Privacy Policy

1. Who We Are

Worship Works is a cloud-based church administration and accounting platform developed and operated by Merina Shop LTD, a corporation registered in Canada.

This Privacy Policy applies to all users of the Worship Works platform, including church administrators, staff accounts, and organization members whose data is entered or managed within the platform.

2. Information We Collect

2.1 Account & Organization Information

When you create an account or register your church, we collect:

• Church or organization name, email address, phone number, and mailing address
• Administrator name, email address, and password (stored as a secure hash — we never store plaintext passwords)
• Billing information processed through our payment provider (Stripe); we do not store full credit card numbers
• Subscription plan and billing history

2.2 Member Data You Enter

Worship Works is a tool for managing your congregation. Data you enter about your church members may include:

• Full name, date of birth, gender, marital status
• Contact information: email, phone, home address
• Member number, membership status, and join date
• Profile photo
• Contribution and giving records (amounts, dates, fund categories)
• Family group associations
• Pastoral follow-up notes
• Any optional fields enabled by your church's administrator

2.3 Usage & Technical Data

When you use the platform, we automatically collect limited technical data:

• IP address and approximate geographic location (country/province)
• Browser type and operating system
• Pages visited, actions taken, and time spent in the app
• Error logs to help us diagnose and fix issues

We do not build advertising profiles or sell this data.

2.4 Communications

If you contact us by email or through the platform's support channel, we retain the content of that communication to assist you and improve our service.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To operate the platform — authenticate users, store and retrieve church data, generate reports, receipts, and ID cards
• To send transactional emails — CRA donation receipts, annual giving statements, automated task emails (birthday, anniversary, welcome), and password resets
• To process billing — charge subscription fees and issue invoices via Stripe
• To provide customer support — respond to inquiries and resolve technical issues
• To improve the platform — analyze aggregate, anonymized usage patterns to guide feature development
• To comply with legal obligations — respond to lawful requests from Canadian regulatory authorities

We do not use your data for advertising, do not sell it to third parties, and do not use church member data for any purpose other than operating the platform on your behalf.

4. Data Storage & Location

All customer data — including church records, member information, and contribution history — is stored on servers located in Canada. We use cloud infrastructure with Canadian datacenters to ensure your data does not leave Canadian jurisdiction.

Our infrastructure uses industry-standard encryption (TLS in transit, AES-256 at rest) and is maintained with regular security patches and backups.

5. Sharing Your Information

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

5.1 Service Providers (Sub-processors)

We use a small number of third-party services to operate the platform:

• Stripe — payment processing and billing. Stripe's privacy policy governs payment data.
• SMTP email provider — delivery of transactional emails (receipts, statements, automated tasks). Only the recipient's email address and message content are shared.
• Cloud infrastructure provider — hosting and database services, operating in Canadian datacenters.

We maintain data processing agreements with all sub-processors and require them to protect personal information consistent with PIPEDA.

5.2 Legal Requirements

We may disclose personal information if required to do so by law, court order, or a lawful request from a Canadian government authority. We will notify affected organizations where legally permitted to do so.

5.3 Business Transfers

If Merina Shop LTD is acquired, merged, or undergoes a change of ownership, customer data may be transferred to the successor entity. We will provide notice and, where required, seek your consent before any such transfer affects how your data is used.

6. Cookies & Tracking

Worship Works uses a minimal set of cookies:

• Session cookie — maintains your login session. This is a functional cookie; the platform cannot work without it.
• Preference cookie — remembers your organization and UI preferences between visits.

We do not use advertising cookies, tracking pixels, or third-party analytics scripts on the logged-in platform. The public marketing site (worshipworks.ca) may use anonymized analytics to measure page visits. No cross-site tracking is performed.

You may disable cookies in your browser settings, but doing so will prevent you from logging in to the platform.

7. Data Retention

We retain your data for as long as your account is active. Specifically:

• Active accounts: All church and member data is retained and accessible for the duration of your subscription.
• Cancelled accounts: We retain data for 90 days after cancellation to allow for reactivation or export. After 90 days, all organization data is permanently deleted from our systems.
• Billing records: Retained for 7 years as required by Canadian tax law (Income Tax Act).
• Support communications: Retained for 2 years after the issue is resolved.

You may request earlier deletion at any time by contacting us at privacy@worshipworks.ca.

8. Your Rights Under PIPEDA

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) gives you the following rights regarding your personal information:

• Right to access — You may request a copy of the personal information we hold about you or your organization.
• Right to correction — You may ask us to correct inaccurate or incomplete information.
• Right to withdrawal of consent — Where processing is based on consent, you may withdraw consent at any time. This may affect your ability to use certain features.
• Right to deletion — You may request that we delete your personal information, subject to legal retention requirements.
• Right to complain — If you believe we have violated PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

For church member data: Since your church organization is the data controller for member records entered into Worship Works, members of your congregation should direct data access or deletion requests to your church administrator first. We will assist your organization in fulfilling such requests.

To exercise any of the above rights, contact our Privacy Officer at privacy@worshipworks.ca. We will respond within 30 days.

9. Children's Privacy

Worship Works accounts are intended for church administrators and staff who are 18 years of age or older. We do not knowingly collect personal information directly from individuals under 13.

Church member records may include minors as part of family groups. This data is entered by your church organization (as data controller) and should only be included where the church has appropriate consent from parents or guardians.

10. Security

We take the security of your data seriously and implement the following safeguards:

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256
• Passwords are hashed using bcrypt; we never store plaintext passwords
• Role-based access control limits which users can view or edit sensitive data
• Regular automated database backups stored in encrypted form
• Multi-tenant isolation ensures one church organization cannot access another's data
• Security patches applied on a regular schedule

Despite these measures, no system can be guaranteed 100% secure. In the event of a data breach that creates a real risk of significant harm, we will notify affected organizations and the Office of the Privacy Commissioner of Canada as required by PIPEDA's mandatory breach reporting rules (PIPEDA, Part 1, Division 1.1).

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the updated policy on this page with a new "Last updated" date
• Send an email notice to the primary account holder of each organization at least 14 days before the changes take effect
• Where required by law, obtain renewed consent

Continued use of Worship Works after changes take effect constitutes acceptance of the updated policy. If you do not agree with a material change, you may cancel your account before the effective date and request deletion of your data.

12. Contact & Privacy Officer

For any privacy-related questions, requests, or concerns, please contact our designated Privacy Officer: