Privacy Notice

1. Who is responsible

FlockHarbor is operated by Orkora Technologies Limited (RC 9697234), 3 Olayinka Street, off Quarry Road, Ibara, Abeokuta, Ogun State, Nigeria. For the information a church enters about its own people, the church is the data controller and we are its processor: we act on the church's instructions. For the information we hold about the church itself and its staff accounts, we are the controller. We follow the Nigeria Data Protection Act 2023.

2. What we hold

• Church and staff accounts: church name, address and contact details, staff names, email addresses, roles, sign-in times and a log of changes made in the workspace.
• Members and guests, entered by the church: names, phone numbers, email addresses, home addresses, dates of birth, family links, membership status, attendance, small-group and volunteer records, giving and pledge records.
• Welcome and check-in forms: what a guest or member types into a church's public welcome form or check-in page, including a prayer request if they leave one.
• Pastoral care: care requests and notes, which the church restricts to named roles through confidentiality tiers.
• Billing: the plan a church is on and its payment history. Card details are entered on Paystack's pages and never reach our servers.

3. Why we use it

To run the service the church has asked for: keeping its records, sending the emails and messages the church chooses to send (welcome notes, receipts, birthday greetings, announcements, portal invitations, password resets), showing the church's public page in its own brand, enforcing plan limits, and keeping an audit trail of changes. We do not sell personal information, use it for advertising, or build profiles across churches.

4. Who else sees it

We use a small number of service providers to run FlockHarbor. Each receives only what its job needs:

• Vercel, which hosts the application and stores uploaded logos and cover photos.
• Neon, which hosts the database.
• Resend, which delivers email on the church's behalf.
• Termii, which delivers SMS where a church has enabled it.
• Paystack, which processes card payments: a church's own account for online giving, and ours for plan fees.

Some of these providers store data outside Nigeria. We choose providers with recognised security practices and contractual commitments to protect personal information. We disclose information to no one else unless the law requires it.

5. How we protect it

• Every workspace is isolated: a church's staff can only ever see that church's records.
• Access inside a church is role-based; care records carry confidentiality tiers the church sets.
• Connections are encrypted in transit; payment keys are encrypted at rest.
• Passwords are stored only as salted hashes.
• Changes to records are written to an audit log the church's administrators can review.

6. How long we keep it

For as long as the church's workspace is open. When a church closes its workspace and asks us in writing, we delete its data within 30 days, except billing records we must keep under Nigerian tax law. Backups roll off within a further 30 days.

7. Your rights

If a church holds information about you, you can ask it to show you what it has, correct it, or remove it, and to stop contacting you. Members with portal access can see their own profile and giving history at any time. If you would rather raise it with us, or you are a church staff member asking about your own account, write to support@flockharbor.com and we will respond within 30 days. You may also complain to the Nigeria Data Protection Commission.

8. Children

Children's check-ins are recorded by the church with a parent or guardian present, and a pick-up code is shown once to that guardian. We do not collect information from children directly.

9. Cookies

FlockHarbor sets only the cookies needed to keep you signed in securely; the session expires after 24 hours. We do not use advertising or tracking cookies.

10. Changes and contact

We will post any change to this notice here and update the date at the top; material changes are also sent to church administrators. Questions about privacy: support@flockharbor.com. See also our terms of service.