Privacy Policy

1. Introduction

Welcome to ChurchNavigator (“we,” “our,” or “us”). We are dedicated to respecting your privacy and protecting the personal data of our visitors, churches, pastors, worship leaders, and community members who use our platform at https://churchnavigator.com.

2. Information We Collect

When you interact with ChurchNavigator, create an account, submit a church listing, or contact a pastor, we may collect the following information:

• Account & Profile Information: When you register via email or third-party OAuth providers (Google), we receive your name, email address, profile photo, and authenticated user ID.
• Ministry & Listing Data: Church names, physical locations, service times, leadership bio, phone numbers, public social media links, and event schedules submitted by administrators.
• Communication & Enquiries: Names, email addresses, phone numbers, and messages sent through the “Send Enquiry” or “Contact Pastor” forms on public listings.
• Technical Data: Browser type, device characteristics, operating system, and anonymized analytics to ensure smooth performance across all devices.

3. How We Use Your Information

We process your data strictly for legitimate operational purposes:

• To provide, maintain, and improve the church directory and event discovery services.
• To authenticate user sessions securely via Supabase and OAuth identity providers.
• To route and deliver contact enquiries and tickets between attendees, visitors, and church organizers.
• To prevent unauthorized access, mitigate fraudulent activities, and maintain platform security.

4. Third-Party Authentication & Google User Data

If you choose to sign in to ChurchNavigator using your Google Account:

• We only request access to basic profile scopes: your email address, full name, and avatar picture.
• We do not access your Google Drive, contacts, calendars, emails, or search history.
• We never sell, rent, or trade your Google user data to advertisers or third parties.
• Google OAuth tokens are handled securely through industry-standard encryption protocols.

5. Data Storage, Security & International Transfers (GDPR Compliance)

All personal and listing data is housed in encrypted, enterprise-grade cloud databases hosted by Supabase with Row-Level Security (RLS) policies and TLS 1.3 in-transit encryption. For users in the European Union (EU) and United Kingdom (UK), all data processing adheres to the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018. Where international data transfers occur, we rely on standard contractual clauses (SCCs) and robust adequacy frameworks.

6. Legal Bases for Processing (GDPR Article 6)

We process personal information under the following recognized legal grounds:

• Consent: When you voluntarily submit contact messages, enquiries, or newsletter subscriptions. You can withdraw your consent at any time.
• Contractual Necessity: To provide account access, authenticate church ownership claims, and maintain church/pastor listings requested by users.
• Legitimate Interests: To protect platform integrity, prevent spam or abuse, maintain security logs, and deliver directory navigation services.
• Legal Obligation: Where required by applicable taxation, corporate recordkeeping, or lawful government orders.

7. Your Rights under GDPR & UK Law

If you reside in the EU, EEA, or UK, you are entitled to exercise the following statutory rights free of charge:

• Right of Access (Article 15): Request a copy of all personal records we hold about you.
• Right to Rectification (Article 16): Correct any inaccurate or outdated information.
• Right to Erasure / “Right to be Forgotten” (Article 17): Request permanent deletion of your profile, registrations, and account credentials.
• Right to Restriction of Processing (Article 18): Restrict processing of your data while disputes or claims are reviewed.
• Right to Data Portability (Article 20): Receive your personal data in a structured, machine-readable (JSON/CSV) format.
• Right to Object (Article 21): Object to any processing based on legitimate interests or direct marketing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with an EU data protection supervisory authority or the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email our Data Protection Team at connect.churchnavigator@gmail.com. We respond to all requests within 30 calendar days as mandated by GDPR.

8. Contact Us & Data Protection Officer (DPO)

If you have any questions or feedback regarding this Privacy Policy, please contact us: