Privacy Policy
Last updated: 31 July 2026.
This policy explains how Eclesi handles personal data on the eclesi.com website and in the Eclesi platform. It complements the Terms of Use.
1. Two different roles
It matters which context you are in:
- On the eclesi.com website, Eclesi is the controller of the data you give us directly (for example, when you subscribe to the newsletter) and of the browsing data described below.
- Inside the platform (app.eclesi.com and the mobile app), the church or organisation that subscribed to Eclesi is the controller of its members' data, and Eclesi acts as processor, handling that data only under the organisation's instructions. Requests about member data should go to the responsible church first.
2. Data we collect
When you subscribe to the newsletter or answer the questionnaire:
- email address;
- the IP address the subscription came from;
- date and time of the subscription;
- answers to the optional questionnaire: your role at church, how you found us, whether you already use a management system, and your main goal.
Submitting the subscription form is your consent to receive the newsletter, and we record that consent: the moment it was given and the version of this Policy in force at that moment.
When you create an account:
- a record of your acceptance of the Terms of Use and of this Policy: the moment you accepted, the IP address the acceptance came from, and the version of the documents in force at that moment.
For this record Eclesi is the controller: it documents the contract between you and Eclesi, not member data entered by a church. We keep the three values because they are precisely what makes the acceptance provable — without the moment, the address and the version there is no way to show what was accepted, or when.
When you only browse: the server records standard technical data (IP address, browser type, pages visited) in short-lived logs needed to operate and protect the site.
If you allow analytics: aggregated usage data collected by Google Analytics 4, described in section 5.
We do not collect sensitive data through the website and we do not ask for card details at this stage.
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis (LGPD / GDPR) |
|---|---|---|
| Send the newsletter and church-leadership content | Consent (LGPD art. 7, I / GDPR art. 6(1)(a)) | |
| Understand who subscribes so we can tailor the content | Questionnaire answers | Consent (LGPD art. 7, I / GDPR art. 6(1)(a)) |
| Evidence your acceptance of the Terms of Use and of this Policy | Moment, IP and version of the accepted document | Performance of a contract (LGPD art. 7, V / GDPR art. 6(1)(b)) |
| Operate, protect and detect abuse on the site | IP, technical logs | Legitimate interest (LGPD art. 7, IX / GDPR art. 6(1)(f)) |
| Remember your language and your cookie decision | Essential cookies | Legitimate interest (LGPD art. 7, IX / GDPR art. 6(1)(f)) |
| Measure audience in aggregate | Google Analytics cookies | Consent (LGPD art. 7, I / GDPR art. 6(1)(a)) |
4. Cookies and local storage
No measurement cookie is written before you accept the notice shown on your first visit.
| Name | Type | What it does | Lifetime |
|---|---|---|---|
eclesi-lang |
Essential cookie | Stores the language you chose | 1 year |
eclesi-consent |
Essential cookie | Stores your analytics decision | 6 months |
eclesi-newsletter-snooze |
Local storage | Stops the newsletter invite reappearing for 7 days | Until you clear browser data |
eclesi-newsletter-subscribed |
Local storage | Records that you already subscribed | Until you clear browser data |
_ga, _ga_* |
Measurement cookie (Google) | Distinguishes visitors and sessions in aggregate | Up to 2 years |
5. Google Analytics and how to withdraw consent
We use Google Analytics 4 to understand which pages help people and which do not. The Google script is only loaded after you click "Allow analytics". If you choose "Essential only", nothing from Google is loaded and no measurement cookie is created.
You can change your mind at any time through the "Cookie preferences" link in the footer of any page: it clears your decision, reloads the site without the measurement scripts and shows the notice again.
Google acts as a processor for this data and may process it outside your country. More at policies.google.com/privacy.
6. Who we share with
We share data only with providers needed to run the service — hosting, email delivery and Google Analytics when you allow it — always limited to what is necessary and contractually bound to protect the information.
We do not sell personal data and we do not use it for targeted advertising.
We may disclose information when required by law, court order, or to defend our rights in proceedings.
7. International transfers
Some providers run servers outside Brazil. In those cases we rely on contractual safeguards compatible with article 33 of the Brazilian LGPD.
8. How long we keep it
- Email and questionnaire answers: while the subscription is active and for up to 12 months after unsubscribing, to evidence the origin of consent.
- Technical logs: up to 6 months.
- Google Analytics data: per the retention configured in the tool, at most 14 months.
You may ask for deletion before those periods, subject to legal retention duties.
9. Security
We keep reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), role-based access control and periodic backups. No system is fully immune to incidents; if a material incident occurs we will notify the affected people and the supervisory authority as required by law.
10. Your rights
Under article 18 of the Brazilian LGPD, you may at any time request:
- confirmation that processing exists;
- access to your data;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of unnecessary or non-compliant data;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- withdrawal of consent.
If the GDPR (Regulation (EU) 2016/679) applies to you, these rights correspond to articles 15 to 22 of the Regulation: access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), portability (art. 20) and objection (art. 21). Withdrawing consent at any time is art. 7(3).
You may also lodge a complaint with the competent supervisory authority: in Brazil, the ANPD; in the European Union, the data protection authority of your country of residence.
To exercise any of these, write to alef@eclesi.com. We reply within 15 days.
To stop the newsletter, use the unsubscribe link included in every message.
11. Children and adolescents
The website is not aimed at people under 18 and we do not knowingly collect their data through it. Data about children and adolescents entered by churches inside the platform is the responsibility of the controlling organisation, which must obtain the specific consent required by article 14 of the LGPD.
12. Changes to this policy
We may update this policy. When a change is material we will announce it by email or with a notice on the site before it takes effect. The date at the top shows the latest revision.
13. Contact
Data protection officer: alef@eclesi.com.