Privacy Policy

Last updated: 18 May 2026

Rehoboth.ai (ABN 28 670 625 125) operates the Church.IQ platform, accessible at churchiq.com and church-iq.com ("Church.IQ", "we", "us", "our"). We are committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who We Are

Church.IQ is a Software-as-a-Service (SaaS) church management platform headquartered in Australia. Our registered office is at J8 Level 1, 5-7 Hepher Rd, Campbelltown NSW 2560.

If you have any privacy questions, contact our Privacy Officer at contact@church-iq.com.

2. What Information We Collect

2.1 Organisation Data

Information provided by churches and religious organisations during registration and ongoing use:

• Church name, legal name, trading name
• Charity registration number, ABN/ACN
• Tax-exempt status and financial year
• Organisation contact email, phone, address
• Logo and branding assets
• Timezone and currency preferences

2.2 Member Data

Information about individual church members, entered by authorised church administrators or provided directly by Members through the mobile app:

• Full name, email address, phone number, residential address
• Date of birth, gender, marital status
• Member type (visitor, attender, member) and membership status
• Small group and ministry roster assignments
• Minor status flag (whether a member is under 18)
• Profile photo (if provided)
• Field visibility preferences (which profile fields are shown to other members in the directory)

2.3 Financial and Contribution Data

• Donation amounts, dates, and categories (e.g., tithe, offering, building fund, missions)
• Payment method type (card, cash, direct debit)
• Giving history linked to individual member records

2.4 Account and Authentication Data

• Email address and hashed password
• Google or Facebook OAuth identity tokens (used for sign-in verification only; not stored long-term)
• JWT access and refresh tokens for session management

2.5 AI Query Data

When you use Church.IQ's AI-powered assistant, we process the natural language queries you submit and contextual church data required to answer your query (e.g., member counts, contribution summaries).

AI query data for the mobile app is stateless — conversation history is not retained between sessions. Admin sessions may retain context within a single session only.

2.6 Usage and Technical Data

• IP addresses, browser type, device identifiers
• Pages visited, features accessed, session duration
• Error logs and crash reports

3. How We Collect Information

We collect personal information:

• Directly from you — when you register, complete onboarding, enter member records, or contact us
• From your Members — when Members register through the mobile app or accept a portal invitation
• Via OAuth providers — Google and Facebook, when you choose to sign in using those services
• Automatically — through cookies, server logs, and analytics tools as you use the platform

4. How We Use Your Information

We use personal information to:

• Deliver the service — manage church data, generate reports, process contributions, send communications
• Billing and subscriptions — process payments via Stripe, manage plan changes, issue receipts
• Communications — send user invitations, Member portal invitations, announcements, and optional weekly digests
• AI features — answer natural language queries about your church data
• Security — authenticate users, detect and prevent fraud or abuse
• Legal compliance — meet our obligations under Australian law, including financial record-keeping requirements relevant to registered charities
• Service improvement — analyse usage patterns to improve features (using aggregated or anonymised data where possible)

We do not use your data to train third-party AI models without your consent.

5. How We Share Your Information

We do not sell personal information. We share it only as follows:

Recipient	Purpose	Location
Stripe	Subscription billing and payment processing	USA
Stripe Connect	Church donation collection (if enabled)	USA
Resend	Transactional email delivery	USA
Google (Gemini AI)	Processing AI queries	USA / global
Google OAuth	Sign-in authentication	USA / global
Facebook OAuth	Sign-in authentication	USA / global

Each third-party service is engaged under a data processing agreement or equivalent contractual safeguards. We may also disclose personal information where required by Australian law, to protect safety, or in connection with a merger or acquisition (with notice to you).

