconnectapp.com. We will promptly delete such information.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We may update this Privacy Policy periodically. For material changes, we will notify you by email or a prominent in-app notice at least 14 days before the change takes effect. Your continued use of RhemaConnect after a policy update constitutes acceptance of the new policy.