Privacy
What we collect, and why.
Who is responsible for which data, what Folio collects, how AI and crisis handling work, who else handles it, and how long it is kept.
Version 2026-10-25, effective
Related: Terms · Data processing addendum · Sub-processors · Cookies · Security
Who is responsible
Folio is operated by Candensa, London, United Kingdom, registration [COMPANY REGISTRATION NUMBER]. Privacy contact: [PRIVACY LEAD OR DPO NAME], [email protected].
There are two roles.
- Folio is the controller of staff and member account data, billing and tax data, security records, the data of people who give a gift, and visitors to this website.
- The church is the controller and Folio is its processor for the church’s teachings, recordings, transcripts, notes, Ask conversations, subscribers, care alerts and member records. We handle those only on the church’s documented instructions, under the data processing addendum. If you are a church member, the church decides why your data is used and answers your requests.
A partner that creates churches through the API is a separate party. It acts for the church it created, and the church is the controller.
What we collect
Accounts and security
Email address, name, a password hash or a sign-in provider identifier, two-step verification factors (authenticator secrets are encrypted; passkeys are stored as public keys), recovery codes (hashed), role in each church, language and time zone. For each sign-in we record the network address and browser details, and security events such as failed attempts and key use. Failed-attempt counters live in Redis and expire within about an hour.
Church content
Teachings, audio and video, transcripts, live captions, notes, outputs, scripture checks, the church’s voice and statement of faith, connected-source credentials (encrypted), and the people the church invites. A church can flag a teaching as a guest speaker’s.
Ask conversations
Questions, answers, the sources used, and signed-in members’ saved facts if they turned memory on. A visitor on a church website is not asked to sign in. The widget makes a random identifier in the browser’s session storage, and we store only a one-way hash of it with the conversation. We do not store the visitor’s network address with the conversation; it is used briefly for rate limits. The church sees the conversation, not who asked, unless the asker chooses to give contact details.
Care and handoffs
When a question looks like a crisis, or a person chooses “Ask a pastor instead”, the church receives an alert. The alert text is encrypted in the database. The notification sent to the church’s care contacts says only that a member needs care and links to the care board. Reading an alert is logged with a reason. If you choose to leave your name, email or phone number, the church receives it.
Subscribers
Email address, optional first name, phone number if the church collects one, language, list memberships, and a consent record: the wording shown, the time, and the network address and browser details at that moment. Nothing is sent until the address is confirmed.
Billing and gifts
Church billing name, address and tax number the owner enters, plan, invoices, and payment status. For gifts: the giver’s name and email, the recipient’s name and email, an optional message, whether the gift is anonymous. Card and bank details are entered on the payment provider’s page and never reach Folio; we keep the provider’s reference, the card brand, the last four digits and the expiry date.
This website
Our host and network provider see your network address and request details. Fonts load from Google Fonts. See cookies and storage.
Analytics and browser storage
We send page and button events to our analytics provider (PostHog, hosted in the EU) only after you choose “Allow analytics” on the banner. Before that, and if you decline, no analytics request is made. We do not use it to follow you from one church to another. The website sets no cookies. Your browser stores your theme and your analytics choice, and a random session value keeps a conversation together on a church’s Ask page. The signed-in app uses cookies that keep you signed in. Details are on the cookies page.
Why we use it, and the legal basis
| Purpose | Basis (UK GDPR, EU GDPR, NDPA, Kenya DPA) |
|---|---|
| Creating and running accounts, delivering the service, support | Performance of a contract |
| Security, fraud and abuse prevention, rate limits, audit records | Legitimate interests |
| Taking and refunding payments, tax and accounting | Contract and legal obligation |
| Counting website events | Consent, given by choosing Allow analytics and withdrawn by clearing it |
| Service notices to church owners | Contract and legitimate interests |
| Content a church processes in Folio | The church’s own basis, chosen by the church as controller |
What people ask a church can reveal religious belief, health or other sensitive matters. Treat it as sensitive. Churches rely on their own conditions for processing it. We apply the same protections to every question and do not use it to profile anyone.
AI, accuracy and crisis handling
Answers and notes are written by a language model from the church’s approved teaching. They can be wrong or incomplete. They are not pastoral, medical, legal or crisis advice.