6. Data Retention

• Active data is retained for as long as your Organisation account is active
• Account deletion / soft delete: When a Member record is deleted, personally identifiable information (name, email, phone, address, date of birth) is anonymised. Financial contribution records are retained in anonymised form to maintain accounting integrity, as required by Australian Taxation Office (ATO) obligations for charitable organisations
• Organisation account closure: We will retain data for a minimum period of 7 years after account closure to meet legal obligations, after which it is securely deleted
• AI query data: Not retained beyond the active session (mobile) or current session (admin)

7. Your Rights Under the Australian Privacy Principles

Under the Privacy Act 1988 (Cth) and the APPs, you have the right to:

• Access the personal information we hold about you (APP 12)
• Correct personal information that is inaccurate, incomplete, or out of date (APP 13)
• Request deletion of your personal information (subject to legal retention obligations)
• Complain about a breach of the APPs

To exercise these rights, contact our Privacy Officer at contact@church-iq.com. We will respond within 30 days.

If you are in the European Union, you may also have rights under the General Data Protection Regulation (GDPR), including the right to data portability and to lodge a complaint with your supervisory authority.

Deleting Your Church.IQ Account

The deletion process depends on which product you use.

Mobile App (Church.IQ for Android / iOS)

For church members using the Church.IQ mobile app:

If you no longer have access to the app, follow these steps:

1. Send an email to contact@church-iq.com with the subject line Account Deletion Request.
2. Include the email address associated with your Church.IQ account and the name of your church so we can locate your record.
3. We will confirm your identity with your church administrator and process the deletion within 30 days.
4. You will receive a confirmation email once your account and personal data have been deleted.

Admin Portal

For staff and administrators using the Church.IQ admin portal, there are two scenarios:

Admin user (not the last super admin): Go to Settings → Account → Deactivate Account. Your personal account is deactivated and your personal data is deleted. Church data you created (events, rosters, announcements) remains and is reassigned to the organisation.

Last super admin (closing the organisation): If you are the sole super admin and deactivate your account, this permanently deletes the entire organisation and all associated data — including all member records, events, rosters, and financial records. The Stripe subscription is cancelled automatically. This action is irreversible.

The table below details what is deleted and what is retained for mobile app account deletions:

Data type	Action
Email, phone, address, date of birth, gender, marital status	Set to null immediately — no longer stored
Full name	Replaced with "Former Member" immediately
Profile photo	Removed immediately
Password and password reset tokens	Removed immediately
Device tokens (push notifications)	Permanently deleted immediately
Portal access	Revoked immediately
Ministry roster and event assignments	Retained and linked to the anonymised "Former Member" record for church scheduling integrity
Giving / donation records	Retained and linked to the anonymised "Former Member" record to meet Australian Taxation Office (ATO) obligations for registered charities

8. Security

We implement industry-standard security measures, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Hashed password storage (bcrypt)
• JWT-based authentication with token expiry
• Role-based access controls limiting data access to authorised administrators
• Regular security reviews

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at contact@church-iq.com.

9. Cookies and Tracking

Church.IQ uses cookies and similar technologies to maintain user sessions, remember preferences, and gather analytics. You can control cookies through your browser settings, though disabling them may affect platform functionality. We do not engage in cross-site tracking for advertising purposes.

10. Children's Privacy

Church.IQ is designed for use by adult administrators of religious organisations. We recognise that churches maintain records for members under 18 years of age, which are flagged in the system using a minor status indicator.

Church administrators are responsible for ensuring they have appropriate consent and legal authority to collect and store data about minors within their congregation, in accordance with applicable Australian law.

Church.IQ does not directly market to or knowingly collect personal information from children under 13 without verifiable parental consent.

11. International Data Transfers

Some of our third-party service providers process data outside Australia (principally in the United States). When we transfer personal information internationally, we take reasonable steps to ensure it receives comparable privacy protections to those required under the APPs, including through contractual safeguards.

12. Contact and Complaints

Rehoboth.ai
J8 Level 1, 5-7 Hepher Rd, Campbelltown NSW 2560
Email: contact@church-iq.com

If you are not satisfied with our response to a privacy complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on the platform. The "Last updated" date at the top of this document reflects the most recent revision. Continued use of Church.IQ after changes constitutes acceptance of the updated policy.