Scope and roles
Zionel currently serves churches in the United States. This notice covers information Zionel determines how to use for operating the service, securing accounts, supporting customers and administering the business. Zionel includes church-scoped workflows for member, visitor, donation and pastoral records; review the separate Church Data Privacy Notice.
Information covered
Potential categories include account identifiers, contact details, authentication and security events, support communications, billing relationship data, device and diagnostic information, and choices made in the service. Where a church enables them, private in-app care messages and related account identifiers are collected for church-directed care; notification preferences and device tokens are used for enabled operational alerts. Push alerts should contain no private care-message text.
The governed privacy inventory records the data groups below.
- No advertising-data sale feature was identified in the reviewed product. Zionel will reassess any location-specific sale or sharing disclosure when the service or applicable requirements change.
- No advertising tracker was identified in the reviewed public application.
- Payment-card entry is handled on Stripe-hosted checkout when that configured workflow is used.
- identity-profile: account identifiers, contact details, profile preferences.
- authentication: credential references, security events, sessions and recovery state.
- church-membership: church membership, roles, ministry assignments.
- user-content: prayer and testimony content, announcements, uploaded media, content reports.
- ai-history: AI prompts, bounded task context, AI output references, safety reports.
- notifications: delivery addresses, message content, delivery status, device notification tokens.
- financial-integrity: transaction amounts and designations, donor contact details, provider payment references, refund and dispute status.
- security-audit: security audit events, pseudonymous network and device diagnostics, abuse signals.
- support: support communications, contact details, redacted troubleshooting evidence.
- backups: encrypted backup copies of applicable service records.
Purposes and legal bases
Information may be used to provide and secure the service, authenticate users, prevent abuse, respond to requests, administer contracts and billing, meet legal obligations, and improve reliability. Zionel will reassess applicable legal bases and location-specific disclosures when the service or applicable requirements change.
The governed privacy inventory maps the operational purposes below.
- identity-profile: provide the account, authenticate and secure access, respond to account requests.
- authentication: authenticate users, prevent abuse, investigate security events.
- church-membership: provide church-directed operations, enforce tenant and role boundaries.
- user-content: provide community features, moderate abuse, support safeguarding.
- ai-history: provide enabled AI features, trace and investigate unsafe output.
- notifications: send requested or operational communications, record delivery state.
- financial-integrity: provide church giving records, reconcile payments, prevent fraud, meet financial obligations.
- security-audit: secure the service, detect and investigate abuse, preserve accountability.
- support: respond to requests, resolve product and account issues.
- backups: recover from operational loss, preserve service continuity.
Retention, rights and contact
Retention periods are not yet universal public commitments. Account holders may have rights that depend on location and data role. Church-record requests should begin with the relevant church; Zionel-business-data requests follow the data-rights guidance.
Unspecified retention periods remain visible limits rather than promises. Account holders can start global deletion from their signed-in profile or use the public account-deletion guide.
- identity-profile: delete when global account deletion is processed; retained exceptions remain restricted and separately tracked.
- authentication: delete when global account deletion is processed; retained exceptions remain restricted and separately tracked.
- church-membership: pseudonymize when global account deletion is processed; retained exceptions remain restricted and separately tracked.
- user-content: pseudonymize when global account deletion is processed; retained exceptions remain restricted and separately tracked.
- ai-history: delete when global account deletion is processed; retained exceptions remain restricted and separately tracked.
- notifications: delete when global account deletion is processed; retained exceptions remain restricted and separately tracked.
- financial-integrity: the implementation target is 2557 days from later of the relevant tax return filing or due date and final dispute closure; property, unfiled-return and other statutory exceptions require a separate hold. Provider expiry and operational verification remain pending; this is not a completed deletion guarantee.
- security-audit: the implementation target is 2557 days from audit event creation. Provider expiry and operational verification remain pending; this is not a completed deletion guarantee.
- support: the implementation target is 365 days from support case closure. Provider expiry and operational verification remain pending; this is not a completed deletion guarantee.
- backups: the implementation target is 35 days from backup creation. Provider expiry and operational verification remain pending; this is not a completed deletion guarantee.
- Do not include passwords, authentication codes, financial account data or pastoral notes in a rights request.
Need another hand?
Use the support route that matches your role and question. Do not include passwords, session tokens, payment-card data or confidential pastoral notes.
Get support guidance