Data processing addendum
The data processing addendum, in plain language
Who this is between
This addendum is between the church that has a GiftWell account (the church) and Zao, the parent company of DiscipleOS (GiftWell, "we"). GiftWell is part of the DiscipleOS family of products. DiscipleOS is a subsidiary of Zao. It forms part of the terms of use, and applies whenever GiftWell handles personal information for the church. In it, "personal information" means information about an identifiable person. Where a privacy law uses different words ("controller" and "processor", or "business" and "service provider"), the church is the first and GiftWell is the second.
What is processed
| What it is for | Running the church's spiritual gifts assessment and follow-up list: collecting answers, working out results, showing them to the person and to the church's staff, and the optional features the church switches on (Planning Center, AI first look, agent access, exports). |
|---|---|
| How long | For as long as the church uses GiftWell, and then as set out under "Deleting or returning data". |
| Whose information | People who take the assessment; people they ask to confirm their gifts; people they share a result with; and the church's own staff who sign in. |
| What kind of information | Names, email addresses, phone numbers (where the church has them), answers and results, age band (and birth year, gender and whether a household has children if the church uses Planning Center, used only to order introductions), written answers, and details the church already holds in Planning Center if it connects it. This includes information about religious beliefs and practice, which many laws treat as especially sensitive, and information about young people. |
| What we do with it | Store it, display it to the people the church allows, send the emails described in the privacy page, pass it to the services the church connects, back it up, and delete it. |
Your instructions
We process the church's personal information only on the church's documented instructions. Those are: the terms, this addendum, and the settings the church (through its admins) chooses in GiftWell, such as roles, retention, youth options, Planning Center, AI provider, agent access, and opting out of the anonymous statistics. We will not process it for any other purpose, except where the law requires us to; then we will tell the church first unless the law forbids it. If we think an instruction breaks the law, we will say so.
The church promises that its instructions are lawful and that it has told the people concerned, and has any consent or other legal ground the law requires, including for information about religion and for children.
Access by GiftWell's own people is limited to what is needed to run or support the service (people with a GiftWell platform-admin role can open any church's data for that purpose), and each look at the combined statistics, and each full backup, is recorded in an audit log.
Security measures
We use the measures below, and no others should be assumed.
- Access control: five roles (viewer, leader, pastor, admin, owner), with the sensitive things (what people wrote, faith answers, stories, backups) limited to the higher roles or to people who agreed to share; signed, private links for people's own results; rate limits on submissions, emails and other actions.
- Encryption in transit for connections to GiftWell.
- Encryption in the database only for: the "something you have walked through" answer, private confirmation links, the church's Planning Center and AI credentials, and temporary import files. Other fields, including names, emails, answers, written text, faith answers, stories and staff notes, are ordinary database values protected by access rules, not field-level encryption.
- Hashing: passwords and agent tokens are stored only as one-way hashes. Agent tokens expire (30 to 365 days) and can be revoked all at once.
- Sealed backups: full backup and migration files are locked with a passphrase (AES-256-GCM with a key derived from the passphrase) and can be made only by the church's owner unless the church changes that.
- Protection for young people: for anyone who may be under 18, no AI reading, no agent-tool detail and no Planning Center write-back.
- Audit log: sensitive actions are recorded by id and count, never with names, emails or answers.
- Minimising data in AI requests: the AI first look is never sent a name, email, testimony, story, Spirit-gift answers or the "walked through" answer.
- Small, short-lived imports: import previews are encrypted and deleted after 30 minutes.
Sub-processors
The church agrees that GiftWell may use the companies on the sub-processors page to run the service, and that GiftWell relies on each provider's own data protection terms (a data processing agreement, where the provider offers one) to require them to protect the data. GiftWell stays responsible to the church for them. If we add or replace one that will handle the church's personal information, we will update that page and email the church's owner before the change takes effect, and the church may object by writing to us; if we cannot resolve it, the church may stop using GiftWell and have its data deleted.
Services the church connects itself, with its own account or key (Planning Center, the church's AI provider, Stripe), are the church's own choices. GiftWell passes data to them only as the church has set up, and the church's own agreement with each one applies. We list them so the church can see exactly what is sent.
Helping you with requests
GiftWell gives the church tools to answer people's requests: to see a person's result and what they wrote, to export, to erase a person or a single result (and, if the church chooses, to clear the values GiftWell wrote to Planning Center), and to set how long results are kept. People can also erase their own answers from their results page. If someone writes to us about the church's data, we will pass the request to the church without unreasonable delay and will not answer it ourselves unless the church tells us to or the law requires. We will give the church reasonable help with impact assessments and with dealings with a regulator, to the extent they concern GiftWell's processing.
If something goes wrong
If we become aware of a breach of security that leads to the accidental or unlawful loss, alteration, disclosure of or access to the church's personal information, we will tell the church's owner by email without undue delay and no later than 72 hours after we become aware, say what we know (what happened, what data, what we are doing), keep the church updated, and help it meet its own duty to tell the people concerned and regulators, which in some places carries its own deadlines.
