1. Who this policy covers
This Privacy Policy explains how My12 handles personal data when churches and leaders use the platform, visit the website, create an account, contact support, connect integrations, or use billing features.
My12 is provided by QUANTUMLIFT LTD, registered in Scotland, company SC861074, at 3/1 226 Moncur Street, Glasgow, Scotland, G40 2SQ, United Kingdom. Contact security@my12.app for privacy questions.
2. Controller and processor roles
- For church care data entered, imported, or synced by a customer, the church is usually the data controller and My12 is the data processor.
- For My12 account administration, billing, website analytics, product security, and support communications, My12 may act as an independent controller.
- The Data Processing Agreement explains processor obligations for customer-controlled church data.
3. Data we process
- Account data: name, email, login provider, role, organisation, campus, and access settings.
- Church data: people, leaders, groups, campuses, attendance, contact details, birthdays, gender, tags, prayers, praise reports, cares, notes, feedback, alerts, moments, and reports.
- Integration data: Planning Center identifiers, imported records, sync metadata, and connection tokens.
- Billing data: subscription status, plan, customer identifiers, invoices, payment status, and Stripe checkout/portal metadata.
- Technical data: device/browser information, security logs, App Check signals, timestamps, error logs, and notification device tokens.
4. Purposes
- Provide, secure, maintain, and improve My12.
- Allow churches to manage care, attendance, groups, campuses, leaders, feedback, and reporting.
- Authenticate users and enforce permissions.
- Process subscriptions, billing, trials, and payment recovery.
- Send service notifications, reminders, verification emails, password reset emails, and support replies.
- Analyse care alerts, feedback, and leadership reports where AI-assisted features are enabled or used.
Optional public website analytics
If you allow website analytics, My12 uses Google Analytics to understand public page visits and clicks towards pricing and trial registration. The public website does not load the Google Analytics tag until you choose Allow analytics. You can change that choice through Analytics preferences in the website footer.
The public website strips query strings and fragments from the page URLs and referrer URLs it supplies to Analytics. These website events do not include pastoral records, names, email addresses or church member information. Google Signals and advertising personalisation are disabled in the website tag configuration.
5. Lawful basis and special category data
Where My12 acts as processor, the customer is responsible for determining its lawful basis and any special category condition. Church membership, pastoral care, religious affiliation, health, safeguarding, or prayer information may be sensitive or special category data.
Where My12 acts as controller, we normally rely on contract, legitimate interests, legal obligation, or consent where required.
6. Sharing and sub-processors
We share personal data only where needed to provide the service, comply with law, protect security, process payment, provide support, or use customer-authorised integrations.
Current sub-processors are listed at /subprocessors.
Optional Google Gemini processing
Before you share data with Google Gemini, My12 asks for separate permission. Depending on the feature, the data can include your submitted audio or transcript, prayer or care text, relevant names and group context, and excerpts from organisational knowledge you are authorised to use. Gemini processes this information to prepare suggestions, classify or summarise it, or answer a question. Permission to use the microphone and an organisation enabling AI are separate from this sharing choice.
You can decline and continue entering and saving records manually. In supported versions, change your choice in Settings → Account → AI data sharing. Withdrawing permission stops future AI sharing covered by that choice; it does not recall a request already sent. Shared reports may be unavailable when the required contributors have not permitted AI processing. Organisational authority and a lawful basis for information about other people are still required.
Google processes requests under the terms applicable to our API account. Do not assume that provider retention is zero or that all uses exclude training; those conditions depend on the provider service and account terms. Avoid unnecessary sensitive detail and review AI output before saving or relying on it.
Apple identity and invitation verification
Where Sign in with Apple is enabled, My12 verifies the Apple identity and separately checks your organisation access. At first linking, a one-time code proves ownership of your invited My12 email address and you explicitly agree to link the identities. Hide My Email does not reveal your original address to My12. Brevo delivers the verification email. Apple tokens needed for revocation are encrypted on the server; they are not placed in browser storage.
A revoked or deleted identity can leave a minimal security mapping to prevent a prior login silently restoring a deleted account. Contact support if you deliberately need to rejoin after deletion.
Local records and device backups
The Leaders App can keep downloaded records and unsent changes on your device. Updated iOS versions encrypt these records with device-only Keychain keys, apply iOS file protection and exclude this offline vault from device backups. Downloaded snapshots expire after seven days without refresh. Pending unsent changes remain encrypted until synchronised or explicitly erased, so they are not silently lost at expiry.
Signing out or switching accounts removes downloaded snapshots; a pending queue can be recovered only by the same account on that device. Deleting the account clears its local records after server deletion completes. Protection depends on the installed version: update older versions so their legacy offline files can be migrated. A lost or erased device cannot restore this vault from a backup.
Deleting your My12 account
Use Settings → Account → Delete account in supported versions. My12 verifies your identity before beginning deletion, revokes access, and removes your personal workspace, profile, avatar, device registrations and authentication account. A retryable deletion job completes server cleanup if a temporary failure occurs. The app shows progress instead of reporting a partial cleanup as complete.
Organisation owners can transfer ownership to another active leader or explicitly close their organisation before deleting their login. Closure suspends organisation access and stops subscription renewal; shared records remain controlled by the organisation and are handled separately under the Data Processing Agreement. Deleting an individual login does not erase other people’s church records or remove a statutory record-retention duty.
A minimal deletion security record is retained to prevent a deleted UID from silently recreating its account. It contains the UID, status, a hash of the progress receipt and timestamps, rather than pastoral content. Necessary tax, billing, dispute or security records and provider backups can remain subject to their applicable retention arrangements. A hash of a verified email address and a timestamp are also retained to suppress restoration of a deleted Brevo contact; neither the plaintext address nor pastoral content is stored in that suppression record. Deliberately rejoining and restoring communications currently requires support to verify and remove the suppression. Contact security@my12.app about a specific retained record.
7. Retention
- Active organisation data is normally kept while the account is active.
- Deleted organisation data is normally soft-deleted for a short recovery period and then permanently deleted or anonymised, subject to backups and legal requirements.
- Detailed attendance, care, prayer, feedback, and pastoral records should be kept only as long as the customer needs them for church care and accountability. Organisation admins can configure retention settings for these records in My12.
- Billing and tax records may be kept for longer where required by law.
- Planning Center tokens are removed when the integration is disconnected or the organisation is deleted.
8. Your rights
Individuals may have rights to access, correct, delete, restrict, object to, or receive a copy of their personal data. For church care data, requests should normally go to the church customer first because the church controls that data.
You can also contact My12 at security@my12.app.
9. Security
My12 uses technical and organisational measures such as authentication, permission rules, App Check, encryption in transit, managed cloud infrastructure, role-based access controls, and production deployment controls.
10. International transfers
Some service providers may process data outside the United Kingdom or European Economic Area. Where required, My12 relies on appropriate safeguards such as adequacy regulations, standard contractual clauses, or provider data protection terms.
11. Children and vulnerable people
Customers must use appropriate care when storing information about children, youth, vulnerable adults, safeguarding, or pastoral crises. My12 should not be used as the only safeguarding record or emergency response system.
12. Complaints
Privacy questions can be sent to security@my12.app. If you are in the UK, you may also contact the Information Commissioner's Office.