Privacy Policy

ChurchBytes Automations ("ChurchBytes", "we", "us") is a workspace for churches and religious organisations that connects service planning, rotas, congregational data and document generation into one place, and automates the repetitive work around them. It's built and operated by ClickaByte Ltd, a company registered in England and Wales.

ChurchBytes is typically used by a church or benefice (the "organisation") that has signed up for a workspace, and by the staff and volunteers that organisation invites as members. Where your organisation controls what data is entered into ChurchBytes about your congregation, your organisation is the data controller and we act as its data processor for that data. For account‑level data about you directly — your login, your own usage of ChurchBytes — we are the controller.

We collect information in three broad ways: what you give us directly, what your organisation's other systems give us on your behalf, and what's generated automatically as you use the product.

If you sign in with Google, or connect Google Drive from within ChurchBytes, we request the following scopes and use them only as described here:

• Profile & email — to identify you, create your account, and show your name/email in the app.
• drive.file — to create, name and update files ChurchBytes itself generates for you (e.g. a slide deck or newsletter PDF) inside a folder you choose. We cannot see or touch any other file in your Drive under this scope.
• drive.readonly— only when you explicitly pick a spreadsheet or document from your Drive as a data source for a custom automation, so we can read that specific file's contents.

• To provide the core service: building services and rotas, checking for gaps, and generating slides, newsletters, service sheets and other documents from your organisation's own data.
• To run automations you or your organisation set up — including scheduled ones, and custom PDF‑fill workflows you design.
• To authenticate you and keep your workspace secure, including detecting unusual account activity.
• To send service‑related communications: email verification, password resets, approval notifications you've opted into.
• To understand how ChurchBytes is used so we can fix problems and prioritise what to build next.
• To meet legal and regulatory obligations, and to respond to lawful requests from authorities.

Several ChurchBytes features — drafting weekly church news, summarising a sermon, suggesting slide content, answering questions about your organisation's own knowledge base — work by sending the relevant text (a Bible passage, a set of notices, your own uploaded documents) to a third‑party large language model provider to generate a response.

We select providers who contractually commit not to use data submitted via their API to train their own models. This content is sent only for the specific request you triggered, is not knowingly retained by us for AI training, and is never used to train a model on your organisation's behalf without your knowledge. Avoid pasting information you don't want processed this way into an AI‑assisted field if you're ever unsure.

Where UK GDPR applies, we rely on:

• Contract — processing needed to provide the ChurchBytes service your organisation has signed up for.
• Legitimate interests — for security, fraud prevention, product improvement and support, balanced against your rights.
• Consent — for optional integrations you actively connect, like Google Drive, and for any marketing communications, which you can withdraw at any time.
• Legal obligation— where we're required to retain or disclose information by law.

We don't sell your data. We share it only with the following categories of recipient, each strictly to provide the service:

• ChurchSuite— if your organisation connects it, we exchange service, rota and event data with ChurchSuite's own API on your organisation's authorisation.
• Google — for sign‑in and, where connected, storing generated files in your own Drive (see §3).
• AI model providers — for the specific AI‑assisted features described in §5.
• Infrastructure providers — hosting, database and email‑delivery services that store or transmit data strictly to run ChurchBytes.
• Other members of your organisation — content and automations created within a workspace are visible to other members of that same organisation, as ChurchBytes is a shared team tool.
• Legal & safety — where necessary to comply with the law, enforce our terms, or protect the rights, property or safety of ChurchBytes, our users, or the public.

We're based in the UK and host data primarily in the UK/EU. Some of the providers described in §7 — including some AI model providers — process data outside the UK, including in the United States. Where that happens, we rely on appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Addendum or an adequacy decision, to ensure your data receives an equivalent standard of protection.

We keep organisation data for as long as your workspace remains active, plus a limited period afterwards in case you or your organisation wants to reactivate it or export data. If your organisation deletes its workspace, or you request deletion of your own account, we remove personal data within a reasonable period, except where we're required to retain it for legal, accounting or security purposes — in which case it's retained only for as long as that purpose requires and then deleted.

We use encryption in transit (HTTPS/TLS) and at rest for stored credentials and sensitive fields, role‑based access controls within a workspace, and hashed passwords — we never store your password in plain text. Access to production systems is restricted to the people who need it to operate ChurchBytes. No system is perfectly secure, and we can't guarantee absolute security, but we work to protect your information and will notify affected users and, where required, regulators, promptly if a breach occurs.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data, subject to our legal retention obligations.
• Restrict or object to certain processing, including for legitimate‑interest purposes.
• Receive your data in a portable format, or have it transferred directly to another provider.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these, contact us at the address in §15. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

We use a small number of strictly necessary cookies to keep you signed in and remember your active workspace — these aren't optional, since ChurchBytes can't function without them, and we don't use advertising or cross‑site tracking cookies.

ChurchBytes is intended for use by adult staff and volunteers administering a church organisation, not by children. We don't knowingly collect personal data directly from children. Rota or event data entered by an organisation may occasionally reference a young person by name (e.g. a youth group event) — this is organisation data controlled by your organisation under §1, not data we collect from a child directly.

We may update this policy as ChurchBytes changes. If a change is material, we'll let workspace admins know by email or an in‑product notice before it takes effect. The "Effective" date at the top of this page always reflects the version currently in force.

Questions about this policy, or a request relating to your data, can be sent to: