Church Data Processing Terms

These are the Data Processing Terms for Churches. They are the Article 28 contract between a church and The Doxa Way Ltd for the church’s board on Doxa.

A church accepts these terms when its leader sets up a church, ministry, nonprofit or church network on the Doxa web app and ticks “I accept the Church Data Processing Terms on behalf of my church”. A church whose board was made another way (before these terms, in the mobile app, or by someone setting it up for the leader) accepts them from the notice on its board in the web app. Doxa records the version, the time and the person who accepted.

Published text: https://doxa.app/for-churches/data-processing-terms . Doxa keeps every version, and sends any earlier version on request. A church that wants a signed copy can ask privacy@doxa.app.

Version 2.0 replaces version 1.0 (2026-10-07), a template that a church had to ask for by email. The commitments are the same in substance. The changes: a church accepts in the product; Schedule 1 lists the sub-processors for Board Data with their safeguards and contract status; section 9 says what happens to a member’s words when a board or an account is deleted. Version 2.1 (2026-10-08) records that the PostHog, Sentry and Vercel agreements are in place, and says in section 8 how major and minor versions differ. No church had accepted version 2.0 when version 2.1 replaced it. Version 2.2 (2026-10-08) adds section 3.10: a church can switch off all AI processing of its board. It only adds protection, so a church’s acceptance of version 2.0 or 2.1 covers it (section 8.2).

1. Parties and roles

The person who accepts these terms confirms that they have authority to accept them for the church.

1.1 Who controls what

This split follows Doxa’s record of processing activities and its data protection impact assessment (DPIA).

2. Subject matter, duration, nature and purpose (Article 28(3))

3. Doxa’s obligations as processor

3.1 Instructions (Article 28(3)(a))

1. Doxa processes Board Data only on the church’s documented instructions. These terms, the features of the board, and the settings and actions of the church’s leaders are those instructions.
2. If the law of the United Kingdom requires Doxa to process Board Data in another way, Doxa tells the church first, unless that law forbids it.
3. Doxa tells the church at once if, in Doxa’s opinion, an instruction breaks data protection law.
4. Doxa does not use Board Data for its own purposes. Doxa does not use it for advertising, does not sell it, and does not let any sub-processor use it to train AI models.

3.2 Confidentiality (Article 28(3)(b))

Only people who need access to run the service can reach Board Data. Each of them is bound by a duty of confidentiality. Doxa reads Board Data only when the church asks for help, when it must fix a fault, or when the law requires it.

3.3 Security (Article 28(3)(c) and Article 32)

Doxa applies the technical and organisational measures in Schedule 2. Doxa can change them, but it does not reduce the overall level of protection.

3.4 Sub-processors (Article 28(2) and (4))

1. The church gives Doxa general written authorisation to use sub-processors.
2. Schedule 1 is the list of sub-processors that can receive Board Data, with what each does, where, and the transfer safeguard. Section 6 of the Doxa privacy policy (doxa.app/privacy) lists every provider Doxa uses for any purpose.
3. Change notice. Before Doxa adds a sub-processor to Schedule 1, or replaces one, Doxa updates Schedule 1 and tells the church by email to the board’s owner at least 30 days in advance. In an emergency (for example, to keep the service secure) the notice can be shorter, and Doxa says why.
4. Objection. The church can object in writing, on reasonable data protection grounds, within the notice period. Doxa then works with the church in good faith to find a solution. If there is none, the church can end these terms and stop using the board. The Doxa Terms of Service apply to any fees.
5. Doxa binds each sub-processor by a written contract with data protection obligations that are no less protective than these terms. Where that contract is not complete on the date of a version of these terms, Schedule 1 says so, and Doxa completes it. Doxa remains fully liable to the church for each sub-processor’s performance.

3.5 Help with data subject rights (Article 28(3)(e))

1. If a person asks Doxa to use a data protection right over Board Data, Doxa sends the request to the church within 5 working days and does not answer it alone, unless the church asks Doxa to.
2. Doxa helps the church to answer requests. Leaders can see, move and remove words on the board, and manage roles and invitations. For anything the board cannot do (for example, a copy of the Board Data about one person), Doxa helps on request to privacy@doxa.app within the time the church needs to meet the one-month limit.

3.6 Help with security, breaches, DPIAs and the ICO (Article 28(3)(f))

Doxa helps the church to meet its obligations under Articles 32 to 36, as far as the nature of the processing and the information available to Doxa allow. This includes the information the church needs for its own DPIA and for any prior consultation with the Information Commissioner’s Office (ICO). Doxa has its own DPIA for this processing and gives the church a summary on request.

