Privacy notice

In short

• Using a church app can reveal your faith, so we protect all of it as sensitive data.
• Our pastors and the prayer team for your language read your private prayer requests.
• The app's data is stored in the EU. No selling, no ads, no sharing with Celebration Church in the US.
• An account is optional. In Me › Privacy you can delete it or ask for a copy of your data.

Who we are

CELEBRATION ITALIA APS (Italian tax code 93118700611), the church association that runs this app, is the data controller. It brings together the English and Italian congregations in Caserta, Napoli and online.

We haven't appointed a Data Protection Officer. Our privacy lead answers every privacy question: privacy@celebrationitalia.com

What we collect

• As a guest: a random ID for this device (no name or email), its platform and app version, the services you follow, your language, your notification choices and the push token that delivers them. We keep these on our servers to show you the right content. Forms you send are linked to this ID, so you can follow them in the app.
• With an account: your email, first name (surname optional), how you sign in (Apple, Google or an email code), that you're 14 or older, that you read this notice, when you accepted the Terms and when you agreed that we keep your account. Your settings follow you to every device. So do the sermons you save, your sermon notes and where you stopped watching or listening, so you can continue on another device. Staff can't see these. Forms you sent as a guest from this phone are linked to your account, so you can follow them there.
• When you use a feature: only what you give us, such as a connection card (including any faith decision you share), a visit plan (with your children's ages, if you add them), next steps and My journey, a message to a pastor, a prayer request or prayer wall post, an event registration, a group request, a chat message, a receipt request or a request to show your gifts in the app (the name you give under, and your codice fiscale or the last four characters of your IBAN).
• Usage statistics, only if you turn them on: the screens you use, the app version and the congregation the app is set to, with a random ID, never your name.
• Crash reports, only if you turn them on: technical details when the app stops, with a random ID, never your name or what you wrote.
• Security data: your IP address, a one-way code (hash) made from it to stop spam, and an app integrity check (Apple App Attest or Google Play Integrity) when you send a form.
• From others: Apple or Google, if you sign in with them (your name and email, or Apple's private relay address); your bank, PayPal or Stripe when you give (name, amount, date, reference; Stripe also gives us the email you type when paying by card); a family member who registers you; and notes our team adds when following up with you.

Fields marked optional can stay empty. Without a way to contact you, we can't reply to a form. Some features described here arrive in later updates; this notice already covers them.

Why your data is sensitive

European law (GDPR Art. 9) gives extra protection to data that reveals religious beliefs. In a church app, even simple things can reveal your faith: following a service, having an account, sending a form, signing up for a baptism, giving or asking for prayer. Prayer requests and messages can also reveal your health.

So we treat everything in this app as special-category data:

• we collect only what each feature needs;
• pastors and administrators can see everything; everyone else on the staff sees only what their role needs (most roles: their own language), and every opening is logged;
• notifications and staff email alerts never contain names, prayers or messages;
• we don't give your data to anyone outside the church without your explicit consent, except our providers, who work only for us, the services you choose to use (listed under “Who receives your data”) and where the law requires it.

Why we use it and on what legal basis

GDPR Art. 9(2)(d) allows a not-for-profit body with a religious aim to use data about its members, former members and people in regular contact with it, as long as the data isn't disclosed outside it without consent. If you're not yet a member or regular contact, we ask for your explicit consent when you send a form, register for an event or post publicly, and we keep guest data to a minimum.

