Privacy Policy

About this policy

This policy explains how CFOLD collects, uses and protects personal information when you visit cfold.org, create an account, or use the service. By using CFOLD you agree to the practices described here.

Our role

Each church decides what it records about its members and visitors. For that information the church is in charge (the data controller) and CFOLD processes it on the church's behalf. If you are a member with a question about your record, please contact your church first; we will help them answer it.

For the accounts people use to sign in, and for visitors to cfold.org, CFOLD is responsible for the information described below.

What we collect

• Account details: your name, email address and a password, which we store only as a one-way hash.
• Church details: the church's name, logo, address, contact email and phone, time zone and currency.
• Records a church enters: people's names, contact details, addresses, dates of birth and milestones, family links, group and team membership, rosters, attendance, giving records and receipts, prayer requests and testimonies, and service reviews.
• Forms on a church's public pages: what someone chooses to submit, such as a prayer request with their name and, if they ask to be called, their phone number.
• Technical information: basic server logs, such as IP address and time of a request, kept to run and secure the service.
• Payment information: handled by our payment provider. We receive confirmation of payment, not your card number.

How we use it

We do not sell, trade or rent personal information, and we do not use a church's records for advertising.

• To provide the service your church signed up for, including the emails it sends: invitations, reminders, check-ins and receipts.
• To keep accounts secure, prevent misuse and fix problems.
• To bill for the service and keep the records the law requires.
• To tell account holders about important changes to CFOLD.
• To improve the service based on feedback and how features are used.
• To detect and prevent fraud, unauthorised access and abuse.

Who can see it

• Within a church, access depends on role: leaders see the people in the groups they lead, and giving, prayer requests and testimonies are visible only to people the church names.
• Each church's records are kept separate from every other church's.
• Pages a church chooses to share, such as its public calendar or a roster link, can be opened by anyone with the link. Nothing is public until the church switches it on.
• Our staff access a church's records only when needed to provide support or keep the service running.

Service providers we use

We share information only with providers that help us run CFOLD, and only what they need:

• Hosting and database: Hostinger.
• Email delivery: Zoho Mail.
• Payments: our payment gateway (PayHere).
• Fonts on cfold.org: Google Fonts, which receives your IP address when the website loads its typefaces.

Legal requirements

We may disclose information if the law requires it, or in response to a valid legal request or court order. Where we are allowed to, we will tell the church concerned first.

Cookies

CFOLD uses only the cookies it needs to work: one to keep you signed in, and one to remember which church you are viewing if you belong to more than one. Your browser also stores a few display preferences, such as a collapsed sidebar. We do not use advertising or tracking cookies.

You can block or delete cookies in your browser settings, but you will not be able to stay signed in without them.

How long we keep it

• Records stay for as long as the church keeps its account.
• Anything deleted in the app goes to a trash area and is permanently removed after 30 days.
• When a church closes its account, its records are deleted within 90 days, except where the law requires us to keep something, such as billing records.

Security

Passwords are hashed, connections are encrypted, and access inside each church is limited by role. Card payments are handled entirely by our payment provider.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If we ever learn of a breach affecting your church's data, we will tell the church without undue delay.

Your rights

You can ask to see, correct or delete personal information about you. Signed-in users can edit their own profile in the app. For anything else, contact your church, or email us at hello@cfold.org and we will help.

Children

CFOLD accounts are for adults. A church may record information about children in its care; the church is responsible for having the consent of a parent or guardian to do so.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page with a new "Updated" date, and if a change matters we will tell account holders.

Contact

• Business: MurFx
• Email: hello@cfold.org
• Phone: +94 77 799 5734
• Address: 91, Ratnilakele, Devsiripura, Talawakelle, Sri Lanka
• Website: cfold.org