1. Introduction

This policy applies to three groups of people: visitors to our website (kingdomvitals.app), the churches and organizations that sign up for and administer a Kingdom Vitals account ("Churches"), and the members, visitors, and congregants whose information a Church enters into the platform ("Church Members"). Section 3 below explains why we describe Church Members' data separately.

2. Who We Are

Kingdom Vitals is a product of MawuRapha Solutions Limited, based in Accra, Ghana. You can reach us at hello@kingdomvitals.app or +233 50 922 8314. We are in the process of registering as a Data Controller with Ghana's Data Protection Commission (DPC), as required by the Data Protection Act, 2012 (Act 843).

3. Data Controller vs. Data Processor

Kingdom Vitals is a platform that Churches use to manage their own membership, giving, attendance, and ministry records. This means two different relationships apply, depending on whose data is involved:

• Data about a Church's members and congregants. The Church decides what information to collect about its members and why — the Church is the Data Controller for that data under Act 843. We process it only on the Church's instructions, as its Data Processor, and store it in a database isolated to that Church (see Section 11).
• Data about the Church's own account, and data from visitors to our website. For a Church's billing and administrator information, and for anyone who visits our marketing website or submits our contact form, we are the Data Controller.

If you are a Church Member and want to know what a specific Church holds about you, or to exercise a data-protection right, please contact that Church directly first — they control the record. We support Churches in responding to these requests.

4. Information We Collect

Account and billing information

When a Church signs up, we collect the administrator's name, email, phone number, role, and billing details. Payments are processed by Paystack — we only ever store a tokenized payment reference and masked card details (e.g. last 4 digits, card brand, issuing bank); we never see or store a full card number or CVV.

Information a Church enters about its members

Depending on which features a Church uses, this can include:

• Identity and contact details — name, date of birth, gender, marital status, profession, phone, email, home and GPS address, photo.
• Household and family relationships.
• Membership and spiritual milestones — join date, baptism/confirmation date, previous congregation.
• Attendance and check-in records (QR-code based — not biometric data).
• Giving history, pledges, and financial commitments.
• Communication logs — SMS and email sent to a member, including delivery and open/click status.

Special-category information

Some features involve more sensitive data, which Act 843 calls "special personal data" — this includes information revealing religious belief or health status. This requires a Church's members to have given explicit consent, or falls under the recognized exception for religious organizations processing their congregants' data. Examples in Kingdom Vitals:

• Prayer requests, including their content and category — some prayer requests are automatically classified using AI to help route them appropriately (see Section 7).
• Children's emergency contacts and medical information — allergies, conditions, medications, blood type, doctor and insurance details (see Section 13).
• Welfare and benevolence claims — the reason for a claim, description, and any supporting documents a member or Church uploads.

Information we generate about engagement (AI-assisted)

To help Churches understand and care for their members, Kingdom Vitals calculates scores such as churn risk, engagement level, and giving capacity, based on activity in the platform. These scores are informational — they help a Church prioritize outreach and are never used to make any decision that has a legal or similarly significant effect on a member. You may object to this processing at any time (Section 14).

Website and marketing data

If you fill in our contact form, we collect your name, email, church name, church size, and message, and use it only to respond to you. If you accept cookies on our website, we also collect analytics data — see Section 9.

5. How We Use Information

We use personal data to:

• Provide, operate, and maintain the Kingdom Vitals platform for Churches.
• Process payments and subscriptions, and send billing communications.
• Send transactional and, where consented to, informational communications by SMS and email.
• Power AI-assisted features — the SMS/chat assistant, prayer-request classification, and engagement insights described in Section 7.
• Provide customer support and respond to enquiries.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with our legal obligations, including under Act 843.
• Understand how our marketing website is used, where you've consented to analytics cookies.

6. Legal Basis for Processing

We (or the Church, where it is the Data Controller) rely on one of the following legal bases to process personal data:

• Consent — freely given, informed consent, which can be withdrawn at any time.
• Contract performance — to provide the Kingdom Vitals service a Church has subscribed to.
• Legitimate interests — such as keeping the platform secure and improving our features, balanced against your rights.
• Statutory exception for religious organizations — Act 843 recognizes that religious bodies may process their own congregants' data as part of their religious activities.

