Church Data Privacy Notice

Church and Zionel roles

Zionel provides church-scoped workflows for member, visitor, attendance, giving, household, ministry and pastoral information. Contractual responsibilities and legal roles require confirmation for the applicable service agreement and jurisdiction.

For church-managed records, the church determines the ministry purposes, the information it chooses to record and the people it authorizes to use that information. Zionel processes those records to provide and secure the service under the church’s instructions. Zionel separately determines how it processes account, security, support, billing and legal-compliance information needed to operate its own service and business.

Church-managed records

Records may include contact and household details, attendance, first-timer follow-up, team assignments, prayer or testimony content, giving records, uploaded files and pastoral-care information. Private in-app pastoral-care conversations store message text, sender and recipient references, case association and timestamps on Zionel servers for authorized church care workflows. These conversations are linked to the participating accounts and are not end-to-end encrypted. Some categories can be highly sensitive even where a law does not label them that way.

Religious beliefs, prayer, pastoral care, health, safeguarding and children’s information may require heightened protection because of their nature and the law that applies.

Access and responsibility

Access is limited through church-assigned roles and tenant boundaries. Churches must assign least privilege, review departed staff and volunteers, train users, and avoid entering information that is unnecessary for the ministry purpose.

Zionel provides church-boundary checks and role-based access controls. These shared responsibilities do not remove Zionel’s responsibility to secure the service.

• The church is normally the first point of contact for access, correction or removal requests involving church-managed records. Zionel handles requests about information it controls for its own accounts and business and assists churches with church-record requests where required.

Children and vulnerable people

The product is not approved as a direct-to-child service. Churches must obtain any notices, consent or authorization required for children’s data and use additional care with safeguarding information. Zionel will define any expanded age, consent and regional rules before enabling direct child access.

Authorized church users can record children’s names, household relationships, attendance, ministry participation and limited safeguarding information. A household child profile is not a standalone Zionel account. Churches must confirm guardian authority and provide any notice or obtain any consent required by the law that applies before entering or using children’s information. Zionel does not currently enforce a universal minimum account age, so child account access must not be enabled without an approved age and consent policy.

Retention, export and deletion

Authorized church administrators can currently export a paginated member-directory dataset containing member identifiers, names, email addresses, phone numbers and status. This is not a complete export of every church record. A member-directory export is not an automated end-of-service export or deletion of all church records. Contact Zionel to confirm the supported scope, process and timeframes for a church-data transition. Deleting a visible record does not necessarily remove related backup or audit records immediately. Retention requirements and deletion commitments remain visible limits. Financial, security, audit and backup records retained for an approved purpose remain access-restricted.

• The normal audit view shows 14 days. Older audit evidence is access-restricted and delivered to immutable archive storage; the approved archive retention is seven years.
• Global account deletion removes directly addressable identity data, redacts the deleted person’s authored prayer, testimony and care-request text, removes their reactions and acknowledgements, and starts processor-deletion tasks for owned profile media. Other members’ records remain within their church. Financial, security, audit and backup exceptions remain restricted; backup expiry requires separate verification.
• Do not assume that closing a workspace immediately deletes every church record or backup. Confirm the applicable return, retention and deletion arrangements with Zionel.

Service providers and transfers

Zionel uses service providers for hosting, private object storage and security operations, and may use additional providers only when the related feature is enabled. The separate subprocessor inventory distinguishes configured, conditional and optional providers. Consult the subprocessor notice and the church’s agreement for applicable provider and data-handling terms; contact Zionel about arrangements not specified there.