Privacy Policy

Missionary Lane helps churches show the missionaries they support: their letters, photos, prayer requests and places, and, if a church turns it on, where its givers' missions gifts went. Some of this information is about people whose safety depends on it staying private, and some of it is about children. This policy explains what personal information the hosted Missionary Lane service handles, who decides what happens to it, where it goes and how long it is kept.

Missionary Lane is operated by [COMPANY LEGAL NAME], [ADDRESS] ("Missionary Lane", "we", "us"). Contact us at richard@missionarylane.org.

1. Scope #

This policy covers the hosted service: missionarylane.org and its documentation, church galleries at *.missionarylane.org and churches' custom domains, the admin at app.missionarylane.org, My missions, the REST API and MCP server, our feedback form, self-hosting requests and the desktop app's license checks.

It does not cover:

1. 1.1 Self-hosted galleries. A church that self-hosts runs Missionary Lane on its own accounts. We receive only its license checks (section 3.9). The church's own privacy notice applies to everything else.
2. 1.2 Services a church connects. A church's giving platform, its own AI or voice provider, its map provider and its website each have their own privacy terms.
3. 1.3 A church's own use of information. Each church decides what it publishes and how it uses its givers' information. Ask your church for its privacy notice.

2. Two roles: the church decides about its content #

If your question is about information a church holds about you (for example, you are a missionary, a family member or a giver), contact that church first. It decides what is published and kept. If you contact us instead, we will pass your request to the church within [5] business days and help it respond, unless the law requires otherwise (section 15.5).

3. What we collect, by who you are #

3.1 Visitors to missionarylane.org, our docs and church galleries #

1. 3.1.1 Request data. When your browser loads a page, our hosting providers (Vercel and Supabase) receive your IP address, browser user agent, the address requested, the referring page (limited by our referrer policy) and the time. They keep request logs for operating and securing the service, for the periods in section 10.
2. 3.1.2 Visit counts. A gallery records one visit when it loads, when a kiosk opens, and when a tour or building venue view starts. We store only a count per church, per day and per kind of visit. To apply a per-visitor daily limit, the database also stores a keyed one-way hash (HMAC-SHA256, with a secret key) of your IP address combined with the church and the day, with a count. These hashes are deleted after about two days and the daily counts after about 70 days. Visit counts are used for billing a church's hosting usage and for abuse protection, not to profile you.
3. 3.1.3 No advertising or analytics trackers. We do not use advertising cookies, cross-site tracking, or third-party analytics on our pages or galleries.
4. 3.1.4 Browser storage. Some settings are remembered in your browser (section 9).
5. 3.1.5 Third-party content your browser loads. Our pages load their scripts, fonts and flags from our own servers. Map tiles, a church's optional 3D map view, videos (only after you press play) and some 360° field views come from other providers, which receive your IP address (section 8.5). Fonts we do not host are fetched by our servers instead (section 8.3).

3.2 Church staff (owners, admins, editors and Finance members) #

1. 3.2.1 Account: email address; password, which Supabase Auth stores only as a salted hash; your authenticator-app factor for two-step sign-in; sign-in sessions; and authentication logs that include IP address and user agent.
2. 3.2.2 Membership: the churches you belong to, your role, whether you have Finance, and pending invitations (email, role and who invited you).
3. 3.2.3 Activity records: who created certain records (API keys, giving imports, payment documents and payments), and audit-log entries for sensitive actions such as changing Finance access, creating or revoking API keys, operator actions and writes made with API keys.
4. 3.2.4 Billing contact: the first owner's email address is sent to Stripe as the billing contact (section 3.6).
5. 3.2.5 Acceptance records: when you accept the Terms and the DPA for your church (at sign-up, or when a new version needs an owner's acceptance), we record your name and role as you typed them, your account and email, the church, the version and SHA-256 fingerprint of each text (and of the Privacy Policy you were shown), the time, your IP address and user agent. When you first open a church you were invited to, we record that you saw the notice about the Terms. When you create an API key, we record your acceptance of the API terms with the key's ID.

