Privacy Policy

1. Identity of the Data Controller

Holy Nation Prophetic Church ("the Church", "we", "us", "our") is the data controller responsible for personal data collected through this website and the Church Hub digital platform. We are a registered Christian religious organisation operating in Uganda, with our principal place of worship and administration at Kyaliwajjala-Naalya Road, Kyaliwajjala, Wakiso, Uganda.

The Church determines the purposes for which, and the manner in which, personal data is processed. All questions, requests, and complaints relating to data privacy should be directed to us at info@holynationprophetic.church.

2. Scope and Application

This Privacy Policy applies to all personal data collected through:

• The Holy Nation Prophetic Church public website (holynationprophetic.church)
• The Church Hub member platform and all its modules
• Sacred Pages (our Scripture application)
• The Youth Section digital platform
• Contact forms, newsletter subscriptions, and other interactive features
• In-person data collection that is subsequently entered into our digital systems

By using any part of the Platform, you acknowledge that you have read and understood this policy. Where your consent is required, we will obtain it explicitly before processing your personal data.

3. Personal Data We Collect

Account registration:

• Full name and email address
• Password — stored exclusively as an Argon2 cryptographic hash; we cannot recover or read it in plain form
• Church role (subscriber, member, worship leader, minister, etc.) as assigned by pastoral leadership

Contact and inquiry forms:

• Name, email address, and telephone number
• The content of messages, prayer requests, and inquiry submissions
• How you came to know about the Church and your areas of spiritual interest

Church Hub activity:

• Giving records — amounts, dates, fund allocations, and receipts. Accessible only to you and authorised pastoral finance staff
• Prayer requests submitted through the prayer wall
• Small group membership, attendance records, and study room participation
• Pastoral care notes written by your assigned pastoral team member
• Announcements you create or respond to within your group

Sacred Pages:

• Reading progress, bookmarks, highlights, annotations, and notes — stored locally in your browser and optionally synced to your account
• Scripture memory card progress and reading plan completion data

Technical and session data:

• Authentication tokens stored in HTTP-only cookies, inaccessible to browser scripts
• IP addresses and request logs maintained by our infrastructure provider (Cloudflare) for security monitoring and abuse prevention
• Browser-stored preferences such as theme settings

We do not collect sensitive categories of personal data beyond what you voluntarily share with us in the context of pastoral care (such as health-related prayer requests). Any such information is treated with strict confidentiality and accessed only by those with a direct pastoral responsibility for you.

4. Legal Basis for Processing

We process your personal data only where a lawful basis exists. The bases we rely upon are:

• Consent: For newsletter subscriptions, optional contact form data, and where you have expressly opted in to a particular use. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Contractual necessity: Processing required to create and maintain your church account, provide access to the Church Hub, and deliver the services you have requested.
• Legitimate interest: Security logging, fraud prevention, and internal administrative purposes that do not override your fundamental rights and freedoms.
• Compliance with a legal obligation: Where we are required by applicable law to retain or disclose certain records.

Where we rely on consent as the basis for processing, we will record that consent and will not use your data for other purposes without seeking fresh consent.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• Creating and managing your church account and authenticating your sessions
• Providing access to the Church Hub, Sacred Pages, and the Youth Section
• Enabling pastoral follow-up, prayer ministry, and care
• Processing and recording tithes and offerings, and generating giving receipts
• Facilitating small group membership, study rooms, and community engagement
• Sending transactional communications (account confirmations, password resets, receipt emails)
• Sending the church newsletter and event updates where you have opted in
• Detecting, investigating, and preventing security incidents and misuse of the Platform
• Improving the Platform's functionality and user experience on an aggregated, non-identifiable basis

We do not use your personal data for advertising, commercial profiling, behavioural tracking, or sale to any third party. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

6. Disclosure and Third-Party Processors

We share your data only in the following circumstances:

Within the Church: Your name, contact details, and ministry interests are accessible to members of our pastoral and administrative team on a need-to-know basis. Giving records are accessible to authorised finance staff. Prayer requests are accessible to the intercessory team. Study room and small group activity is visible to group leaders and youth leaders within the relevant group. Passwords are never accessible to anyone.

Data processors acting on our behalf: We engage the following service providers who process personal data only on our documented instructions:

• Cloudflare, Inc. — Platform hosting, database (D1), key-value store (KV), and security infrastructure. Data is processed subject to Cloudflare's Data Processing Addendum.
• Resend, Inc. — Transactional email delivery. Receives recipient email addresses and message content solely for the purpose of delivery.
• Google (Gemini API) and Groq, Inc. — AI inference for Bible study features. API queries are context-only; they do not include your name, account identifiers, or contact details.

We do not sell, rent, trade, or otherwise transfer your personal data to any other party. Disclosure to government authorities or law enforcement will occur only where we are legally compelled to do so, and we will notify you of any such request to the extent permitted by law.

7. International Data Transfers

Our infrastructure providers (Cloudflare, Resend, Google, Groq) operate servers and processing facilities outside Uganda, including in the United States and the European Union. By using this Platform, you acknowledge that your personal data may be transferred to and processed in those jurisdictions.

We take reasonable steps to ensure that such transfers are made subject to appropriate contractual or legal safeguards, and that our processors maintain standards of data protection comparable to those we apply ourselves. If you have questions about the safeguards in place for your specific data, contact us at info@holynationprophetic.church.

