This document is a general foundation for a U.S. SaaS service and does not constitute legal advice. It should be reviewed by counsel before commercial launch.
1. Scope and roles of the parties
This Policy explains IglesiaWeb practices for www.iglesiaweb.net, system.iglesiaweb.net, public forms, and related services (the “Service”).
When a church enters information about members, visitors, donors, volunteers, or others, the church determines why and how that information is used. In that context, the church acts as the controller or business and IglesiaWeb acts as a service provider or processor following church instructions. IglesiaWeb directly controls account, billing, support, security, and website-use data collected to operate the Service.
2. Information we collect
We may collect:
- Account and organization: name, email, phone, language, protected credentials, role, church name, logo, and institutional contact details.
- Church-managed data: members, families, visitors, companions, countries of origin, ministries, volunteers, events, prayer requests, follow-up, and uploaded documents.
- Financial administration: records of tithes, offerings, donations, budgets, expenses, reimbursements, inventory, reconciliations, and reports. IglesiaWeb does not request complete bank account numbers through ordinary modules.
- Billing: customer, subscription, plan, and payment-status identifiers. Stripe processes complete card and payment-method data; IglesiaWeb does not store complete card numbers.
- Use and security: IP address, browser, device, access dates, sessions, authentication attempts, audit events, diagnostics, and technical logs.
- Communications: messages submitted through contact, support, or email channels.
3. How we use information
We use information to provide and secure the Service; authenticate users; enforce permissions and plans; process subscriptions; provide support; send operational notices; generate requested reports; prevent fraud, abuse, and incidents; maintain backups; meet legal obligations; and improve stability, accessibility, and user experience.
We do not use a church’s member, visitor, prayer-request, or financial records for targeted advertising.
4. Legal basis, instructions, and consent
Each church represents that it has an appropriate legal basis, authorization, or consent to collect and upload information to IglesiaWeb, including sensitive information, donations, prayer requests, and children’s data. The church is responsible for providing required notices to members, visitors, employees, and volunteers and for initially responding to their privacy requests.
5. How we disclose information
We may disclose information only as necessary to:
- the customer church and its authorized users;
- vendors supporting hosting, infrastructure, email, monitoring, backups, support, and security;
- Stripe for payments, billing, and subscription management;
- authorities or third parties when required by law, to protect rights and safety, or during a legitimate business transaction subject to safeguards.
We require vendors to use information only to provide their services. IglesiaWeb does not sell personal information or share it for cross-context behavioral advertising.
6. Cookies and similar technologies
The Service uses cookies and local storage that are strictly necessary for sessions, security, language preferences, and functionality. We may use limited measurement to understand performance and general use. We do not currently use third-party advertising cookies. If this changes, we will update this Policy and provide legally required controls.
7. Retention and deletion
We retain data while an account is active and for a period reasonably necessary to provide the Service, resolve disputes, preserve audit records, meet obligations, and restore backups. When an account is deleted, active data is deleted or deidentified under our procedures unless retention is required. Backups expire on scheduled cycles. Churches should export information they need before termination.
8. Security
We use reasonable administrative, technical, and organizational safeguards, including role controls, available two-factor authentication, encryption in transit, protected passwords, audit logs, access restrictions, backups, and monitoring. No system is completely secure. Customers must protect credentials, grant minimum permissions, and promptly report suspected access.
9. Privacy rights and requests
Depending on jurisdiction, a person may have rights to know, access, correct, port, or delete information; restrict certain uses; withdraw consent; or opt out of sale or sharing. IglesiaWeb does not discriminate for exercising legal rights.
If a church uploaded the information, contact that church first. We will assist the church as required by contract and law. For information directly controlled by IglesiaWeb, email info@iglesiaweb.com. We may verify identity and authority before acting. Authorized agents must provide proof of authorization.
10. Children
IglesiaWeb is intended for churches and authorized adults, not for independent use by children. Persons under 13 may not create accounts or submit information directly. If a church records children’s information, it is responsible for obtaining verifiable parental or guardian authorization when applicable, limiting access, and complying with COPPA and other laws. If we learn that we directly received a child’s information without authorization, we will take reasonable steps to delete it.
11. Transfers and location
The Service primarily targets U.S. organizations. Information may be processed in the United States and other locations where vendors operate. When required, we will use contractual mechanisms and reasonable safeguards for international transfers.
12. Changes and contact
We may update this Policy for legal, technical, or Service changes. We will post the revised date and, for material changes, provide reasonable notice in the Service or by email.
Questions and requests: info@iglesiaweb.com. IglesiaWeb will respond within the time required by applicable law.