3.3 Missionaries and their families (held for the church) #

Churches enter or upload, or the AI reads from letters for staff to approve:

1. 3.3.1 Profile: names (display name, first, last and spouse names, household members), tagline, place, country, region, map coordinates, time zone, ministry focus, status and status note, mission board, sending church, support address, contact details (email, phone, website, social link, mailing address), portrait and logo, biography.
2. 3.3.2 Support details, private by default: monthly support amount, payment day and frequency, dates support began and ended, last visit, staff notes.
3. 3.3.3 Letters: page images and PDFs, the text read from them, title, summary, highlights, prayer requests, praises and verse.
4. 3.3.4 Media: photos, videos and captions; 360° field views and their credits; narration recordings.
5. 3.3.5 Family members: name, relationship (missionary, spouse, child, other), birthday and whether the year is known, notes, and switches for whether the person and the birthday are public and whether the birthday is announced.
6. 3.3.6 Important dates and announcements.
7. 3.3.7 Place briefings: country facts, the U.S. travel advisory level for the country, and recent news headlines for the place, chosen and summarized by AI.
8. 3.3.8 Visibility and restriction settings: whether the missionary is Draft, Public, Limited (restricted) or Hidden, per-field switches, and a restricted missionary's alias.
9. 3.3.9 Payee records for payments: names under which the church pays the missionary (such as a mission board) and account references.

This information may reveal religious affiliation, and prayer requests can contain health or family information. The church decides what is published. What the public gallery shows, and what it never shows for restricted missionaries, is described in our security documentation and in section 11.

3.4 Givers #

If a church turns on Giving & My missions:

1. 3.4.1 From the church's giving platform or files: giver name, email address and the platform's person ID; each gift's amount, date (or month for undated totals), fund and refund status; funds and their missions share; pledges (year, amount, kind and agency).
2. 3.4.2 Computed for the church: how each gift is allocated to the church's payments to missionaries ("gift traces").
3. 3.4.3 When you sign in to My missions: your email address, a one-time sign-in link, your session, and the link between your account and the church's giver record. You are matched by your confirmed email address, or by the church's treasurer. The first time you open My missions at a church under a version of the Terms for givers, we record that you accepted them and confirmed your age: the version and fingerprint of the text, the time, your IP address and user agent.

Your giving records are visible only to you and to the church's owners and Finance members. Your gifts are never sent to an AI provider.

3.5 People named in payment documents #

When a treasurer uploads or emails a bank statement, cheque register or remittance, the document and the payment lines read from it (payee, amount, date, reference, memo) are stored privately for the church. Such documents can contain other transactions and account numbers. Churches are asked to remove unrelated pages and account numbers where they can.

3.6 Billing #

Payments are handled by Stripe. We send Stripe the church's name, its web address name, our internal church ID and the owner's email address, and Stripe collects payment details on its own pages. We never see or store full card numbers. We store Stripe customer, subscription and invoice-item IDs, the plan and status, add-ons, credits, usage records with their vendor cost, and monthly statements.

3.7 API and MCP users #

For each API key we store its name, the first 8 characters, a keyed one-way hash (HMAC-SHA256) of the key, its scopes, who created it, and when it was created, last used and revoked. The full key is shown once and never stored. Each request is counted in a per-key, per-minute window, deleted after about an hour. Writes made with a key are recorded in the audit log with the key's ID, prefix and name.

3.8 Feedback senders #

Anyone may send feedback. We store the kind of message, the message, the page address, which app it came from, the app version, your browser user agent and the time. If you are signed in we also store your account ID and email, the church you named if you belong to it, and any screenshot you attach (in a private store only our operators can read). If you are not signed in we store the email address you give, if any, the church you name, and a keyed one-way hash (HMAC-SHA256, with a secret key) of your IP address, used to limit how many messages one sender can send. Our operators add a status, priority and internal notes.

3.9 Self-hosting applicants and licensees #

When you request self-hosting we store: your account email; your name and role; your church's name, city, website and congregation size; your reason; the license version and the SHA-256 fingerprint of its text; your typed signature; the time; and your IP address and browser user agent. We store our decision and any note. If approved, the license key is stored encrypted, with a hash for lookups. Each time the desktop app checks the license we record the time and the app version.