• Using the app as a guest and receiving the notifications you choose: our legitimate interest in serving the people who come to the church (Art. 6(1)(f)); Art. 9(2)(d) for members and regular contacts.
• Your account and what it syncs: to provide the account you asked for under the Terms of use (Art. 6(1)(b)) and your explicit consent to keep it (Art. 9(2)(a)), which you withdraw by deleting the account.
• Forms you send (connection card, visit, next steps, talk to a pastor, private prayer), prayer wall posts and group requests: your explicit consent (Art. 9(2)(a)), which you can withdraw at any time.
• Event registrations, including answers such as whether you'll be baptised: to handle the registration you asked for (Art. 6(1)(b)) and your explicit consent (Art. 9(2)(a)), because taking part can reveal your faith.
• Gifts, receipts and accounting records: our legal obligations (Art. 6(1)(c)), with Art. 9(2)(d) for members and regular contacts; receipts you request (Art. 6(1)(b)).
• Matching your gifts to you in our records and linking them to your account for the accounts and receipts: our legitimate interest in keeping accurate accounts and issuing receipts (Art. 6(1)(f)); Art. 9(2)(d) for members and regular contacts. You can object.
• Showing your gifts to you in the app (My giving) after you ask us to: your explicit consent (Art. 9(2)(a)), which you can withdraw at any time in My giving (“Stop showing my gifts”) or in Me › Privacy.
• Pastors and administrators seeing your record and church activity, for pastoral care: our legitimate interest in caring for the people of our church (Art. 6(1)(f)); Art. 9(2)(d) for members and regular contacts. You can object.
• Usage statistics: your consent, which you can withdraw in Me › Privacy.
• Crash reports: your consent, which you can withdraw in Me › Privacy.
• Security, spam protection and the staff activity log: our duty to protect your data (Art. 6(1)(c) and Art. 32) and our legitimate interest in preventing abuse (Art. 6(1)(f)).
• Answering your privacy requests and keeping proof of consent: our legal obligations (Art. 6(1)(c)).

Prayer requests

Private requests. A prayer request can reveal your faith or your health. That's why we ask for your explicit consent on the form itself, separately from your account. It's read by our pastors and the prayer team for your language, to pray for you and, if you asked, to call you back. Administrators can open it too, and every opening is logged. It never appears on the prayer wall, in notifications or in emails to staff, and it isn't kept on your phone after sending. Please don't name other people or share their health details.

If your words suggest you may be in danger, the app shows local help numbers at once and the pastoral lead is alerted. A person always decides what happens next.

Prayer wall. Your post is public to anyone using the app in that language, including guests without an account. It shows your first name, or no name if you post anonymously. A moderator reads it first, may hide other people's names or health details, and tells you why if it's declined. Posts with certain words are held for review automatically. People can tap “I prayed”: you see how many, never who. You can report posts and block people in the app, or report a post by writing to privacy@celebrationitalia.com.

Giving

You can't pay inside the app. You give outside it:

• Bank transfer: the app builds a payment reference from the fund and your name. Your name stays on your phone; we see it later on our bank statement.
• PayPal: opens in your browser. PayPal handles your payment under its own privacy notice.
• Card on our web giving page: Stripe processes the payment. Your card number goes only to Stripe, which also checks for fraud under its own notice.
• SecureGive (USD), in the English app only: this gift goes to Celebration Church in the United States, not to us; SecureGive and that church use your data under their own notices.
• 5x1000: you choose us in your tax return. The app collects nothing.

Our pastors, administrators and the treasury (people with the Donations permission) see who gave and how much. No one else does. We match each gift to a person: card gifts automatically when the name and email given at payment match our record (or with a new record when we have none for that email), otherwise by hand; bank transfers and PayPal from our statements, automatically when the name in the payment matches, otherwise by hand. This lets us prepare receipts and keep the accounts. If you have an account, your gifts can be linked to it. Every opening of a donor record is logged.

My giving. With an account you can see in the app the gifts we have recorded for you, by year, once your donor record is linked to your account. If it isn't yet, you can ask once with “Show my gifts in the app”: you give the name you give under and your codice fiscale or the last four characters of your IBAN, with your explicit consent. Our treasury, pastors and administrators see the request and may contact you, through the contact on your donor record, to check it's you. What you typed is deleted as soon as the treasury decides. You can withdraw the request, and stop showing your gifts at any time in My giving or in Me › Privacy: the link goes at once, and the records of your gifts stay, as the law requires. Opening My giving is never logged.

Receipts. Ask for one in the app. We use your name, email and the gifts it should cover, and send it by email. Traceable gifts to an APS may give a 30% tax credit (art. 83, Third Sector Code).

We keep accounting records, including donor names and amounts, for 10 years, as the law requires.

Who at the church sees what

• Pastors · everything, for the whole church, including private prayer requests and gift amounts
• Administrators · everything pastors see, plus staff, settings and the activity log
• Treasury · donors, amounts and receipts; nothing else
• Prayer team · private prayer requests in their language only
• Prayer wall moderators · prayer wall posts in their language, never private requests
• Connect team · cards, visits, next steps and messages to a pastor in their language
• Group leaders · members and requests of their own group
• Welcome team · on the event day, only name, party size and ticket status
• Translators · only texts, never personal data

Pastors and administrators can open your full record, but never see what you watch. They sign a designation letter and use two-step sign-in, and every opening is logged.

