Privacy Policy

Last updated: 14 August 2026

PrayerForm ("we", "us", "our") provides prayer week registration and event-management tools for churches at prayerform.app and church subdomains such as your-church.prayerform.app.

This Privacy Policy explains how PrayerForm handles personal information. It is written for two audiences:

• If you registered for a prayer hour: you signed up on a page run for a church. That church will see your name, email address, and selected hours. This policy explains what PrayerForm does with that information as the church's service provider, and what the church can do with it.
• If you are a church administrator: this policy explains PrayerForm's practices as your platform provider, including the tools you use to manage events and registrations.

Who is responsible. Each church is the controller of the registration information for its own events. The church decides the event, who may register, and how long those records are kept. PrayerForm is a processor of that church-held registration data: we operate the platform on the church's instructions. PrayerForm is the controller of platform-account, security, and service-operation data (for example, church administrator accounts and anti-abuse records).

1. What we collect

From people registering for a prayer hour

When you register for a prayer hour through PrayerForm, we collect:

• Your name
• Your email address
• The prayer hours you select
• The church and prayer event you register for

We do not provide a free-text notes field as part of the registration process.

From church administrators

When a church administrator creates and manages a PrayerForm account, we collect:

• Email address
• Name, Google account identifiers, and profile photo URL when the administrator signs in with Google
• Church name
• Timezone
• Confirmation email settings
• Prayer event details, such as event names, dates, and available prayer hours

Automatically collected information

We may automatically collect limited technical information when you use PrayerForm, including:

• IP address
• Browser and device information
• Information about interactions with our registration forms
• Page URLs (including the church subdomain), referrer, and browser/device information used to understand how PrayerForm is used
• Email address in short-lived anti-abuse records (for example, to limit verification-code requests)
• IP address and technical data in infrastructure security logs, retained for as long as those hosting providers keep security logs

This information is used primarily for security, spam and abuse prevention, reliable operation of the service, and (for page URLs and related telemetry) product usage measurement. These copies are not kept for profiling or advertising.

PrayerForm does not use advertising cookies or advertising/marketing tracking pixels on church registration pages (subdomains). Our own marketing site at prayerform.app and the authenticated church-admin dashboard use Google Ads conversion tracking, described in sections 4 and 10.

2. How we use your information

We use personal information to:

• Process and manage prayer hour registrations
• Allow churches to manage their prayer events and see registrations for their own events
• Send registration confirmations and reminders
• Allow you to change the prayer hours you selected
• Provide and maintain PrayerForm
• Protect PrayerForm from spam, fraud, and abuse
• Maintain the security and reliability of the service
• Respond to requests, questions, and support enquiries
• Comply with legal obligations
• Understand service usage in aggregate or de-identified form to improve PrayerForm; we never use registration information to market to congregation members or to build advertising profiles

We do not sell personal information.

We do not use registration information for advertising or targeted marketing, and we do not use it to create advertising profiles.

Registration for a prayer event may reveal information about a person's religious or philosophical beliefs. That information is processed only to run the church's event, on the church's instructions. The church is responsible for a lawful basis for that processing, including any special-category condition that applies. PrayerForm does not use this information to infer or profile a person's beliefs beyond what is necessary to provide the service. PrayerForm's own processing of administrator accounts, security, and service-operation data is for the platform purposes listed above.

3. Who can see your information

When you register for a prayer event, the church running that event may be able to see your:

• Name
• Email address
• Selected prayer hour(s)

Church administrators can also download that registration information (including registration timestamps) as a CSV file, and can invite additional administrators. Confirmation and reminder emails use the church's display name. Copies the church exports, forwards, or receives by email reply are held under the church's own practices. PrayerForm does not control those copies, and deleting a registration in PrayerForm does not remove them.

Church administrators only have access to registration information for events associated with their church account.

We use technical and organisational measures designed to prevent one church from accessing another church's registration data.

Authorised PrayerForm operators can access registration data across churches as needed to operate, secure, and support the service, under access controls. This is separate from church-to-church isolation.

We do not sell personal information or share it with third parties for advertising or marketing purposes.

We may disclose information to service providers that help us operate PrayerForm, or where disclosure is required or permitted by law.

4. Service providers

We use a small number of trusted service providers to operate PrayerForm. Except as noted for Google reCAPTCHA below, these providers process information only as necessary to provide their services to us.

