＋Submit a Church

Privacy policy

Last updated: 21 October 2026

This policy explains which personal data ChurchedIn processes, why, and what your rights are.

1. Who is responsible

David Verleysen, Moorsledestraat 131, 1020 Brussels, Belgium, company number 0736.831.794 ("ChurchedIn", "we") is the controller of the personal data described below. Questions about privacy: hello@churchedin.com.

2. What we process, why, and on what basis

Visiting the website

  • Technical data (IP address, browser type, pages requested, date and time) is processed by our hosting provider to deliver the website and keep it secure. Basis: legitimate interest (running a secure website).
  • Your location ("Nearest to me"): only if you allow it in your browser. Distances are calculated on your own device; your location is never sent to us or stored.
  • Maps: map images are loaded from OpenStreetMap's servers (OpenStreetMap Foundation, United Kingdom), which receive your IP address to deliver them. No cookies are used for this.
  • Climate badge: the "Climate Action" badge at the bottom of our pages is shown by Tree Nation, the organisation through which we offset the carbon footprint of this website. Your browser loads it from Tree Nation's servers, which therefore receive your IP address. It sets no cookies and stores nothing in your browser.
  • Fonts are served from our own website; no data is sent to Google for them.
  • Visit statistics without cookies: our hosting provider Vercel counts page visits for us (pages viewed, the website you came from, country, device and browser type). It uses no cookies and builds no profile of you: visitors are recognised for at most one day through a temporary code that cannot be traced back to you, and we only ever see totals. Basis: legitimate interest (understanding how the website is used, to improve it).
  • Page counters for churches and organisations: every time a church or organisation page, church website or event page is opened, or one of its buttons (website, directions, phone, email, give) is used, one anonymous counter per page, day and kind goes up by one in our database, so that the church or organisation can see how often its page is used. We store no cookies, no IP address, no device or visitor identity and nothing in your browser; robots are not counted and neither are visitors who send "Do not track". We only ever see totals. Basis: legitimate interest (giving churches an idea of how their page is used).

Statistics and marketing (only with your consent)

If you accept analytics cookies, we use Google Analytics (Google Ireland Ltd / Google LLC) to understand how the website is used. If we later measure advertising, this will only happen if you accept marketing cookies. We do not use this information to identify you or to build profiles of your beliefs. Google Analytics does not store full IP addresses. Data is kept for 14 months. Basis: consent (you can withdraw it at any time via "Cookie settings" at the bottom of every page). Details: see our cookie policy.

Forms

  • "Submit a church": the church details you provide and, if you give it, your email address, so we can contact you about your submission. Basis: legitimate interest (keeping the directory complete and accurate). Kept until the submission has been handled and for no longer than 12 months thereafter.
  • "Suggest a correction": your message and, optionally, your email address. Basis: legitimate interest. Kept until the suggestion has been handled and for no longer than 12 months thereafter.
  • Contact form: your name (optional), email address, church name (optional) and message, so we can answer you. Basis: legitimate interest (answering your question). Kept for as long as needed to answer and follow up, and for no longer than 12 months thereafter.
  • Emails you send us: kept as long as needed to answer and follow up.

When you send one of these forms, we receive an email notification with its content. These notifications are sent to ChurchedIn's own email inbox and are not shared with other churches or third parties.

Please do not include sensitive information about yourself or others in these forms.

Messages to a church or organisation

When a church or organisation switches on the contact form on its page, you can write to it from that page. We pass your name, email address and message by email to that church or organisation (to its public address or to the people who manage its page) so that it can reply to you. Its address is never shown to you or to others. ChurchedIn does not keep your message: we only keep a counter of how many messages a page received (no names, addresses or contents) to limit abuse. Basis: your consent (the box you tick before sending). Our email provider (Resend, see section 3) sends the email on our behalf. After that, the church or organisation is responsible for what it does with your message. Please do not include sensitive information about yourself or others.

Logging in

If you have an account on ChurchedIn (administrators and church representatives), we process your email address to send you login links, and keep a login cookie in your browser. We also remember the language you chose for the login screens. Basis: performance of a contract and legitimate interest in securing access to the platform. Kept as long as your account exists.

Managing a church page

If you ask to manage a church's page, we process your name, role in the church, email address, and optionally your phone number and message, to check that you represent the church and to give you access. When you edit the page, we receive an email notification listing what was changed and by whom; these notifications are sent to ChurchedIn's own email inbox and are not shared with other churches or third parties. Photos you upload are stored with our database provider and shown publicly on the church's page. By uploading a photo, you confirm that you have the right to publish it and that any identifiable people shown have agreed to its publication, where required. Basis: performance of our agreement with you / legitimate interest (keeping the directory accurate and preventing abuse). Kept as long as you have access, then at most 12 months.