- Answers are written only from the church’s teaching that it has approved, and name their sources. If the teaching does not answer, the answer says so. A model can still misread or misstate the source.
- A pastor or staff member is the human review. By default a person at the church approves each note before members see it. A church can switch on automatic approval for notes that pass checks, and a page says which kind of approval it had.
- No decision with a legal or similarly significant effect on a person is made by automated means. Automated steps are drafting, retrieval, scripture checking, rate limits and crisis screening. To contest or question any of them, write to the church or to us and a person will look at it.
- We do not train or fine-tune models on a church’s content or on questions. Content is sent to our language-model and speech vendors only to produce the result. We use vendor plans under which the vendor does not use API content to improve its own models. [OWNER TO CONFIRM BEFORE LAUNCH: Google Gemini API is on a paid plan, and Deepgram’s Model Improvement Partnership setting.] Vendors may keep content for a short time for abuse monitoring under their terms.
Crisis wording
Every question is screened for wording about self-harm, abuse, violence and medical emergencies, first by pattern matching in English, French, Spanish, Portuguese, Swahili, Yoruba and Nigerian Pidgin, and where it is unclear by a language model. If it is flagged, the person is shown a caring message with free helplines for their country (which a church can change), and is told to call local emergency services if in immediate danger. A care alert is created for the church, whose care contacts are notified if the church has set any up. Screening is imperfect and can miss wording or flag a harmless question. Folio is not an emergency service and nobody monitors it around the clock. If you are in danger, call your local emergency number.
Who else handles it
We use the providers on the sub-processors page, each only for its job. We do not sell personal data and do not share it for advertising. Folio staff do not see a church’s content. A church owner can grant time-limited support access that is logged, and platform administrators otherwise see counts, statuses and errors. We may disclose data where the law requires it.
A church sees what its members and visitors give it, and a partner that created a church can act for it through the API.
Where it is processed, and transfers
Our servers are in Falkenstein, Germany. Some providers, including our speech and language-model vendors and payment providers, process data in the United States or elsewhere. Where personal data from the UK, the European Economic Area, Nigeria or Kenya goes to a country without an adequacy finding, we rely on the safeguards the law provides, such as the standard contractual clauses, the UK International Data Transfer Addendum, contractual terms approved or recognised by the relevant regulator, or a recognised exception. Ask us for a copy of the safeguards for a provider.
How long we keep it
Retention is set by each church for its own data. A new church starts with recordings, captions, conversations and audience events kept until the church removes them, and care alerts for 90 days. Here is what the software does.
| Data | How long | Who decides |
|---|---|---|
| Recordings a church uploads | Kept until the church removes them, unless it picks 30, 90, 180 or 365 days. A daily job removes the audio or video file once a transcript exists. A recording with no transcript is kept. | The church chooses |
| Live captions | Kept until removed, unless the church picks 30, 90, 180 or 365 days. A daily job removes captions of ended services that already have a transcript. | The church chooses |
| Ask conversations, including questions asked on a church website, and saved voice questions | Kept until removed, unless the church picks 90, 180, 365 or 730 days after the last message. A conversation with an open handoff to a pastor, or a share link still active, is kept. | The church chooses |
| Audience delivery records and email events | Kept until removed, unless the church picks 90, 180, 365 or 730 days. | The church chooses |
| Care alert text and the handling note | Erased 90 days after the alert was raised by default (the church can pick 30, 60, 90, 180 or 365) once the alert is marked handled. An alert nobody has handled is not cleared. The alert’s category, time and who read it stay. | The church chooses |
| Transcripts, notes, outputs and other teaching | Kept until the church deletes them or deletes the church. | The church |
| Facts a member saved in Ask memory | Kept until the member edits, forgets or clears them. They are encrypted in the database and are not removed by conversation retention. | The member |
| Sign-in sessions | Idle for 7 days or 30 days in total ends a session. The session record, with the network address and browser details recorded at sign-in, is kept until the account is anonymised. | Folio |
| Security events (sign-ins, failures, key use) | Kept with the network address and browser details until the account is anonymised or the church is deleted. No automatic expiry yet. | Folio |