3.10 People who email us #

If you email us, we keep your message and contact details to answer you.

3.11 The missionary directory and the missionary portal #

Missionary Lane keeps one central record for each missionary family whose church adds them, so that a letter one supporting church shares reaches the other churches that support the same family (how it works). We decide what the directory holds and how it is shared, so we are its controller.

1. 3.11.1 What a record holds: the family's display name, place, country and region; the email addresses and family names churches entered for them (used only to recognise the same family); the letters churches published through it (pages or PDF, title, date, summary, highlights, prayer requests, praises, verse and letter text); and what the missionary posts in the portal (letters, photos, videos, prayer requests, praises, announcements and needs, each marked Public or Hidden). It never holds support amounts, payment details, staff notes, family records, giving or anything else from a church's admin.
2. 3.11.2 Never in the directory: missionaries a church shows as Limited or Hidden, missionaries of a church that has left the directory, and kiosks a church took out of it.
3. 3.11.3 Who sees it: a church's staff see a record only when the platform suggests it as a match for one of their kiosks (its name, place and how many churches share it) or after they confirm the match. Linked churches' galleries show Public items according to each church's own settings. Hidden items are seen only by linked churches' staff and by the missionary. Other churches, visitors and the public never see a record itself.
4. 3.11.4 Portal accounts: email address, password (stored by our sign-in provider) and two-step sign-in factor, as for church staff. A missionary becomes the owner of their record by signing in with an email address a church has on their kiosk.
5. 3.11.5 Why we may do this: our legitimate interest, and the churches', in getting each missionary's letters to the churches that already support them, without each church uploading them again. Letters are written by missionaries to be read by their supporting churches; the directory shares them only with churches whose staff have confirmed they support that family. For families serving in the EU/EEA, the UK or Switzerland, we rely on the missionary's explicit consent (GDPR and UK GDPR Art. 6(1)(a) and 9(2)(a); the Swiss FADP): we never start a record for them from a church's upload, and nothing is shared until the missionary consents in the portal. We record when and to which wording they consented. They can withdraw at any time in the portal, and sharing stops at once; withdrawal does not affect what was shared before.
6. 3.11.6 Your choices: a missionary can see which churches are linked, pause or remove any of them, and take their whole record out of the directory, in the portal, or by writing to us. A church can leave for one kiosk or for all of them. Leaving withdraws what was shared through the directory from the other churches; each church keeps the letters it uploaded itself.
7. 3.11.7 AI: a letter a missionary uploads in the portal is read once by the AI provider we use for the platform (section 7.2), under the same rules as church letters.

4. Where information comes from #

1. 4.1 From you, when you use the service or contact us.
2. 4.2 From your church, which enters or uploads missionary, family and giving information, or connects its giving platform; and, through the missionary directory, from other churches that support the same missionary (section 3.11).
3. 4.3 From services a church connects, on the church's instructions: gifts and donors read from Planning Center, Breeze, Rock RMS, MinistryPlatform or Pushpay; pages and images from the church's own website when importing its look.
4. 4.4 From public sources we query to prepare place briefings: news search results, U.S. State Department travel advisories and country facts.
5. 4.5 Generated by the service: AI-written summaries, kiosk designs, narration and briefings; gift allocations; usage and visit counts; security logs.

5. How we use information #

We do not sell personal information, use it for targeted advertising, or use church content or giver records to train AI models. We do not make decisions about anyone that produce legal or similarly significant effects based solely on automated processing.

6. Sensitive information #

Missionary and giving information can reveal a person's religious beliefs, and prayer requests can contain health information. Under the GDPR and UK GDPR these are special categories of data (Art. 9). Many US state privacy laws treat religious beliefs and children's data as sensitive.

1. 6.1 Each church, as controller, must have a lawful condition to process them. For a church this is often processing by a not-for-profit body with a religious aim, about its members and people in regular contact with it, with appropriate safeguards (GDPR Art. 9(2)(d)), or explicit consent. Publishing beyond the church generally needs the person's consent.
2. 6.2 We process such information only for the church and only to provide the service, and we protect it with the measures in section 11.
3. 6.3 We do not ask for, and churches must not enter, government ID numbers, full payment card numbers or bank login credentials.