3.7 Personal data breaches

1. Doxa tells the church without undue delay, and in any case within 48 hours, after Doxa becomes aware of a personal data breach that affects Board Data.
2. The notice goes to the board’s owner by email, and to any other address the church gives to privacy@doxa.app for this purpose. It states what Doxa knows of the items in Article 33(3): the nature of the breach, the categories and approximate number of people and records, the likely consequences, and the measures taken or proposed. Doxa sends more information as it learns it.
3. Doxa takes reasonable steps to contain the breach and reduce its harm. Doxa follows a written breach procedure.
4. The church decides whether to notify the ICO and the people affected about Board Data. Doxa does not notify them in the church’s name unless the church asks or the law requires it.

3.8 Deletion or return at the end (Article 28(3)(g))

See section 9.

3.9 Information and audits (Article 28(3)(h))

1. Doxa gives the church the information it reasonably needs to show that both parties meet Article 28. This includes Doxa’s sub-processor register, the relevant parts of its record of processing activities, and the security certifications (for example SOC 2 Type II or ISO 27001) of its main sub-processors.
2. Doxa answers a reasonable written security or privacy questionnaire once a year.
3. If that information is not enough, the church (or an independent auditor it appoints, bound by confidentiality) can audit Doxa’s compliance with these terms. The church gives at least 30 days’ notice, an audit takes place no more than once in 12 months, it is done remotely where possible, and it must not put other customers’ data at risk. The church pays its own costs. The limit of once in 12 months does not apply after a breach that affects Board Data, or when a supervisory authority requires the audit.

3.10 Switching off AI features

1. A leader or the owner of the board can switch off AI features on the board’s Manage page in the web app. Doxa records who made each change and when.
2. While AI features are off, Doxa does not send Board Data to an AI provider (OpenAI, Anthropic, ElevenLabs, AssemblyAI, Deepgram or any other). This means:
   • no search embeddings, Related prophecies, Themes or Doxa Engage for the board;
   • no AI draft of a Held prophecy: the church’s leaders write the wording;
   • no automatic transcription of voice recorded for the board: the member who records it can type what was said;
   • no AI titles or Scripture suggestions for words recorded on the board;
   • the safety check on shared text and comments uses pattern checks only (for example, for phone numbers and email addresses), without an AI service.
3. Doxa enforces this on its servers, not only in the apps. The server functions for search embeddings, Related prophecies, Themes, Doxa Engage and drafts of a Held prophecy read the setting first, and refuse if they cannot read it. For transcription, titles, Scripture suggestions, reminders and the safety check, the app names the board in each request, and the server then refuses or uses the non-AI check. The database also refuses to store new search embeddings or Themes for the board.
4. When the church switches AI features off, Doxa deletes at once the AI-derived data of the board: the search embeddings of its words, its saved Themes, and the search-index entries of words recorded on the board. The words, notes, comments and held wording stay. Copies in backups expire as section 9.3 says.
5. A word that a member brought from their own Encouragement Vault stays the member’s own record (section 6). The setting stops the board’s processing of that word. It does not change the AI features that the member uses for their own records. A recording that a member makes in their own Encouragement Vault, and brings to the board later, was processed as the member’s own record before it reached the board.
6. If the church switches AI features on again, Doxa makes search embeddings again for up to 50 of the newest words on the board, and for every word recorded after that, so Related prophecies and Themes work again for them. Deleted Themes do not come back.
7. The Doxa mobile app applies the setting from the first app release after 8 October 2026. An earlier app version does not name the board in its requests. Until a member updates, it can still send a voice recording made for the board for transcription, and its text for a title, a Scripture suggestion, a reminder and the safety check (comments too). In every app version, a recording that a member starts outside the board, and then sends to the board, is transcribed before the member chooses the board.

4. The church’s obligations

1. The church has a lawful basis under Article 6 and a condition under Article 9 for Board Data. A church that is a not-for-profit body with a religious aim can have Article 9(2)(d) available to it for its members, former members and regular contacts. For other people (for example, a visitor named in a word), the church needs another condition, such as explicit consent.
2. The church tells the people on its board how it uses Board Data (Articles 13 and 14). Doxa gives a short text the church can use (Schedule 3).
3. The church does not require any member to bring a personal word to the board. A member brings a word only by their own action.
4. The church gives board roles only to people who need them, and removes roles when a person leaves a role.
5. The church answers data subject requests about Board Data, with Doxa’s help (section 3.5).

