Your congregation's data belongs to your church.

In data protection terms, your church is the controller and Pastoral Office is the processor. Your church decides what is collected and why; we hold it, keep it safe, and act on your instructions. We do not decide what goes into your records and we do not use them for our own purposes.

We do not sell data, we do not share it with advertisers, and we do not use one church’s records to train anything.

Whatever your church puts in: member and family records, contact details, attendance, giving history and pledges, group membership, children’s check-in records and their guardians, event registrations, prayer requests, pastoral notes and care cases, volunteer schedules, and the messages you send from the platform.

We also keep the ordinary operational records any hosted service keeps: who signed in and when, what changed and who changed it, and server logs used to keep the service running and secure.

Only people your church invites, and only as much as the role you give them allows. A finance officer sees giving; a group leader sees their own group; a read-only viewer cannot change anything. Pastoral notes and care cases are restricted further, because they should be.

Every church’s data is separated inside the database itself by row level security, so one church cannot read another’s records even if the application asked it to. Sensitive changes are written to an audit log that records who did what and when.

Our own staff do not browse church records. Access to production is limited to what is needed to operate and support the service, and support work happens at your request.

Online giving and event payments are processed by Paystack across Africa, including Mobile Money, and by Stripe elsewhere. Card and mobile money details are collected by the payment provider directly and never reach our servers, so there is no card number in Pastoral Office to lose.

What we do hold is the record of the gift: amount, date, fund, method and the giver it belongs to, because that is the receipt your church has to be able to produce.

The service runs on dedicated servers we control. Backups are taken nightly, encrypted before they leave the machine, and stored off-site so that a single failure cannot take both the database and its backups. We restore those backups into a throwaway database and count what comes back, because a backup nobody has restored is only a claim.

Companies we rely on to run the service include our hosting provider, our payment providers, our backup storage provider, and the carriers who deliver your SMS, WhatsApp and email. They are given only what their job requires.

You can export your records at any time from inside the app. If you leave, you take your data with you.

If a member asks to be erased, your church can remove their record, and we will erase it from our systems and from backups as those backups age out of their retention window. Some records have to survive erasure of the person: a church is usually required to keep the financial record of a gift for its own accounts and tax reporting, so those entries remain while the personal details attached to them are removed.

To ask about any of this, or to raise a concern, write to hello@pastoraloffice.com.

If we change how any of this works we will update this page and, where the change matters to you, tell the churches it affects rather than quietly editing the text. See also our terms of service.