7. AI processing #

Missionary Lane uses AI models to read letters, design kiosks and write narration, prepare place briefings and read payment documents, and voice services to record narration. Each church chooses either its own provider account (its own keys) or Missionary Lane credits (our account with a provider we choose).

7.1 What is sent #

AI-written text is checked by church staff: prayer requests and praises are approved before they appear, and payment lines are saved only when a treasurer applies them. In the gallery, narration is labelled "AI voice", and letter summaries and prayer requests the AI read from a letter are marked "AI-assisted summary, reviewed by the church".

7.2 Which providers, and whether they train on the data #

When a church uses its own keys, the church's agreement with its provider governs the data we send on the church's behalf. When it uses Missionary Lane credits, we send it to [PLATFORM AI PROVIDER, currently configured: Anthropic] and [PLATFORM VOICE PROVIDER, currently configured: ElevenLabs] under our agreements with them.

What each supported provider's published terms say, as checked on 2026-10-31 (providers change their terms; churches using their own keys should check their own account and plan):

For churches using their own keys: use a paid plan, and turn off any setting that lets the provider use your content for training. With Gemini, use a paid (billing-enabled) project. With Amazon Polly, apply AWS's AI services opt-out. With OpenRouter, disable providers that train on data. With ElevenLabs, turn off "Improve the models for everyone". The admin shows this guidance next to each of these providers.

8. Who we share information with #

We share personal information only with the service providers below, with services a church directs us to use, as the law requires, or with your consent. We do not sell personal information or share it for cross-context behavioral advertising.

8.1 Our sub-processors #

The current list will be kept at [SUB-PROCESSOR LIST URL, e.g. missionarylane.org/dpa#annex-3]. We will give churches at least [30] days' notice before adding a sub-processor, as set out in our DPA.

8.2 Services a church chooses #

When a church connects a service, we send it what is needed on the church's instructions, under the church's agreement with that provider:

1. 8.2.1 AI providers with the church's own keys: Anthropic, OpenAI, Azure OpenAI, Google Gemini, OpenRouter (and the provider it routes to) or an OpenAI-compatible service. Data as in section 7.1.
2. 8.2.2 Voice providers with the church's own keys: ElevenLabs, OpenAI, Google Cloud Text-to-Speech, Azure AI Speech, Amazon Polly or an OpenAI-compatible service. Narration scripts.
3. 8.2.3 Giving platforms: Planning Center, Breeze, Rock RMS, MinistryPlatform, Pushpay. We send the church's credentials and read requests; we never write to them.
4. 8.2.4 Map providers: the church's CARTO and Google Maps keys are served to visitors' browsers (section 8.5).
5. 8.2.5 The church's website, when importing its look.

8.3 Public sources we query #

To prepare place briefings, our servers request: Google News search results for the missionary's recorded place and country (the search contains the place name, not people's names); the U.S. State Department's travel advisory feed; and REST Countries for country facts. These requests come from our servers, not from visitors.

So that browsers do not contact them, our servers also request:

1. 8.3.1 Google Fonts, for a font a church chose that we do not host ourselves. We fetch the font once, keep it in private storage and serve it from our own address. The request contains only the font's name and style.
2. 8.3.2 Google Maps Platform (Geocoding and Time Zone), when church staff search for a missionary's place in the admin. The request contains the place typed and, for the chosen result, its map position.

8.4 Planned providers (not yet in use) #

Streaming for uploaded video ([VIDEO PROVIDER, planned: Cloudflare Stream]), video transcription and GPU processing for 3D scans. We will update this policy and the sub-processor list before using them.

8.5 Providers your browser contacts directly #

These providers receive your IP address and standard request data when your browser loads content from them. They are not given account information by us. Everything else our pages need, including their code libraries, fonts and flags, is served from our own servers.