Deleting or returning data
The church can export or erase its data at any time using GiftWell's tools. When the church stops using GiftWell and the owner asks, we will return the data in the formats the export and backup tools produce, if asked, and delete it, and tell the church when that is done. Copies remain in our hosting provider's backups until those expire. We may keep what the law requires us to keep (for example, records of payments).
Showing compliance
We will give the church the information it reasonably needs to check that we are keeping to this addendum, and we will allow a reasonable review (first by questions and documents, and, if that is not enough or the law requires it, by an audit with fair notice, no more than once a year and at the church's cost, and without exposing other churches' data).
Data sent abroad
GiftWell hosts the service in United States (Amazon Web Services, us-east-2, Ohio). Some of the companies on the sub-processor list can process data in the United States or elsewhere. If the church is in the European Economic Area, the United Kingdom or Switzerland, sending data to GiftWell in the United States is a transfer the law requires a safeguard for.
The safeguard is the European Commission's Standard Contractual Clauses (and, for the UK and Switzerland, their addendum or amendments), which the church and GiftWell agree are incorporated here for those transfers. Until counsel has finalised the details, write to hello@giftwell.app and we will provide a copy for signature.
California and similar laws
To the extent California's privacy law (the CCPA) or a similar US state law applies, GiftWell is the church's "service provider" (or "processor"), and: the church discloses personal information to GiftWell only for the limited purposes in this addendum; GiftWell will not sell it or share it for advertising; will not retain, use or disclose it for any purpose other than those, or outside its direct relationship with the church, except as the law allows; will not combine it with other information except as the law allows; will comply with the law and give the same level of protection the law requires; will tell the church if it can no longer meet its obligations; and the church may take reasonable steps to stop and remedy unauthorised use. GiftWell's use of information to build, improve and secure its services, including deidentified statistics, is as the law allows service providers.
The anonymous, combined statistics
The church instructs and permits GiftWell to produce anonymous, combined statistics from the church's data, under the rules on the privacy page (never shown for small groups, never including what people write, excluding people who have erased their answers). GiftWell publicly commits to maintain and use them only in deidentified form and not to attempt to reidentify them. The church can withdraw this instruction at any time in Settings; from then on its data is left out.
The rest
If this addendum and the terms disagree about personal information, this addendum wins. The limits on liability in the terms apply to this addendum as far as the law allows. We may update this addendum as the terms say; a change that reduces the protection of the church's data takes effect only with the church's agreement, unless the law requires it.
Who we are and how to reach us
GiftWell is provided by Zao, the parent company of DiscipleOS. GiftWell is part of the DiscipleOS family of products. DiscipleOS is a subsidiary of Zao.
Privacy and data requests: hello@giftwell.appEverything else: hello@giftwell.app
Version history
We keep this list so you can see what changed and when. If a change is one you would reasonably care about (for example, a new kind of data we collect or a new sub-processor), we will say so at the top of the page and email church owners before it takes effect.
- . Described how pastors follow up after a result: the walked-through and conversation log (who and when, never what was said), placing a person on a ministry and checking 30 and 90 days later whether they are serving (by the pastor's own answer, or by a read-only Planning Center check matched only by a linked profile or one exact email, and never for anyone who did not share or may be under 18), the staff-only view of ministry needs against people who could serve, and a weekly email to church staff naming people who shared and are still waiting. The email never goes to the people it lists, and goes out on a day and hour each church chooses in its own timezone (by default Monday 8:00 am Pacific). A person's My GiftWell download and printable page now also include the follow-up record kept about them (placements, the dates of conversations and walk-throughs, and the Planning Center team or group that was checked), and only theirs. Flagged for counsel review.
- . Clarified what the optional staff-only AI first look is sent: it also includes the Ephesians 4 first look and any self-reported profile result (such as Enneagram or Myers-Briggs) a pastor recorded for the person, and where the gifts each serving team asks for fall in the person's bands. The same consent and age rules apply, and the never-sent list is unchanged.
- . Added My GiftWell, a passwordless page where a person signs in with a one-time emailed code to see their own results over time, ask for one retake reminder email, and download or delete their own results. Described the code and session handling, what is and is not shown, the reminder, and the new retention periods. Flagged for counsel review.
- . Disclosed that GiftWell itself may use an AI provider (models routed through OpenRouter) for the platform-level "Ask the platform" analyst, sent only suppressed, rounded, anonymous aggregate tables and never names, emails, free text or individual assessments; listed it as a sub-processor; and stated plainly that platform administrators can open any church's workspace for support and operations, with each access recorded in the audit log.
- . Rewrote the terms and privacy pages; added the data processing addendum and the sub-processor list; spelled out what each role (taker, church, parent or guardian) can see and do; added regional rights, cookies, retention, and what GiftWell does not do. GiftWell's own fonts are now served from GiftWell itself.
GiftWell is part of the DiscipleOS family of products. DiscipleOS is a subsidiary of Zao.