Church Data Privacy Notice

Who operates Zionel

Zionel is operated by Zionel LLC ("Zionel," "we," "us").

For privacy questions, contact privacy@zionelchurchapp.com. For product or account support, contact support@zionelchurchapp.com.

Church and Zionel roles

Zionel provides church-scoped workflows for member, visitor, attendance, giving, household, ministry and pastoral information. Contractual responsibilities and legal roles require confirmation for the applicable service agreement and jurisdiction.

For church-managed records, the church determines the ministry purposes, the information it chooses to record and the people it authorizes to use that information. Zionel processes those records to provide and secure the service under the church’s instructions. Zionel separately determines how it processes account, security, support, billing and legal-compliance information needed to operate its own service and business.

Church-managed records

Records may include contact and household details, attendance, first-timer follow-up, team assignments, prayer or testimony content, giving records, uploaded files and pastoral-care information. Private in-app pastoral-care conversations store message text, sender and recipient references, case association and timestamps on Zionel servers for authorized church care workflows. These conversations are linked to the participating accounts and are not end-to-end encrypted. Some categories can be highly sensitive even where a law does not label them that way.

Religious beliefs, prayer, pastoral care, health, safeguarding and children’s information may require heightened protection because of their nature and the law that applies.

Access and responsibility

Access is limited through church-assigned roles and tenant boundaries. Churches must assign least privilege, review departed staff and volunteers, train users, and avoid entering information that is unnecessary for the ministry purpose.

Zionel provides church-boundary checks and role-based access controls. These shared responsibilities do not remove Zionel’s responsibility to secure the service.

• The church is normally the first point of contact for access, correction or removal requests involving church-managed records. Zionel handles requests about information it controls for its own accounts and business and assists churches with church-record requests where required.

Children and vulnerable people

Children under 13 may be represented in authorized church-managed household and attendance records, but cannot independently open a Zionel workspace, shared feed or care conversations. Churches must confirm guardian authority and provide notices or obtain consent required by applicable law before collecting children’s information. A household child record is not a standalone sign-in account. Regional and parental restrictions may require additional safeguards for older minors; a 13+ declaration does not establish compliance in every jurisdiction.

Retention, export and deletion

Authorized church administrators can currently export a paginated member-directory dataset containing member identifiers, names, email addresses, phone numbers and status. This is not a complete export of every church record. A member-directory export is not an automated end-of-service export or deletion of all church records. Contact Zionel to confirm the supported scope, process and timeframes for a church-data transition. Deleting a visible record does not necessarily remove related backup or audit records immediately. Retention requirements and deletion commitments remain visible limits. Financial, security, audit and backup records retained for an approved purpose remain access-restricted.

• The normal audit view shows 14 days. Older audit evidence is access-restricted and delivered to configured archive storage. The documented audit retention target is seven years; provider expiry, holds and restoration handling require operational verification, not merely approval of a target.
• Global account deletion removes directly addressable identity data, redacts the deleted person’s authored prayer, testimony and care-request text, removes their reactions and acknowledgements, and starts processor-deletion tasks for owned profile media. Other members’ records remain within their church. Financial, security, audit and backup exceptions remain restricted; backup expiry requires separate verification.
• Do not assume that closing a workspace immediately deletes every church record or backup. Confirm the applicable return, retention and deletion arrangements with Zionel.

Service providers and transfers

Zionel uses service providers for hosting, private object storage and security operations, and may use additional providers only when the related feature is enabled. The separate subprocessor inventory distinguishes configured, conditional and optional providers. Consult the subprocessor notice and the church’s agreement for applicable provider and data-handling terms; contact Zionel about arrangements not specified there.

Questions, corrections and privacy requests

Email privacy@zionelchurchapp.com for privacy questions, access or correction requests, or help with account deletion. For church-managed records, contact your church administrator first; if you cannot reach the church or the issue concerns Zionel itself, contact Zionel directly. Describe the request and the relevant church without sending passwords, verification codes, identity documents, payment credentials or private pastoral narratives. We may ask for proportionate verification through an established account channel before disclosing or changing records.

A church membership ending does not by itself delete the person’s global account or records held for other churches. Global account deletion is available from Profile. The account-deletion guide explains the workflow and restricted exceptions. Church-managed records and a person’s independent sign-in account are different responsibilities.