8.6 Other disclosures #

We may disclose information if required by law or a valid legal order; to protect the safety of a person, including a missionary; to investigate fraud or security incidents; or as part of a merger, acquisition or sale of assets, subject to this policy. Where the law allows, we will tell the affected church before disclosing its content. [OPTIONAL COMMITMENT: we will challenge requests that seek restricted missionaries' identities unless legally compelled.]

9. Cookies and browser storage #

Our pages set no cookies of their own. The service uses your browser's local storage for the following:

These are strictly necessary for the service or remember choices you made. Embedded content from the providers in section 8.5, such as a video after you press play, may set its own cookies under those providers' policies.

10. How long we keep information #

The periods marked "deleted automatically" are settings of the service, and the deletions run every day. We may keep information longer where the law requires it, or to resolve a dispute or security incident.

11. How we protect information #

1. 11.1 Each church's data is kept apart. Database row-level security decides what each request may read or change, so one church's members cannot see another church's data. Records that belong to a missionary are forced to the same church, and a record's church can never change. Server functions check membership before acting and limit every query to that church.
2. 11.2 Two-step sign-in for staff. Every staff action requires a session that has completed password and authenticator-code sign-in. Supabase's leaked-password protection is turned on. [CONFIRM IN THE SUPABASE DASHBOARD.]
3. 11.3 Least access to giving. Only owners and Finance members, signed in with two-step sign-in, can read giving records. A giver can read only their own. Editors and admins without Finance see nothing about giving.
4. 11.4 Restricted missionaries. For a Limited missionary, the database functions that serve the public gallery, the API and the MCP server leave out the real name, exact place, photos, portrait, letter text and pages, family, dates, contact and support details and place briefing. Their public address is an opaque code, their map position is rounded to whole degrees, and API giving results are masked to their alias. AI writes their public text under rules that forbid names and places, and earlier AI text and recordings are withdrawn when a missionary becomes Limited. Their uploaded files are never served to visitors, except narration recorded from text written under those rules.
5. 11.5 Secrets. AI, voice, map and giving-platform keys are stored encrypted in Supabase Vault, are write-only from the admin and are read only by server functions. API keys are stored only as a keyed hash.
6. 11.6 Private stores. Payment documents, feedback screenshots and software downloads are in private storage. Download links expire after an hour.
7. 11.7 Files are kept in private storage. A visitor's browser can load a file only while the public gallery shows it, through a link that expires after one hour; any other file cannot be opened by visitors, even with its exact address. A file the church withdraws stops loading for new visitors at once, and a link already given out stops working within an hour. Church staff open their own church's files through links that also expire. Photos are re-saved in the browser before upload, which removes the location and camera details phones store in them.
8. 11.8 Defensive network rules. Church-supplied addresses (such as a Rock RMS server or an OpenAI-compatible endpoint) must use https and cannot point to private networks. Giving connectors send read requests only, refuse redirects and remove credentials from error messages. Stripe webhooks and emailed documents are accepted only with valid signatures. Browser pages send security headers, and the admin cannot be framed.
9. 11.9 Rate limits and audit logs. API keys, feedback and visit counting are rate-limited. Operator actions, Finance changes, API key changes and API writes are logged.
10. 11.10 Encryption in transit. Our pages, API and connections to our providers use HTTPS.

No system is perfectly secure. Report concerns to richard@missionarylane.org.

12. If there is a breach #

If a security incident affects personal information we hold for a church, we will tell that church without undue delay, and in any event within [48] hours of confirming it, with what we know and what we are doing, so that it can meet its own duties. Where we are the controller, we will notify the authorities and affected people as the law requires, including, where the GDPR applies, the supervisory authority within 72 hours where required. If an incident could put a missionary's safety at risk, we will contact the church immediately by every available means.

13. Children #

1. 13.1 Not directed to children. The service is for churches and adults. Staff accounts are for people 18 and over. My missions is for givers aged [13] and over. We do not knowingly collect personal information online directly from children under 13. If you believe a child under 13 has given us personal information, contact richard@missionarylane.org and we will delete it.
2. 13.2 Information churches add about missionaries' children. Churches may add missionaries' children as family members, with names and birthdays. This information is provided by the church, not by the children, and the church must have a parent's or guardian's permission (Terms section 7). It is protected as follows:
   1. (1) Family members, and their birthdays, are private by default. They appear in a gallery only when staff switch them on.
   2. (2) A public birthday is shown as a month and day only, never the year.
   3. (3) A restricted missionary's family never appears publicly, in the gallery, the API or the MCP server.
   4. (4) Family details are not sent to AI providers to design kiosks.
   5. (5) A parent can ask the church, or us, to hide or remove a child's information (section 15.5).