Subscribing to a paid plan

If you subscribe to a paid plan, our payment partner Stripe collects your payment details (card or bank details, which we never see or store) and the church's billing details. We receive the church's name, billing address, VAT number (if any), email address, the plan chosen and the payment status. We use them to activate the plan, send receipts, warn you about payment problems, issue invoices on request and keep our accounts. Basis: performance of a contract and legal obligation (accounting). Billing and accounting records are kept for 7 years, as the law requires.

Registering for an event

When you register for an event, we process your name, email address and the number of people coming with you (and, only for events that ask for it, the names of the people coming with you; by registering them you confirm they agree), to keep your place (or your place on the waiting list), send you a confirmation, a reminder the day before and a link to cancel, and give the organising church a list of who is coming. Because registering for a church event can reveal your religious beliefs, we process this information only with your explicit consent. You give this consent by actively ticking a separate consent box on the registration form. The box is not pre-ticked, and registration is only possible if you give this consent. Basis: explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). You can withdraw it at any time by cancelling your registration (link in the confirmation email) or by writing to us.

The organising church may also add its own questions to the registration form (for example about allergies, or whether you attend the church). Answering them is part of your registration, the answers can be sensitive (health, religious beliefs) and are covered by the same explicit consent, and they are only visible to the organising church. The church decides which questions it asks and is responsible for asking only what it needs; ChurchedIn only stores the answers for the church. The answers are deleted together with the registration, 30 days after the event.

Your registration is shared with the organising church (its representatives on ChurchedIn), who may use it only for this event. We never use it for anything else and never publish it; visitors only see how many places are left. Registrations are deleted automatically 30 days after the event. We do not use registrations for marketing or profiling.

Newsletters

If you subscribe to our events newsletter or to our news for church leaders, we process your email address, your language and, for the events newsletter, the city you choose (optional), to send you the newsletter you asked for. You subscribe in two steps: you confirm by clicking a link in an email, and every newsletter has an unsubscribe link. Because an events newsletter can show your interest in church events, we only do this with your explicit consent, which you give by ticking a separate consent box on the form (not pre-ticked). Basis: explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). You can withdraw it at any time by unsubscribing or by writing to us. We keep your data until you unsubscribe or ask us to erase it; after you unsubscribe we keep the address only so that we don't write to you again. We do not use your subscription for profiling, and we do not share it with churches or other third parties.

Church listings

Listings describe churches (organisations). They are compiled from information the church published itself, information sent to us, and public sources such as OpenStreetMap. Listings may contain the church's public contact details and, occasionally, the name of a person in a public role (for example a pastor). Basis: legitimate interest (offering a public directory of churches). Anyone concerned can ask us to correct or remove information (see section 5). We do not use listing information to create profiles of individuals or to infer anyone's religious beliefs.

3. Who receives data

We use these service providers ("processors"), bound by data processing agreements:

  • Vercel Inc. (United States) — hosting.
  • Supabase Pte. Ltd. (Singapore; database and file storage hosted in an EU region, Ireland) — stores listings, submissions, suggestions, contact messages, login accounts, access requests, event registrations and uploaded photos. Transfers where necessary are covered by Standard Contractual Clauses.
  • Stripe (Stripe Payments Europe, Ltd., Ireland; Stripe, Inc., United States) — processes payments for paid plans.
  • Resend (United States) — sends login links, registration confirmations, newsletters and email notifications.
  • Google (Ireland / United States) — Analytics, only with your consent.

The church organising an event receives the registrations for that event (see above). OpenStreetMap Foundation (United Kingdom) receives IP addresses when maps are shown, and Tree Nation when the climate badge is shown. We never sell personal data.

4. Transfers outside the European Union

Vercel and Resend may process personal data in the United States. Both are certified under the EU-US Data Privacy Framework; transfers are also covered by the European Commission's Standard Contractual Clauses where applicable.

Stripe (payments) and Google (Analytics, only with your consent) may also process data in the United States, on the same basis: the EU-US Data Privacy Framework where the provider is certified, and Standard Contractual Clauses.

Supabase may involve entities outside the EU for support and operational purposes. Where personal data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses and appropriate supplementary safeguards.

The United Kingdom benefits from an EU adequacy decision.

5. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing (including processing based on legitimate interest), to data portability, and to withdraw consent at any time. Write to hello@churchedin.com; we answer within one month. To protect your data, we may ask you to confirm your identity before responding to a request. You will not be subject to decisions based solely on automated processing that produce legal or similarly significant effects for you.

You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.

6. Children

ChurchedIn is not intended for children under 16. We do not knowingly collect personal data from children without parental consent. If you believe a child has provided us with personal data, contact us at hello@churchedin.com.

7. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encrypted connections (HTTPS), access controls, limited access to personal data, and the use of established hosting, database and email providers.

8. Changes

We update this policy when the website changes (for example when accounts, subscriptions or event registrations are introduced). The date at the top shows the latest version.