5. International transfers

1. Doxa stores Board Data in London, United Kingdom (Supabase on Amazon Web Services, eu-west-2). The web app’s server functions also run in London.
2. Some sub-processors in Schedule 1 are in the USA or can access data from there. For each such transfer, Doxa uses one of these safeguards, as Schedule 1 states for each provider: the UK Extension to the EU-US Data Privacy Framework; or the EU Standard Contractual Clauses (2021) with the ICO International Data Transfer Addendum (the UK Addendum); or the ICO International Data Transfer Agreement (IDTA). Doxa keeps a transfer risk assessment for each US recipient.
3. If a transfer from the church to Doxa under these terms is itself a restricted transfer, and no adequacy decision covers it, the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2, controller to processor) and, for UK data, the ICO International Data Transfer Addendum (version B1.0) are incorporated into these terms by reference. Section 2 and Schedules 1 and 2 give the information their annexes need. Where they apply, they prevail over the rest of these terms.

6. Doxa’s own data

Doxa is the controller of the data in section 1.1 that is not Board Data, and processes it under the Doxa privacy policy. A member’s own account and personal Encouragement Vault are not Board Data. When a member leaves the board, or the church deletes the board, the member keeps their own records, including the words they wrote or brought to the board.

7. Liability

Each party is liable for its own breaches of data protection law, as Article 82 sets out. The liability terms of the Doxa Terms of Service (doxa.app/terms) apply to these terms. Nothing in these terms limits a liability that the law does not allow to be limited.

8. Changes to these terms

1. Doxa can update these terms. Each version has a number and a date, and the version history is published.
2. For a change that reduces the church’s protection, Doxa tells the board’s owner at least 30 days before it applies, and asks the church to accept the new version on the board. Such a change gets a new major version number (for example 3.0). A change that the law requires, that corrects facts, or that only adds protection, can apply at once and gets a new minor number (for example 2.1); the church’s acceptance of the major version covers it.
3. Doxa records the version the church accepted, and tells the church on request.

9. End of processing: return and deletion (Article 28(3)(g))

1. Export. At any time, and at the end, the church can ask for a copy of its Board Data at privacy@doxa.app. Doxa sends it in a common machine-readable format (JSON, with links to audio files) within 30 days.
2. Deletion. When the church deletes its board, its membership, roles, invitations, weighing status, weighing notes and held-word links are deleted at once. When the church asks Doxa to delete the board, or when Doxa stops providing the service, Doxa does this within 30 days.
3. Backups. Copies in Doxa’s backups expire within 90 days (on the effective date, backups are kept for 7 days).
4. Members’ own records. Each word on a board is the record of the member who wrote it or brought it. Deletion of the board does not delete those records: they stay in each member’s own account. In the same way, when a member deletes a record or their account, the word leaves the board. The church instructs Doxa to work this way, because the record belongs to the member’s own account.
5. Legal retention. Doxa keeps a copy only where the law of the United Kingdom requires it, and then protects it and uses it for nothing else.
6. On request, Doxa confirms the deletion in writing.

10. Precedence, term and law

1. If these terms and the Doxa Terms of Service disagree about Board Data, these terms apply.
2. These terms stay in force while Doxa processes Board Data.
3. The law of England and Wales governs these terms. The courts of England and Wales have jurisdiction.

Schedule 1. Sub-processors that can receive Board Data

This is the list for Board Data (section 3.4). Section 6 of the privacy policy lists every provider Doxa uses for any purpose.

Doxa does not send a member’s name, email or Doxa account ID with content to an AI provider. OpenAI and Anthropic do not train models on Doxa’s data. AssemblyAI does not train on data processed in its EU region. Doxa does not use AI tools for its own operations on Board Data unless a data processing agreement covers that tool.

Schedule 2. Technical and organisational measures (Article 32)

Schedule 3. Guidance for churches

Good practice for a church that uses a board. It is part of these terms only where section 4 says so.

1. Never require a personal word. Invite members to bring a word to the board. Do not make it a condition of membership, ministry or leadership.
2. Tell your people. Put a short notice in your church privacy notice, for example: “We use Doxa to record, weigh and hold prophetic words given to our church. Doxa processes this information for us. We use it to discern together and to remember what God has said. Only the people we give a role can see the words and the weighing notes. Ask [church contact] for a copy of what we hold about you, or to correct or delete it.”
3. Weigh the word, honour the person. Weighing notes are about a word, not a verdict on a person. Write them so that the person who gave the word could read them.
4. People who are not on Doxa. When you record who gave a word, or a person a word is about, record only what the board needs.
5. Keep roles current. Review who has a team role at least once a year.
6. Children. Doxa is for people aged 13 and over. Take extra care with words about or from people under 18.
7. Ask for help. privacy@doxa.app answers questions about these terms, exports and deletion.