Privacy Policy

Last updated: April 2026. We take your privacy seriously, especially in a ministry context.

1. Who We Are

ChurchAI.tools is an independent project, based in South Africa. It is not affiliated with any church or denomination — it's a small, independently-built tool for church leaders who want to use AI well in their ministry work.

Information Officer: David — [email protected]

We are based in South Africa and comply with the Protection of Personal Information Act (POPIA). This privacy policy explains how we collect, use, and protect your personal information when you use ChurchAI.tools.

2. Information We Collect

We collect the following categories of personal information:

  • Account information: Your email address and name, provided during signup and account management.
  • Payment information: Payment details are processed and stored by Stripe. We do not store your credit card numbers or sensitive payment information on our servers.
  • Usage data: Course progress, lesson completion timestamps, resource download history, and onboarding quiz responses to personalise your experience.
  • Technical data: Browser type and device type, collected for analytics and troubleshooting purposes.

3. How We Use Your Information

We use your personal information for the following purposes:

  • Subscription management and billing via Stripe
  • Training progress tracking and resume functionality across sessions
  • Personalised content recommendations based on your role and onboarding quiz results
  • Email communications: account confirmations, subscription updates, and optional digest emails
  • Platform improvement and troubleshooting

We do NOT sell, rent, or trade your personal information to third parties. We do not use your personal information for targeted advertising.

4. Third-Party Services

ChurchAI.tools uses the following third-party services, each of which may process some of your personal information:

  • Supabase (supabase.com) — Database and authentication. Stores user accounts, progress, bookmarks, and session data. Hosted in EU/US regions.
  • Stripe (stripe.com) — Payment processing. Handles subscription billing and management. PCI DSS Level 1 compliant. Stripe retains transaction records per their own data retention policy and legal requirements.
  • Vercel (vercel.com) — Application hosting and content delivery network (CDN).
  • Cloudflare (cloudflare.com) — CDN and SSL/TLS encryption.
  • Vimeo (vimeo.com) — Secure training video hosting and playback.
  • Brevo (brevo.com) — Transactional and marketing email delivery for account confirmations, onboarding sequences, and platform notifications.
  • Sanity (sanity.io) — Content management system for courses, skills, prompt libraries, and resources.
  • PostHog(posthog.com) — Privacy-first product analytics. We use PostHog to understand which courses, skills, and pages are actually useful so we can improve them. PostHog only receives data after you accept the analytics banner, and never receives sensitive content (sermon drafts, prayer requests, pastoral notes, theological questions, or any data you create using the platform's tools).

Cookies and Local Storage

We keep cookie use to a minimum. We use:

  • Authentication cookies set by Supabase to keep you signed in. These are essential for the service and cannot be opted out of without breaking login.
  • Attribution cookie (cai_attribution) — first-party, 90-day expiry. Stores how you arrived at the site (referrer, UTM parameters from a marketing link, Google or Meta click ID if you arrived from an ad) so we can correctly credit a marketing source when you sign up. This data is first-party and is never shared with third parties as part of this cookie.
  • Analytics consent choicestored in your browser's local storage. The first time you visit, a banner asks whether you accept analytics. Your answer is remembered locally so we don't ask again.
  • PostHog analytics cookies — only set after you accept the analytics banner. Used to track product usage in aggregate. You can revoke consent at any time by clearing site data in your browser; the banner will then reappear.

Each of these services has their own privacy policy governing their use of your data. We select service providers who meet appropriate security and data protection standards.

5. Your AI Usage (BYOAI)

ChurchAI.tools does NOT proxy, store, or have access to your AI conversations. This platform operates on a BYOAI (Bring Your Own AI) model — your AI interactions happen directly between you and your chosen AI provider.

When you use our Claude Desktop skills, prompts, or apply our training guidance with your own AI service (Claude, ChatGPT, Gemini, or others), that interaction occurs entirely outside of ChurchAI.tools. We never receive, store, or process your AI inputs or outputs.

Your AI subscription costs and usage are governed by your individual agreement with the respective AI provider. ChurchAI.tools has no visibility into, control over, or responsibility for those interactions.

6. Data Retention

Your account data is retained while your subscription is active. After account deletion or subscription cancellation, your personal data will be removed within 30 days. Anonymised usage statistics (with no personal identifiers) may be retained for platform improvement purposes.

Stripe retains transaction records per their own data retention policy and applicable legal requirements. We do not control Stripe's retention of billing records, which may be subject to financial regulations.

7. Your Rights Under POPIA

Under South Africa's Protection of Personal Information Act (POPIA), you have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete personal information.
  • Deletion: Request deletion of your personal information, subject to any applicable legal retention requirements.
  • Objection: Object to the processing of your personal information for direct marketing purposes.
  • Complaint: Lodge a complaint with the Information Regulator (inforegulator.org.za) if you believe your rights under POPIA have been violated.

To exercise any of these rights, please contact our Information Officer at [email protected]. We will respond to your request within a reasonable timeframe as required by POPIA.

8. Security Measures

We implement appropriate technical and organisational measures to protect your personal information:

  • Supabase Row-Level Security (RLS) ensures users can only access their own data — no cross-account data leakage
  • All data is transmitted over HTTPS/TLS, enforced by Cloudflare across all platform routes
  • Stripe handles all payment data with PCI DSS Level 1 compliance — the highest level of payment security
  • Authentication is managed via secure session tokens with httpOnly cookies to prevent client-side access
  • Regular security updates are applied to all platform dependencies

While we implement robust security measures, no system is completely immune to security incidents. We take our responsibility to protect your data seriously.

9. Breach Notification

In the event of a security breach that poses a risk to your rights and freedoms, we will notify both the Information Regulator and affected users as soon as reasonably possible, as required by POPIA Section 22.

Breach notifications to affected users will be sent to the email address associated with your account. The notification will describe the nature of the breach, the personal information involved, and the steps we are taking to address it.

10. Contact

For any privacy-related enquiries, to exercise your rights under POPIA, or to contact our Information Officer:

Information Officer: David

Email: [email protected]

ChurchAI.tools is an independent project run from South Africa.