| Email subscriber consent record | Address, time, wording, and the network address and browser details at the moment of consent are kept until the church erases the subscriber or is deleted. | The church |
| Plan, invoice and payment records | Kept while the church exists, and removed when the church is deleted. [COUNSEL: CONFIRM TAX AND ACCOUNTING RETENTION PERIOD] | Folio |
| Data exports | An archive is ready for 7 days and each download link works for 15 minutes. | Folio |
| Operational logs | Kept for 14 days. They carry a request identifier, the path and the status, and are meant to carry no personal data. | Folio |
| Finished background jobs and webhook delivery payloads | Kept for 30 days. | Folio |
| Sandbox churches | Created for testing, they expire after 30 days. | Folio |
| Backups | Encrypted copies of the database are kept for up to 35 days for point-in-time recovery, 14 daily dumps on the server, and off-site snapshots kept 14 daily, 8 weekly and 12 monthly. Deleted data therefore remains in backups until they roll off, up to about 12 months. We do not restore a backup into live use without deleting again what was deleted. | Folio |
| A church that has been deleted | Deletion starts after a 14-day grace period that the owner can cancel. It removes the church’s files, recordings, search index, conversations, memberships, billing and security records. A small record that a church with an opaque reference was deleted, and what was removed, stays. | Folio |
| A church that stops paying | Becomes read-only after a 14-day grace period. Nothing is deleted automatically. The owner can export and delete at any time. | The owner |
Your rights and how to use them
Depending on where you live you can ask to access, correct, delete, restrict or object to the use of your data, receive a copy you can reuse, withdraw consent, and not be subject to solely automated decisions. This applies under the UK GDPR and Data Protection Act 2018, the EU GDPR, the Nigeria Data Protection Act 2023, the Kenya Data Protection Act 2019, and for California residents the CCPA as amended (we do not sell or share personal information for cross-context advertising).
- For your own Folio account, gifts or this website: write to [email protected] from the address on the account. Account closing, anonymising and export are done by our staff on request today. We reply within one month, or tell you why we need longer.
- For what a church holds about you (questions, subscriber record, care alert): ask the church. If you write to us, we pass the request to the church. A church can export or erase a subscriber’s record and delete conversations from within the app.
- Church members who saved Ask memory can edit, forget or clear it in the app at any time.
- Unsubscribe with the link in every email.
We may need to confirm who you are. We do not charge for a request unless it is manifestly unfounded or excessive. We do not discriminate against anyone for using these rights.
Complaints
Please tell us first and we will try to put it right. You can also complain to the regulator.
- Nigeria: the Nigeria Data Protection Commission (ndpc.gov.ng). Registration status: [NDPC REGISTRATION STATUS].
- United Kingdom: the Information Commissioner’s Office (ico.org.uk). Registration: [ICO REGISTRATION NUMBER]. UK representative: [UK REPRESENTATIVE, IF REQUIRED].
- European Economic Area: the supervisory authority in your country. EU representative: [EU REPRESENTATIVE, IF REQUIRED].
- Kenya: the Office of the Data Protection Commissioner (odpc.go.ke). Registration status: [ODPC REGISTRATION STATUS].
- California: the California Privacy Protection Agency or the Attorney General.
Security and breaches
Every church’s data is separated by church identity in each request and by the database itself. Connections are encrypted with TLS. Sensitive fields, such as care alert text, saved Ask facts, connected-source credentials, authenticator secrets and webhook secrets, are additionally encrypted before they are stored. Backups are encrypted. Sensitive actions need a recent second factor. See trust and security.
If a personal data breach affects data we control, we will tell the regulator where the law requires it, within 72 hours of becoming aware where feasible, and affected people without undue delay when there is a high risk to them. For data we process for a church, we tell the church without undue delay so it can meet its own duties.
Children
Folio is for church staff and adults. It is not directed at children under 13 (or under 16 where the law sets that age), and we do not knowingly collect their data. Churches decide whether to record services or events that include young people; they are responsible for parent or guardian permission and should not upload content of children without it. If you think a child’s data is in Folio, write to us and we will remove it.
Changes and contact
When we change this page we change the version and date above. For a material change we email church owners before it takes effect. Contact: [PRIVACY LEAD OR DPO NAME], [email protected], Candensa, London, United Kingdom.