Google reCAPTCHA is provided by Google. Google may process IP address, device information, cookies, and interaction data under Google's Privacy Policy as an independent controller. Visiting a church registration page can indicate a religious affiliation to Google.

Google Ads conversion tracking runs on our marketing site at prayerform.app and on the authenticated church-admin dashboard to measure church signups. It is not loaded on public congregation registration pages (church subdomains). Google may process IP address, device information, cookies, and interaction data under Google's Privacy Policy as an independent controller.

When we add or replace a service provider that receives personal information, we will update this policy first and, for material changes, notify churches before the new provider processes their data.

5. Data retention

PrayerForm retains registration information for as long as the relevant church keeps the event or registration records in its account.

Church administrators can delete registration data or events from their dashboard. When a church deletes registration data, it is removed from our active systems. Copies may remain in encrypted backups until those backups are overwritten.

PrayerForm operators can deactivate a church, which hides it from public use but does not delete registration or event records. Church administrators remove data by deleting registrations or events in the dashboard. To request deletion of a church account and its remaining records, contact support@prayerform.app.

6. Your privacy rights and choices

Depending on where you live, you may have rights relating to the personal information we hold about you, including the right to:

• Request access to your personal information
• Ask us to correct inaccurate or incomplete information
• Request deletion of your personal information
• Withdraw consent where processing is based on consent
• Object to or request restrictions on certain processing
• Request a copy of your information in a portable format where applicable
• Complain to your local privacy or data protection authority

If you registered for a prayer hour, you can change your selected hours by opening the event's update page and requesting a verification code emailed to you. That flow does not delete your name or email. A church administrator can delete a registration from their dashboard. Deleting a registration in PrayerForm does not remove copies the church has already downloaded or forwarded.

To make a privacy request about platform-held information, contact us at support@prayerform.app. For registration information held for a church event, you may also contact the church running that event.

We may need to verify your identity before fulfilling certain requests.

7. Children's data

PrayerForm is not specifically directed at children.

Churches may choose to make prayer events available to people of different ages. Where children use PrayerForm, we expect the church running the event to determine whether parental or guardian involvement or consent is required under applicable law.

PrayerForm does not knowingly use children's personal information for advertising or profiling.

8. Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

These measures include, where appropriate:

• Encryption of information in transit
• Encryption and security controls provided by our infrastructure providers
• Access controls and authentication
• Separation of each church's registration data
• Monitoring and protections against spam and abuse
• Secure backups and recovery procedures

No internet-based service can be guaranteed to be completely secure. While we work to protect your information, we cannot guarantee absolute security.

If we become aware of a privacy or security breach, we will investigate and contain it promptly. Where New Zealand law requires, we will notify the Privacy Commissioner and affected people as soon as practicable. Where GDPR or UK GDPR applies, we will notify the relevant authority without undue delay and within 72 hours of becoming aware unless the breach is unlikely to risk people's rights, and we will notify affected people when required.

9. International processing

PrayerForm is based in New Zealand and may be used by churches and congregation members in other countries.

Our service providers may process personal information in New Zealand, Australia, the United States, and other countries depending on the provider and the services being used. This includes registration information that can reveal religious belief.

Where personal information is transferred or processed outside your country:

• For EU and UK users, transfers rely on the EU-US or UK-US Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable).
• For New Zealand users, overseas disclosures follow comparable-protection steps under the Privacy Act.

10. Cookies and similar technologies

PrayerForm does not use advertising cookies or third-party advertising trackers on church registration pages (subdomains).

The marketing site at prayerform.app and the authenticated church-admin dashboard use a Google Ads tag and cookie for conversion measurement (see section 4). This tag is not loaded on public congregation registration pages (church subdomains).

We may use essential cookies or similar technologies where necessary to:

• Keep you signed in
• Maintain security
• Support the operation of the service
• Remember necessary settings

Google reCAPTCHA may also use its own cookies and similar technologies. Google may process that data under Google's Privacy Policy as described in section 4.

11. Changes to this policy

We may update this Privacy Policy as PrayerForm develops or our data practices change.

When we make changes, we will update the Last updated date at the top of this page. We will email church administrators and post a prominent notice before any change that introduces advertising or sale of data, adds a new category of personal information, changes who is the controller, or adds a service provider that receives personal information.

12. Contact us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a concern about how your information is handled, contact us:

Email: support@prayerform.app

PrayerForm
New Zealand