14. International transfers #

We are based in the United States, and our main providers store and process data in the United States [AND SUPABASE REGION]. Churches and missionaries may be anywhere in the world. Where we transfer personal information from the EEA, the UK or Switzerland, we rely on our providers' certifications under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where they have them, and otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum). Our DPA includes the clauses for churches that need them. Information a church publishes in its gallery can be viewed from anywhere.

15. Your rights #

15.1 Everyone #

You can ask us what personal information we hold about you as a controller, and ask us to correct or delete it. Email richard@missionarylane.org. We will verify your request, usually by confirming control of your account email, and answer within the time the law sets, or within 45 days if no law applies. We will not treat you differently for exercising your rights.

15.2 EEA, UK and Switzerland #

Where the GDPR, the UK GDPR or the Swiss FADP applies, you have the right to access, rectify and erase your personal information, to restrict or object to processing, to data portability, to withdraw consent at any time where we rely on it, and to complain to your data protection authority. You may object at any time to processing based on our legitimate interests. [EU REPRESENTATIVE (GDPR Art. 27): NAME AND ADDRESS, OR STATEMENT THAT ONE IS NOT REQUIRED.] [UK REPRESENTATIVE: NAME AND ADDRESS, OR STATEMENT.]

15.3 California #

Where the California Consumer Privacy Act applies, California residents have the right to know what personal information is collected, used and disclosed; to delete it; to correct it; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. In the last 12 months we have collected the categories described in section 3 (identifiers, internet activity, commercial information such as billing records, and, for churches' content, information that may reveal religious beliefs, health or children's information) for the purposes in section 5, and disclosed them to the service providers in section 8. We do not sell or share personal information, and we use sensitive personal information only to provide the service. You may use an authorized agent; we will ask for proof of authorization.

15.4 Virginia and other US states #

Where the Virginia Consumer Data Protection Act or a similar state law applies, residents have the right to confirm whether we process their personal data, to access, correct and delete it, to obtain a portable copy, and to opt out of targeted advertising, sale and profiling (which we do not do). If we decline a request, you may appeal by replying to our decision or emailing richard@missionarylane.org with "Appeal" in the subject. We will answer within 60 days. If you are not satisfied, Virginia residents may contact the Virginia Attorney General.

15.5 Information a church holds about you #

For missionaries, family members and givers, the church is the controller, except for the missionary directory, where we are (section 3.11): missionaries can manage their record in the portal or ask us directly. Make your request to the church; it can correct, hide or delete your information in the admin. If you send it to us, we will forward it to the church within [5] business days, tell you we have done so, and help the church respond. If a church does not act on a request concerning a person's safety, contact us at richard@missionarylane.org and we will work with the church, and may restrict the information while the request is resolved.

15.6 Givers #

Your church can show you, correct or delete your giving records, unlink your sign-in, or remove you from My missions. You can also sign out at any time, and on the My missions page you can download your giving records and delete your My missions account yourself (section 10). Deleting it does not affect your church's own giving records in its giving platform and its books; if its giving platform still lists you, the church's next import may list you again, so ask the church to remove you there too.

16. Do Not Sell or Share #

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Because of that, there is nothing to opt out of; we treat a Global Privacy Control signal as a request not to sell or share, which we already honour.

17. Contact #

[COMPANY LEGAL NAME], [ADDRESS] · Privacy questions and requests: richard@missionarylane.org · Security: richard@missionarylane.org · [DATA PROTECTION OFFICER OR PRIVACY CONTACT, IF APPOINTED]

18. Changes to this policy #

We will post any change here with a new date. If a change is material, we will email church owners at least [30] days before it takes effect and, where the law requires, ask for consent.