How we handle your data

IglesiaConnect is developed, published, and technically operated by YCYC Consulting and Investment SL. YCYC Consulting and Investment SL is the data controller (Spanish: responsable del tratamiento) for the personal-data processing described in this policy. We determine the purposes and means of that processing and provide the software, hosting, security, and support for the platform.

Each church or organization using IglesiaConnect manages the day-to-day records and user permissions within its own tenant. Those organizations and their authorized administrators contribute and manage church-specific information inside the service, but YCYC Consulting and Investment SL remains the data controller for the processing covered by this policy. The organization using the ICCE Fuenlabrada tenant and public church pages is Iglesia Cristiana China en España · F堂 (ICCE Fuenlabrada), Calle Astorga 26, 28947 Fuenlabrada, Madrid, Spain.

This policy covers the product website (iglesiaconnect.com), the ICCE Fuenlabrada site (iglesiaconnect.com/iccefuenlabrada), the member web app (app.iglesiaconnect.com), the iOS app, and the optional ChatGPT/MCP connection.

For privacy questions, contact us at privacy@iglesiaconnect.com.

We only collect the data we need to run the church platform:

• Account data — your name, email, preferred language, the tenant (church) you belong to, and a secure hash of your password. You provide this when you register.
• Profile data — optional display name, ministry/role assignments, and notification preferences that you set in your profile.
• Audio recordings — when you tap “Start recording” in the live-translate host page, your microphone audio is streamed to our servers for transcription and translation and a private source recording is stored with the session. We use stored live-translate recordings and their captions to review incidents, measure accuracy and latency, and improve speech, translation, and voice quality. When you submit a choir practice take, the audio file is stored so your worship leader can review it. Recording never starts automatically—it always requires an explicit tap, and the iOS microphone permission prompt appears the first time.
• Photos — when you upload a photo to the church gallery or a book cover to the library, that file is stored on our servers. We only access the photo library after you pick a specific image; we do not scan or index your camera roll.
• Activity data — what you booked, which choir rehearsals you joined, which devotionals you read, plus basic technical logs (timestamps, IP address, app version, device model) needed to keep the service running and secure.
• Connected Google Workspace data — only when you separately connect Google, we process the Google account email, granted scopes, encrypted OAuth tokens, and the Drive file metadata, requested XLSX/CSV cell values, native Sheet values, Form structure, Form responses, or Calendar events needed for the action you request. We do not continuously copy or index your Drive.
• Live-translate listener — the public listener page does not require an account and does not request microphone or camera access. We only log the anonymous session ID you joined and basic connection metadata to deliver the translated audio stream.

Outside an optional Google connection that you explicitly authorize, we do not collect location, contacts, calendars, reminders, advertising identifiers (IDFA), health data, or financial card details. Giving and offerings are processed by our payment partner; IglesiaConnect itself never stores your card number.

You may choose to connect your IglesiaConnect account to ChatGPT through our MCP service. The connection uses OAuth 2.1: you sign in on an IglesiaConnect page and approve specific scopes. Your IglesiaConnect password is not sent to ChatGPT.

When you ask ChatGPT to use IglesiaConnect, we process:

• the linked user and tenant identifiers, approved OAuth scopes, short-lived access tokens, and revocable refresh-token records;
• the arguments for the selected tool, such as a date range, event ID, search term, profile field you asked to update, or the resource and column mapping for an attached spreadsheet;
• the minimum authorized IglesiaConnect data needed to answer that tool call, plus security and audit metadata.

Every tool call is still checked against your existing tenant, role, and resource permissions. Connecting ChatGPT never grants administrator access by itself. The current connector supports explicit single-record operations and reviewed imports for people, groups, memberships, and create-only donations. It does not expose bulk deletion, messaging, permission management, private counselling/minor records, or unrestricted file access.

If you ask to preview an attached .xlsx or .csv, the MCP service temporarily downloads that file from ChatGPT's approved file host and parses it in memory. We do not retain the uploaded file bytes. Only mapped preview fields, validation results, and rollback snapshots are stored in IglesiaConnect for up to 30 days, accessible only to the same user under their current permissions. Uploading a file does not import it; a separate confirmation is required. Longer-lived security audit records contain the import type, row count, outcome, and request ID—not spreadsheet cell values.

You may also separately connect Google Workspace in read-only or management mode. Read-only mode can search and read the Drive, Sheets, Forms, and Form responses you request. A separate Calendar connection can synchronize requested Calendar events. Management mode can additionally create or change app-created or explicitly requested Drive, Sheets, and Forms items. Google access never bypasses your IglesiaConnect role permissions. OAuth tokens are encrypted at rest; we do not retain a general Drive index or source Drive spreadsheet or native Sheet/Form content after the requested call, except mapped import previews and rollback evidence described above. You can disconnect Google at any time, which revokes access without deleting your Google files.

IglesiaConnect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising or to train generalized AI models.

Tool results shown in a ChatGPT conversation are also handled by OpenAI under the terms and data controls for your ChatGPT account. Review the OpenAI Privacy Policy before connecting. You can revoke the connection from your IglesiaConnect profile at any time.