“All” means all of it; the other entries mean only the part named; “—” means no access. Staff never see what you watch, read or listen to.

What we never do

• We never sell your data or use it for advertising or marketing profiles.
• There's no member directory: other users can't look you up.
• Staff can't see what you watch, read or listen to.
• Notifications never contain your name, your prayers or your messages.
• We don't share your data with Celebration Church in the United States. If that ever changes, we'll ask for your explicit consent first, separately.
• No fundraising notifications unless you turn them on.

Who receives your data

In the church: the roles in “Who at the church sees what”. Other users see only what you choose to publish, such as a prayer wall post.

Providers that run the app for us, each under a data processing agreement:

• Supabase: database and sign-in · Frankfurt, Germany
• Cloudflare: web pages (global network); media and encrypted backups stored in the EU
• Google Cloud: runs our nightly backup job · Milan, Italy
• Brevo: emails such as sign-in codes and tickets · EU
• Google Firebase: push notifications and app integrity checks
• Stripe: card gifts on our web giving page
• Deepgram: turns the audio of our sermons into text, in the EU; our team checks every transcript before it is published
• Sentry: crash reports · EU
• PostHog: usage statistics, only if you turn them on · EU
• Our email provider, for messages you send to privacy@celebrationitalia.com

Independent organisations, under their own privacy notices: Apple and Google, if you sign in with them and to deliver push notifications; your bank, PayPal and SecureGive when you give; Spotify for Creators, which hosts our podcast and sees your IP address when you play an episode.

Videos play in YouTube's official player. When you open a video or the live stream, the player loads and Google receives your IP address and device information, even without a Google account. The YouTube Terms of Service and the Google Privacy Policy apply.

Sermon pictures load from YouTube, and some photos of speakers and events from our website celebrationitalia.com, which Squarespace hosts. When the app shows one, your device asks that server for it, so Google or Squarespace receives your IP address and device information. We send them nothing else. The app keeps the pictures on your device, so it doesn't fetch them again.

Outside the EU: Google and Apple may handle push tokens and sign-in data in the US, Cloudflare serves our web pages from its global network, and some providers have US parent companies or support teams. These transfers are covered by the EU-US Data Privacy Framework or the EU standard contractual clauses. Write to us for a copy of these safeguards.

How long we keep it

Your rights

You can ask to see your data, correct it, delete it, limit how we use it, receive it in a portable format or object to its use. You can withdraw any consent at any time; this doesn't affect what we did before.

• In the app: in Me › Privacy you can ask for a copy of your data (ready within one month: we email you, and you download it in the app after signing in), turn usage statistics and crash reports on or off, and delete your account. You can also delete it on our website.
• What deletion covers: your account goes at once. Records of your gifts stay for 10 years because the law requires it, no longer linked to an account. Connection cards and messages you sent to the church team are deleted too if you tick that option; otherwise they're deleted 12 months after the last activity.
• No app? Use the request page on our website or write to privacy@celebrationitalia.com.
• How we answer: we may ask you to confirm who you are. We reply within one month; for complex requests we can extend this by two months and will tell you why.

Your right to object. Where we rely on our legitimate interest, you can object at any time and we'll stop, unless we have compelling reasons to continue.

No decision about you is made by automated means alone. Keyword checks only hold a post for a person to review or show help numbers.

You can also complain to the Garante per la protezione dei dati personali, Italy's data protection authority (garanteprivacy.it).

Children

You need to be 14 or older to create an account or send us a form. Under 14? Keep using the app as a guest. Posting on the prayer wall needs an account, so it's 14+ too.

Parents may give us details about their children, such as their ages when planning a visit, or for Celebration Kids and a child dedication. Event sign-ups for under-14s go through a parent or guardian.

Youth groups and youth chats always have two approved adult leaders, and adults can't send private messages to minors.

How we protect your data

We store the app's data in the EU and encrypt it in transit and in our backups. Every staff member uses two-step sign-in and signs a designation letter before first access. Pastors and administrators can see everything; everyone else sees only what their role needs (most roles: their own language). Every opening or export of a sensitive record is logged. If a data breach puts you at risk, we'll tell you and the Garante as the law requires.

Staff and volunteers get a separate notice about how their own sign-ins and actions are logged.

Changes to this notice

When we change this notice, we update the version and date at the top, before any new feature that uses your data goes live. The English and Italian versions say the same thing. If they ever differ, the Italian version prevails.