Privacy & terms.

Who we are. Church Flow (Pty) Ltd, South Africa, operates church-flow.com and the Church Flow platform.

What we collect on this site. When you sign up we collect your church's name, your name, email address and chosen password. No payment card is collected during the trial. If you subscribe, payment is processed by Paystack; card details are entered on Paystack's secure pages and never stored by us. The demo form collects the contact details you type into it, which we use only to respond.

Your congregation's data. Data your church loads into its workspace (people, giving, attendance) belongs to your church. Your church is the responsible party; Church Flow processes it only to operate the workspace, encrypted at rest and in transit, with each church's data kept strictly separate.

Platform messaging. When your church sends email, SMS or WhatsApp messages through Church Flow's built-in channels, the message content and recipient contact details pass through messaging accounts operated by Church Flow, strictly to deliver those messages on your behalf. Church Flow acts as an operator (processor) of that personal information under POPIA; your church remains the responsible party. We keep delivery records (delivery status, bounces, complaints and opt-outs) to operate the service, protect deliverability and meet legal obligations. Messaging credits are prepaid: top-ups are not refundable to your card; balance corrections are made as credit adjustments by Church Flow support.

Cookies and advertising measurement. The account area sets one strictly-necessary session cookie (cf_session). Our own marketing pages on church-flow.com (never a church's workspace, a church's website or any member data) may load the Meta Pixel so that we can measure our Facebook and Instagram advertising and show relevant ads to people who visited this site. It sets Meta's _fbp cookie and sends Meta the church-flow.com pages you viewed and standard events such as requesting a demo or starting a trial, together with your IP address and browser details. You can opt out through Meta's ad preferences or by blocking third-party cookies; the site works fully without it. The same marketing pages and the signup wizard may also load Google Ads conversion tracking (the Google tag) so that we can measure our Google Search advertising. It sets Google's _gcl_au cookie on church-flow.com, reads the gclid click identifier that Google appends to the address when you arrive from one of our ads, and sends Google the church-flow.com pages you viewed and the conversion events (requesting a demo or contacting us, starting a trial, starting a subscription) together with your IP address and browser details. You can opt out through Google's ads settings or by blocking third-party cookies; the site works fully without it. We run no other advertising or third-party analytics cookies.

Retention. If you cancel, your workspace data is retained for 90 days for export and reinstatement, then purged.

Your rights. You may request access to, correction of, or deletion of your personal information at any time via [email protected].

Scope. Church Flow Social, the social module of Church Flow, uses YouTube API Services. A church's authorised staff connect the church's own YouTube channel via Google OAuth; the app accesses only that connected channel and never any other user's data. By connecting a channel you also agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy.

Data use. Raw Google user data the app receives (the connected channel's profile, its video and live-broadcast listings, live-chat messages during the church's own streams, and OAuth tokens) is used solely to provide the module's features to that church's authorised staff: uploading and scheduling the church's own videos, managing the church's own live broadcasts, reading and replying to live chat, and displaying the channel's analytics. Aggregated or anonymised Google user data is used only to render the same church's analytics dashboard (totals and trends for its own channel) and for no other purpose. Google user data is never used for advertising, is never sold, and is not used to develop, improve, or train generalised AI or machine-learning models.

Data sharing and transfer. Neither raw nor aggregated Google user data is transferred, shared, or disclosed to any third party. It is accessible only within the connecting church's own workspace to that church's authorised staff, and to Church Flow personnel strictly as needed to operate and support the service or to comply with applicable law. No Google user data is passed to advertisers, data brokers, analytics vendors, AI model providers, or any other external party.

Data protection. All communication with Google APIs and with your browser is encrypted in transit with TLS. OAuth tokens are stored encrypted with an application-level encryption key, are redacted from application logs, and are never exposed to the browser. Google user data is held in an access-controlled database, separated per church by row-level security, on servers whose disks are encrypted at rest, with nightly client-side-encrypted backups. Within a workspace, access is limited to authorised staff through role-based permissions.

Retention and revocation. A church can disconnect its channel at any time from the Church Flow dashboard, or revoke Church Flow Social's access in Google security settings at myaccount.google.com/permissions; revoking invalidates the app's access immediately. Stored workspace data, including Google user data, is purged 90 days after cancellation (see Retention above). Deletion requests: [email protected].

Limited use. Church Flow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Scope. Church Flow Social also lets a church's authorised staff connect the church's own Facebook Pages and linked Instagram accounts (via Meta's Graph API), TikTok accounts (via TikTok for Developers), and Google Business Profile locations. Each connection is made through that platform's own OAuth consent screen, and the app accesses only the accounts the church connects, never any other user's data.

Data use. Platform data the app receives (the connected account's profile name, picture and identifiers, the church's own posts and videos, comments, direct messages and reviews on the church's own accounts, engagement statistics, and OAuth tokens) is used solely to provide the module's features to that church's authorised staff: composing, scheduling and publishing the church's own content, reading and replying to comments, messages and reviews in the inbox, and displaying the church's own analytics. Platform data is never used for advertising, is never sold, and is not used to develop, improve, or train generalised AI or machine-learning models.

Data sharing and protection. Platform data is not transferred, shared, or disclosed to any third party. It is accessible only within the connecting church's own workspace to that church's authorised staff, and to Church Flow personnel strictly as needed to operate and support the service or to comply with applicable law. OAuth tokens are stored encrypted with an application-level encryption key; all platform data is held in an access-controlled database, separated per church by row-level security, encrypted in transit and at rest.

Disconnecting and deleting your data. A church can disconnect any account at any time from the Church Flow dashboard (Social → Channels), or revoke access on the platform's side: for Facebook and Instagram under Facebook Settings → Business integrations, for TikTok under Settings → Security → Manage app permissions in the TikTok app, and for Google Business Profile at myaccount.google.com/permissions. Revoking invalidates the app's access immediately. Stored workspace data from a disconnected account, and all platform data after cancellation, is purged within the 90-day retention window above; to have it deleted sooner, email [email protected] from your church's account and we will delete it within 30 days and confirm.

Subscriptions. Plans are billed in South African Rand via Paystack, monthly or annually, after a 30-day free trial. You can change plans or cancel from your account page at any time; cancellation takes effect at the end of the paid period.

Refunds. Fees are non-refundable, except where a billing error on our side is confirmed; those are refunded automatically.

Acceptable use. The platform is for legitimate church and ministry administration. Workspaces used for unlawful activity may be suspended.

Your data on exit. Export your data at any time. After cancellation, we purge our copy after the 90-day retention window.

Service. We operate the service with reasonable skill and care.

Changes. We may update these terms at any time. The current version always lives on this page, and the date at the top reflects the latest revision.