7. AI Processing

Kingdom Vitals uses artificial intelligence to power certain features, including an SMS/chat assistant that can answer member questions (looking up things like giving history, upcoming events, or ministry information on request) and automatic classification of prayer request content. To do this, relevant data — which may include a message's content, a member's phone number, or matched profile details — is sent to one of our third-party AI providers (which may include Anthropic, OpenAI, Google, Cohere, or DeepSeek, depending on the feature). These providers process this data under contract with us and do not use it to train their own models on our customers' behalf beyond what is necessary to provide the requested response.

8. Who We Share Information With

We do not sell personal data. We share it only with service providers who help us run Kingdom Vitals, each bound by confidentiality and data-protection obligations:

• Paystack — to process payments and subscriptions.
• TextTango — to deliver SMS messages.
• AI providers (Anthropic, OpenAI, Google, Cohere, DeepSeek) — as described in Section 7.
• Email delivery providers — to send transactional and account emails.
• Cloud infrastructure and storage providers — to host the platform and store uploaded files securely.

We may also disclose information where required by law, to protect our rights, or to investigate fraud or security incidents.

9. Cookies

Our website shows a cookie notice on your first visit. If you click "Accept", we load Google Analytics to help us understand how visitors use our website; if you click "Decline", or take no action, analytics cookies are not loaded. You can clear your browser's local storage at any time to reset this choice and be asked again.

10. Data Retention

We keep Church and Church Member data for as long as a Church's account is active, so the platform can function as intended. If a Church closes its account, we retain its data for a reasonable period afterward to meet accounting, legal, and dispute-resolution needs, after which it is deleted or anonymized. A Church may request earlier deletion of its data by contacting us; we will act on such requests except where retention is required by law.

11. Data Security

Each Church's data is stored in its own isolated database, separate from every other Church on Kingdom Vitals. Data is encrypted in transit, access to production systems is restricted, and payment data is tokenized rather than stored in raw form (Section 4). No method of storage or transmission is completely secure, and we cannot guarantee absolute security, but we take reasonable, industry-standard steps to protect the data entrusted to us.

12. Cross-Border Data Transfers

Some of our service providers — including our AI providers and cloud infrastructure — may process data outside Ghana. Where this happens, we take steps to ensure the destination provides an adequate level of protection for personal data, as required by Act 843, including relying on contractual protections with those providers.

13. Children's Data

Kingdom Vitals allows Churches to record information about children in their children's ministry, including emergency contacts and medical information, to help keep children safe during church activities. This information is entered by the Church, not by children themselves. It is the Church's responsibility, as Data Controller, to obtain appropriate consent from a parent or guardian before entering a child's information into the platform. We process this information only on the Church's instructions.

14. Your Rights Under Ghana's Data Protection Act, 2012 (Act 843)

Subject to some exceptions, you have the right to:

• Access — ask whether we (or a Church) hold your personal data, and get a copy of it.
• Correction — ask for inaccurate, incomplete, or misleading data to be corrected.
• Object — object to processing that causes you unwarranted harm or distress; you have an absolute right to opt out of direct marketing at any time.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Request deletion — while Act 843 does not yet establish a formal right to erasure, we will honor reasonable deletion requests where we're able to.

Church Members: please contact your Church first, as they control your record — we support them in responding within the timeframes Act 843 requires. Church administrators and website visitors can contact us directly using the details in Section 17.

15. Complaints

If you're not satisfied with how we or a Church have handled your personal data, you have the right to lodge a complaint with Ghana's Data Protection Commission.

16. Changes to This Policy

We may update this policy from time to time. We will update the "Last updated" date above when we do, and for material changes we will make reasonable efforts to notify Church administrators directly.

17. Contact Us

Questions about this policy or your data? Reach us at:

• Email: hello@kingdomvitals.app
• Support: support@kingdomvitals.app
• Phone: +233 50 922 8314 / +233 24 959 4564
• Address: Accra, Ghana