Privacy Policy

VITECH is a multi-tenant church management SaaS. Each church or organisation that uses VITECH gets its own isolated workspace (tenant). Data entered by one church is logically and technically separated from data entered by every other church. We do not combine, sell, or share tenant data between churches.

We only collect data that is necessary to provide, secure and improve the VITECH platform. The categories of data processed include:

• Account data: name, email address, password hash, phone number, profile photo, role and church membership. This is used for authentication, authorisation and audit logging.
• Church workspace data: church name, denomination, address, location, logo, branding colours, subscription plan, payment history and administrator contacts.
• People / member data: names, dates of birth, contact details, family relationships, membership status, first-timer and new-convert records, follow-up notes and pastoral-care information entered by authorised church users.
• Attendance data: service attendance, event check-ins, QR/fingerprint scan events, children’s check-in records and related analytics.
• Giving and financial data: donation records, funds, categories, tithes, offerings, pledges, expenses, budgets, levy calculations and receipts. We do not store full payment card or mobile-money credentials on VITECH servers.
• Communication data: SMS, WhatsApp, email and push messages sent through the platform, delivery receipts, opt-out preferences, campaign analytics and communication templates.
• Uploaded media: profile photos, church logos, hero images, documents, sermon media and other files uploaded by authorised users.
• Operational data: service schedules, departments, groups, volunteer rosters, event registrations, care cases, visitation notes and audit logs.
• Technical data: IP addresses, browser type, device information, session tokens, error logs and usage analytics used to operate and secure the service.

We use collected data solely to:

• Provide, operate and maintain the VITECH platform and its features.
• Authenticate users and enforce role-based access controls.
• Isolate church tenants and prevent unauthorised cross-tenant access.
• Process and deliver SMS, WhatsApp and email messages initiated by churches.
• Generate receipts, statements, reports and analytics for authorised users.
• Maintain audit trails for accountability and compliance.
• Detect abuse, fraud and security incidents.
• Communicate service updates, billing and support responses.

We do not sell tenant or member data, use it for unrelated advertising, or train third-party AI models on church data.

VITECH enforces church isolation at every layer of the platform. Access to data is controlled by authenticated server-side rules that check the user’s identity, role and church workspace before any record is returned or modified. Encryption in transit (TLS) and encryption at rest protect stored data. Administrative access is logged and reviewed.

Church administrators control who is invited into their workspace and what permissions each user receives. VITECH staff do not access tenant data except when required for support, and only under strict internal controls.

VITECH integrates with the WhatsApp Business Platform provided by Meta to allow churches to send and receive WhatsApp messages. When a church connects its WhatsApp Business account:

• The church’s WhatsApp access token is stored encrypted and is only decrypted by VITECH server processes when sending a message on the church’s behalf.
• Tokens are never returned to the browser, exposed in logs, or shared with other tenants.
• Incoming messages and delivery status updates are received through a verified webhook endpoint and processed according to the church’s opt-in and opt-out preferences.
• Meta may process phone numbers and message content in accordance with Meta’s own privacy practices. We encourage churches to review Meta’s Business Tools Terms and Data Processing Terms.

VITECH uses cookies and similar technologies to keep users signed in securely, remember preferences and protect the platform from abuse. Authentication cookies are httpOnly, secure and scoped to the VITECH domain. We do not use third-party advertising or tracking cookies.

We retain data for as long as a church maintains an active VITECH account and as needed to provide the service, comply with legal obligations, resolve disputes and enforce agreements. When a church account is closed, data is retained for a reasonable period to allow recovery or legal compliance, then securely deleted in accordance with the church’s instructions and applicable law.

Church administrators can request deletion of their workspace or specific records by contacting VITECH support. Individual users may also contact their church administrator or VITECH support to exercise rights such as access, correction, restriction or deletion of personal data, subject to the church’s authority over its own records.

We will respond to verified requests within the timeframes required by applicable law. Deletion of certain records may be limited where retention is necessary for legal, financial, audit or security purposes.

VITECH uses trusted infrastructure and communication providers to host, secure and deliver the platform. These providers are contractually bound to process data only on our instructions and to maintain appropriate security measures. Current categories of subprocessors include cloud hosting, email/SMS/WhatsApp delivery, payment processing and analytics services.

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised “Last updated” date. Continued use of VITECH after changes constitutes acceptance of the updated policy.

If you have questions, concerns or requests about this Privacy Policy or how VITECH handles data, please contact us:

VITECH Church Management System
Email: privacy@vitechcms.com
Website: www.vitechcms.com