• Run the church platform — log you in, show your worship schedule, accept facility bookings, deliver live translation, and run choir rehearsal workflows.
• Communicate with you — send service-related emails (password reset, booking confirmation, and ministry announcements you opted into).
• Keep the service safe — detect abuse, troubleshoot bugs, and meet the security obligations we owe to you and your church.
• Improve the product — use aggregate, non-personal usage statistics (for example, how many people opened a devotional this week). With recording consent, specifically authorized technical staff may also use privately stored live-translate audio and associated captions in controlled evaluation sets to find transcription, terminology, translation, latency, and voice-quality failures. We do not build advertising profiles.

Our legal bases under GDPR Article 6 are consent (recordings and optional profile fields), contract (running the account you registered for), and legitimate interests (security, fraud prevention, and basic analytics).

Your data is visible to:

• You — on every device you sign in on.
• Your church’s pastoral team and assigned admins — they can see member directory entries, ministry assignments, facility bookings, and choir submissions for the church you belong to. They cannot see members of other churches.
• Our technical sub-processors — who only see what they need to run their part of the service:
  • Infrastructure hosting and object storage in the EU stores the database, service logs, and uploaded files.
  • OpenAI speech and language services process the audio or text you explicitly send for live transcription and translation, under our applicable API data controls.
  • During the current voice-system transition, ElevenLabs may process translated Spanish text to generate optional listener speech. We do not send stored source recordings to ElevenLabs for this step.
  • OpenAI / ChatGPT receives authorized tool inputs and results only when a user enables the optional connection and requests an IglesiaConnect action in ChatGPT.
  • Google APIs process only the Drive, Sheets, Forms, responses, or Calendar request initiated through a Google account that the user separately authorizes; Google's own terms and privacy policy also apply to that account.
  • Email delivery for transactional emails only.

We do not sell your data, and we do not share it with advertisers, data brokers, or social networks. The iOS app contains no third-party tracking SDKs.

• Account and profile — kept while your account is active and deleted within 30 days of account deletion.
• Live-translate audio — source recordings, generated transcripts, translations, corrections, and technical quality measurements are stored privately with the session. They are not subject to an automatic 90-day deletion rule and are kept until the session host or an authorized church administrator deletes the session, the tenant closes, or a valid deletion request is fulfilled. De-identified aggregate quality measurements may remain after source audio is deleted.
• Choir practice recordings — kept until you or your worship leader deletes them, or until the song is archived (typically one rehearsal cycle).
• Gallery and book-cover photos — kept while the gallery item or book record exists and deleted when the item is removed.
• Technical logs — kept for 90 days, then aggregated or deleted.
• ChatGPT authorization records — authorization codes and pending requests expire within minutes; access tokens are short-lived. Refresh-token evidence and the connection grant remain only while needed to keep the connection active, investigate reuse, or meet security obligations, and are removed after revocation and the applicable security window.
• Google Workspace connection — one-time authorization state expires within 10 minutes. Encrypted Google access and refresh tokens, account email, approved scopes, expiry, and sync metadata are kept only while the connection is active and are removed when it is disconnected. Requested Google content is transient unless it becomes an IglesiaConnect record or a reviewed import preview, which follows the 30-day import retention above.

IglesiaConnect is rated 4+ on the App Store because it contains no objectionable content, but the platform is intended for use by adults (church members and lay leaders). Children may appear in church family records that their parents maintain; those records are visible only to the family and pastoral staff. We do not knowingly collect data directly from children under 14 without parental involvement.

You can:

• Access and edit — your profile inside the app (Profile → Edit).
• Delete your account — from Profile → Delete account in both the web app and the iOS app. Deletion removes your account, profile, and personally identifiable activity within 30 days. Aggregate, anonymous statistics may be kept.
• Withdraw consent — for future optional processing at any time. You may stop a live or practice recording immediately and ask privacy@iglesiaconnect.com or an authorized church administrator to delete a stored live-translation session or recording.
• Disconnect ChatGPT — from the connected-apps section in your IglesiaConnect profile. This revokes the grant and refresh tokens; new tool calls will require authorization again.
• Disconnect Google Workspace — from App connections in IglesiaConnect. We revoke the Google token where possible and delete the stored connection. This does not delete your Google files. You can also revoke IglesiaConnect from your Google Account security settings.
• Export your data — by emailing privacy@iglesiaconnect.com.
• Lodge a complaint — with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), if you believe we have mishandled your data.

The IglesiaConnect iOS app asks for three system permissions, each only when you tap a feature that needs it:

• Microphone — only when you tap “Start recording” to host a live translation session or submit a choir practice take. Listener pages never request microphone access.
• Camera — only when you open the ISBN scanner in the library or scan a QR code to join a session.
• Photo Library — only when you tap “Upload photo” in the gallery or pick a book cover. We use the system picker, so we only see the photo you choose.

The app does not request notifications, location, contacts, calendar, reminders, Bluetooth, local-network discovery, or tracking (App Tracking Transparency) in version 1.

Traffic is encrypted in transit (HTTPS/TLS). Passwords are stored as salted hashes—never in plaintext. Access to production data is restricted to a small set of operators and logged. The ChatGPT connection uses the OAuth 2.1 authorization-code flow with PKCE, short-lived signed access tokens, rotating refresh tokens, scoped tools, rate limits, and a second permission check in the IglesiaConnect API. We patch dependencies on a regular cadence and review changes that touch authentication or data handling.

If we materially change how we handle data, we will update this page and change the Effective date above. For significant changes, we will also notify active users by email or an in-app banner.

Questions, concerns, or rights requests: privacy@iglesiaconnect.com. For general church inquiries, see our Contact page.