Privacy.

What we hold

• About the person who subscribes: the email address and name on his sign-in account, and the unit he subscribed for.
• About billing: a Stripe customer and subscription reference, the plan, the status and the renewal date. Not a card number — that is held by Stripe, on Stripe's own payment page.
• About a unit's members: whatever the unit enters — names, contact details, membership records, service hours, photographs. That is the unit's record keeping, held on its behalf.
• About someone asking for an import quote: the name, email, optional phone number, council and old site address he sends us — kept to answer him and to quote the work, and deleted on request.
• About visitors: ordinary server logs, and a prayer-intention visitor identifier stored in the visitor's own browser so a returning visitor sees which intentions he already marked. No advertising trackers and no third-party analytics on the storefront.

Who can see a unit's data

Access is a four-step ladder — public, member, officer, admin — enforced on the server for every request rather than by hiding things in the page. A unit's records are scoped to that unit at the database level: one council cannot read another's, including by editing a web address.

Platform operators can reach a unit's data in order to run and support the service, and those actions are logged.

Artificial intelligence

Nothing containing member information is sent to a commercial AI service. Meeting audio is transcribed and text is drafted on hardware we operate ourselves. Prayer intentions reach the drafting model with the submitter's name removed. The single exception anywhere in the platform is illustration image generation, which is given no member information at all.

Your unit's content is never used to train a model, ours or anyone else's.

Who else is involved

• Stripe — payment processing and the billing portal.
• Our identity provider — sign-in, so we never hold a password.
• An email relay — to deliver mail a unit sends and mail about billing.
• YouTube and Vimeo — only if a unit embeds a video, and only for the visitor who plays it.

We do not sell personal information to anyone, for any purpose.

How long we keep it

While a unit subscribes, and for 3 months after the subscription ends, so that a unit cancelling during a leadership change does not lose its records. After that it may be deleted. Billing records are kept as long as accounting requires.

Asking us about your own information

If you are a member of a unit here, the unit holds that record — ask an officer first; they can edit or remove it directly. If you cannot get an answer that way, write to us from the contact page and we will help. We will tell you what we hold and remove what we are able to remove.

What we are not claiming

Knightly Sites has no privacy certification, no completed external audit, and no formal data processing agreement on offer today. If your unit needs one of those, say so before you subscribe rather than after.