Privacy
What we collect, why, who sees it, and what you can make us do about it. Last updated 15 August 2026.
The short version
- We sell nothing and share nothing for advertising. There is no advertising on Foldmetric and no data broker in this document.
- There are no analytics, no tag managers and no third-party scripts on any page. Fonts are served from our own servers, so loading Foldmetric does not tell anyone else that you did.
- One cookie, and it exists to keep an administrator signed in.
- The check-in page never lists your congregation. It can confirm that a number belongs to a member; it cannot be asked who the members are.
- Your data is yours. You can export it at any time on every plan, including the free one, and deleting your church deletes it.
Who is responsible for what
This is the most important part of this policy, and it decides who you go to about your own information.
For a church administrator’s own account — the name, email address and password used to sign in to Foldmetric — we are the controller. We decide what is collected and why, and you exercise the rights below against us.
For a congregation’s records — the members in a church’s directory and their attendance — the church is the controller and we are its processor. The church decides who goes in its directory, what it is for, and how long to keep it. We hold and process that information on the church’s written instructions and for no purpose of our own.
So if you are a member of a congregation and want to know what is held about you, corrected, or erased, ask your church. They can act on it themselves inside Foldmetric, immediately. If you cannot reach them, write to us at privacy@foldmetric.com and we will put you in touch and, where the law requires it, act ourselves.
What we hold
About a church and its administrators
- Church — name, the subdomain you chose, country, city, time zone, service times, and a logo if you upload one.
- Administrator — name, email address, the role you picked from a list, and a password. Passwords are handled by Google Firebase Authentication; we never see or store one.
- Invitations — the email address and role of anyone you invite to help administer the church, until the invitation is accepted or revoked.
- Billing — your plan, the currency you are quoted in, and a record of payments. Card details are never sent to us or stored by us; they go directly to the payment provider.
About a congregation
- Directory — each member’s name, and a phone number or an email address (at least one, because that is how check-in recognises them), plus the date they were added and whether they were added by the office or registered themselves.
- Attendance — that a named member checked in, on which date, to which service, and at what time.
We do not ask for and have no field for dates of birth, addresses, giving, family relationships, photographs, or any of the special categories of data the GDPR protects — including, deliberately, religious belief. Foldmetric records that somebody was in a building. A church may of course infer more from that, which is one reason the church and not Foldmetric is the controller of it.
Technical
- Session cookie — one cookie named
fold_church, set only after an administrator signs in. It records which church the session belongs to, is signed so it cannot be forged, is unreadable by JavaScript, and expires after seven days. It is strictly necessary for signing in, so no consent banner asks you about it. We set no other cookies. - Abuse counters — to stop somebody testing thousands of phone numbers against a check-in page, we count failed attempts per connection. The IP address is hashed and never stored: it is put through a keyed hash and only the result is kept, so the counter cannot be turned back into an address or a person.
- Server logs — our hosting provider keeps ordinary request logs, which can include IP addresses, for a short period for security and reliability.
Why we hold it, and on what legal basis
| What | Why | GDPR basis |
|---|---|---|
| Administrator account | To give you an account and let you sign in to it | Performance of a contract |
| Church and service details | To run your check-in page and produce your reports | Performance of a contract |
| Billing records | To take payment and to keep accounts | Contract, and legal obligation |
| Abuse counters | To keep a congregation’s details from being probed | Legitimate interests (security) |
| Directory and attendance | Whatever the church collected it for | The church’s to determine, not ours |
Who else touches it
These are our sub-processors. We do not add one without updating this list.
- Google Firebase (Firestore, Authentication) — stores everything above and handles passwords. Hosted in [REGION — confirm the Firestore location and name it here].
- [HOSTING PROVIDER] — serves the site and keeps request logs.
When card payments go live, the provider taking them — Paystack for churches in Africa and Stripe elsewhere — will receive the billing contact and payment details directly. We will update this policy before that happens, not after.
We have never sold personal information, and we do not share it for cross-context behavioural advertising. We would have to change this policy and tell you before that could change.
Where it goes
Foldmetric serves churches in about twenty countries, so data may be processed outside the country you are in, including outside the UK, the EEA and Nigeria. Where personal data covered by the UK GDPR or EU GDPR leaves those areas, we rely on the European Commission’s Standard Contractual Clauses, and the UK Addendum where the UK GDPR applies. [CONFIRM: SCCs executed with each sub-processor, and a transfer risk assessment on file.]
How long we keep it
- While your church is on Foldmetric — the directory and the attendance record are kept until you delete them. Attendance is the product: a record that quietly deleted itself after a year would make the absence list wrong, so we do not expire it on our own initiative.
- When you delete a member — the record goes immediately.
- When you close your church — everything under it is deleted within [30 days — confirm], except records we are required to keep for tax and accounting, which are invoices and nothing else.
- Abuse counters expire on their own within days.
Your rights under the GDPR
If you are in the UK or the EEA you have the right to be told what we hold, to get a copy of it, to have it corrected, to have it erased, to restrict or object to how we use it, and to have it handed to you in a portable format. Where we rely on legitimate interests you may object, and we will stop unless we have compelling grounds not to.
We do not make automated decisions with legal or similarly significant effects about anybody. The absence list is a list; a person decides what to do about it.
Write to privacy@foldmetric.com. We answer within one month. You can also complain to your supervisory authority — in the UK, the Information Commissioner’s Office — though we would rather you gave us the chance to fix it first.
[IF SELLING INTO THE EEA OR UK WITHOUT AN ESTABLISHMENT THERE: appoint an Article 27 representative and name them here.]
Your rights under the CCPA/CPRA
If you are a California resident you have the right to know what personal information we have collected and why, to a copy of it, to have it deleted, to have inaccuracies corrected, and to limit the use of sensitive personal information. You also have the right not to be discriminated against for exercising any of them — and you will not be: nothing on Foldmetric gets worse because you asked.
In the twelve months before this policy was last updated we collected the categories described under What we hold: identifiers (name, email address, phone number), commercial information (your plan and payments), and internet activity limited to the abuse counters and server logs described above. We collected them for the purposes in the table above, from you or from the church that entered them.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, including for anyone under 16. There is therefore no “Do Not Sell or Share My Personal Information” link on this site, because there is nothing for it to switch off.
To exercise any of these, write to privacy@foldmetric.com. We will verify that the request is really yours — usually by replying to the address already on the account — and answer within 45 days. An authorised agent may act for you with written proof.
Children
Foldmetric is sold to churches, not to children, and an administrator account is for an adult. A church may well have children in its directory. That is the church’s decision as controller, and its responsibility to have a lawful basis and, where the law requires it, parental consent. We do not knowingly collect information directly from a child.
Security
Everything travels over TLS. The directory is never readable from a browser — the public check-in page can confirm a number belongs to a member without being able to list the congregation, and failed lookups are throttled. Session cookies are signed and unreadable by JavaScript. Each church’s records are stored beneath that church, so no query exists that could return another congregation’s data.
If a breach affects your data we will tell the relevant supervisory authority within 72 hours where required, and tell you without undue delay where the risk to you is high.
Changes
If we change this in a way that matters, we will say so on this page and email account administrators before it takes effect.
Contact
[LEGAL ENTITY NAME], [REGISTERED ADDRESS].
privacy@foldmetric.com
[DATA PROTECTION OFFICER, if one is required or appointed]
Churches needing a data processing agreement for their own records can request one at the same address.