8. Retention of Personal Data

We retain personal data only for as long as it is necessary for the purpose for which it was collected, subject to the following:

• Active accounts: Retained for the duration of your account and for a period of 12 months after your last login, after which dormant accounts are flagged for review
• Giving records: Retained for a minimum of 7 years in accordance with financial record-keeping obligations
• Contact and inquiry records: Retained for 2 years from the date of submission, unless a pastoral relationship continues
• Security and access logs: Retained for 90 days
• Deleted accounts: Core identifying data is removed within 30 days of account deletion; giving records are anonymised and retained in aggregate for financial reporting purposes

You may request early deletion of your data at any time, subject to our legal retention obligations.

9. Your Rights as a Data Subject

You have the following rights with respect to your personal data:

• Right of access: To obtain confirmation of whether we hold personal data about you, and to receive a copy of that data together with supplementary information about how it is processed
• Right to rectification: To require correction of any inaccurate or incomplete personal data. You may update your own information through your account profile, or submit a correction request to us
• Right to erasure: To request deletion of your personal data where there is no overriding legitimate reason for us to continue processing it. We will action erasure requests within 30 days and notify you of the outcome
• Right to restriction: To request that processing of your data be suspended in certain circumstances, for example while an inaccuracy is being corrected
• Right to data portability: To receive a copy of personal data you have provided to us in a structured, commonly used, machine-readable format
• Right to object: To object to processing of your personal data where we rely on legitimate interest as the legal basis. We will cease such processing unless we can demonstrate compelling legitimate grounds
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal

To exercise any of these rights, send a written request to info@holynationprophetic.church with the subject line "Data Subject Request". We will acknowledge receipt within 5 business days and respond substantively within 30 days. For complex requests we may extend this by a further 30 days, with notice to you.

We may require you to verify your identity before processing a data subject request. We will not charge a fee for reasonable requests.

10. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:

• All data in transit is encrypted using HTTPS/TLS
• Passwords are stored exclusively as Argon2id cryptographic hashes — irreversible and unrecoverable
• Authentication sessions are managed via JSON Web Tokens with server-side revocation enforced through Cloudflare KV
• Session cookies are HTTP-only and inaccessible to browser-side JavaScript
• All API endpoints are protected by role-based access controls; no endpoint is accessible beyond its minimum required permission level
• Prayer requests and sensitive pastoral data are subject to additional access restrictions beyond standard member roles
• Infrastructure is hosted on enterprise-grade Cloudflare infrastructure with DDoS protection and edge security controls

No security system is impenetrable. If you have reason to believe your account has been compromised, contact us immediately at info@holynationprophetic.church.

11. Cookies and Browser Storage

We use the following browser-based storage mechanisms:

• HTTP-only authentication cookie: Issued on sign-in to the Church Hub. Contains a signed session token. Inaccessible to JavaScript. Expires after 7 days of inactivity.
• localStorage: Stores user preferences (theme, language), the Church Hub JWT token, and reading progress data. This data does not leave your device unless explicitly synced to your account.
• IndexedDB: Stores Sacred Pages data locally — annotations, scripture memory cards, reading plan progress. No personal identifiers are stored here.

We do not deploy advertising cookies, marketing pixels, cross-site tracking scripts, or third-party analytics services such as Google Analytics. The only external scripts loaded are fonts from Google Fonts (which are subject to Google's own privacy terms).

You may clear browser storage at any time through your browser settings. Clearing localStorage will sign you out of the Church Hub; clearing IndexedDB will remove locally stored Sacred Pages data.

12. Minors and Young Persons

The Kids Section of this Platform is publicly accessible and does not collect any personal data from children. No account, registration, or form submission is required to access Kids Section content.

The Youth Section is designed for young persons aged 13 to 25. Account creation is required and is subject to approval by our youth leadership team. For users under the age of 18, we encourage parental or guardian awareness of their child's account and activity. We will respond promptly to any enquiry from a parent or guardian regarding a minor's personal data.

We do not knowingly collect personal data from children under the age of 13. If we become aware that we have inadvertently collected such data, we will delete it without delay. Parents who believe we may hold data about a child under 13 should contact us at info@holynationprophetic.church.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in risk to your rights and interests, we will notify affected individuals without undue delay and, where required, report to the relevant supervisory authority. Notification will include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address it.

If you discover or suspect a security vulnerability in our Platform, please notify us responsibly at info@holynationprophetic.church before any public disclosure.

14. Changes to This Policy

We may revise this Privacy Policy to reflect changes in our practices, the Platform, or applicable legal requirements. The effective date at the top of this page indicates when the current version took effect. For material changes that affect how we use data you have already provided, we will notify registered users by email and by in-Hub announcement at least 14 days before the change takes effect.

Your continued use of the Platform following the effective date of a revision constitutes acceptance of the updated policy. If you do not accept a material change, you may request deletion of your account.

15. Contact and Complaints

For any privacy-related question, rights request, or complaint, contact us through any of the following:

• Email: info@holynationprophetic.church
• Phone / WhatsApp: +256 701 962 114
• In writing: Holy Nation Prophetic Church, Kyaliwajjala-Naalya Road, Kyaliwajjala, Wakiso, Uganda
• Contact form: holynationprophetic.church/contact

We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in Uganda.

This Privacy Policy is governed by the laws of Uganda. By using this Platform, you submit to the jurisdiction of the courts of Uganda for any dispute arising from or relating to this policy.