Privacy
How GiftWell handles what you tell it
Anonymous, combined statistics
In practice: only people who ticked the box to share their results with the church’s pastoral team are counted; anyone who may be under 18 is counted only inside one combined “under 18” group, and only when that group is large enough; results are grouped no finer than a church’s size, tradition or country or state, never a city or a church; and a statistic about a group is hidden unless it describes at least 10 people from at least 3 different churches. A church that opts out in Settings is left out of the combined numbers from then on. Only GiftWell’s platform administrators can see these statistics, and each time they look or download them it is recorded in an audit log.
Our commitment about deidentified information. GiftWell publicly commits to maintain and use these combined statistics only in deidentified form, and not to attempt to reidentify them. If GiftWell ever gives deidentified information to another party, it will require that party by contract to make the same commitment.
GiftWell's own use of an AI provider
Separately from the optional first look above, GiftWell itself may use an AI provider (models routed through OpenRouter, as GiftWell's configuration sets) for an "Ask the platform" analyst. Only GiftWell's platform administrators can open it, and it is used to understand the combined statistics, not any one church or person. It is off unless GiftWell has set up its own key for it; without one, the page shows plain rule-based insights.
- What is sent: only suppressed, rounded, anonymous aggregate tables: groups that are too small are hidden and the numbers are rounded. Never names, emails, free text, church names, or any individual's assessment or answers.
- The administrator's question is screened before it is sent. A question that names a church, or holds an email address or a phone number, is refused, and the question is limited to 300 characters. This screen is automatic and cannot recognise every possible name, so administrators are also instructed to ask only about the combined numbers.
- What the provider keeps: GiftWell asks that data collection be denied where the provider supports it, so that providers that keep or train on prompts are not used. That request is made on OpenRouter; if GiftWell ever points the analyst at a different provider that has no such setting, that provider's own terms apply. The provider is listed on the sub-processors page.
- This never involves a church's own AI key, and it is not used for anyone's first look.
GiftWell staff access to a church's workspace
People with a GiftWell platform-administrator role can open any church's workspace, including what the church's own pastors can see, in order to support the church and to run the service. When an administrator opens a church they are not a member of, that access is recorded in the audit log (the page opened, never what was looked at, and no more than once an hour for each administrator and church). Viewing or downloading the combined statistics is recorded too. This repeats, in one place, what the sections on who can see your result say.
Who is who
- The church (for example, the church whose page you used) decides why and how your answers are used. In privacy-law terms it is the "controller" (or, in California, the "business"). It is responsible for telling you what it does with your answers, for having a proper basis to collect them, and for answering your requests about them.
- GiftWell (Zao, the parent company of DiscipleOS) runs the software and keeps your answers for the church. In privacy-law terms it is the church's "processor" (in California, its "service provider"). It acts on the church's instructions, which are the settings the church chooses, and under the data processing addendum.
- GiftWell is in charge of its own purposes for: the accounts of the people who sign in to run a church's GiftWell; plan and payment records; security and abuse logs; messages sent to us; the emails GiftWell sends at a person's request (a result shared with a friend, and a "my gifts" link); and the anonymous, combined statistics above. For these GiftWell is a controller. Whether the statistics make GiftWell a controller of the data they come from is a question we have flagged for our lawyers.
GiftWell is part of the DiscipleOS family of products. DiscipleOS is a subsidiary of Zao.
If you took the assessment
What we collect
- Your name and, if you give it, your email address.
- Your answers to the questions, and the scores and bands worked out from them.
- If you choose to write them: who or what you care about, what you are good at, what your life allows right now, what you would love to grow in, your faith and baptism answers, how you came to faith, and something you have walked through. These are religious or deeply personal information, and are kept only as described below.
- If you are asked and agree: your answers about the gifts of the Spirit.
- Your age band (for example "25 to 34"), if the church asks for it. We keep the band, not your birthday. If the church uses Planning Center we may also hold your birth year from there.
- If the church links you to Planning Center and you shared your results with its pastoral team: your gender, and whether there are children in your household, from Planning Center. These are used only to order the introductions a pastor might make (for example, putting people close in age first). They are never shown to anyone, never decide whether you are suggested, and someone who may be under 18 is never suggested alongside an adult.
- Details the church already holds about you, if it connects Planning Center: for example groups, teams and positions, household, check-in history and a few facts from your profile. GiftWell keeps a copy of these in the church's account so the church can see them next to your result.
- What the church's pastors record about following up with you: that they walked through your result and when, that they had a conversation with you and when (never what was said), and the ministry they placed you on and when. If the church connects Planning Center and you shared with the pastoral team, GiftWell also keeps, for as long as that placement is being followed, the name of the Planning Center team or group that ministry is linked to, the date you were last scheduled on it and whether your membership looks current.
- The ordinary technical details of a web request: your IP address and browser type, in the sign-in session records and in server logs.
- If you use "tell a friend": the friend's email address and the message you wrote.
- If you sign in to My GiftWell: a one-time code (kept only as a keyed hash, never as typed) and the session that sign-in starts. If you tick "remind me to retake": a date, and a note that you asked for it, but not a second copy of your email address.
- If you ask two people to confirm your gifts: what they write goes only to the pastors, and you never see it.
The three tick boxes
- Share my results with the pastoral team. Lets the church's team follow up with you by name, and includes you in introductions, spreadsheets and the church's tools. It is also what makes an optional AI first look possible, and what counts you in the anonymous statistics above.
- Gifts of the Spirit answers. Only asked if the church includes that part, and only kept if you tick it.
- Planning Center. Only if the church connects it and asks: lets the church write the results described under "Planning Center" below to your Planning Center profile.
We record when you ticked, or did not tick, each one.
Who can see it
- You, from the private link to your results.
- The church's pastors (and its admins and owner, who have pastor-level access) can open your result in the app and read everything you wrote, your faith and baptism answers and your story, even if you did not tick the box to share your results. Leaders and viewers on the church's team can read what you wrote, and your faith and baptism answers and story, only if you did tick it. If you did not tick it, you are marked do-not-contact, and your answers stay in the app: you are left out of the spreadsheet (CSV) export, introductions, AI readings, Planning Center and agent tools (agents see only a number, not your name). Your answer about something you have walked through is not kept at all unless you ticked the box.
- Even when you shared with pastors, agent (MCP) tools receive what you wrote, your faith and baptism answers and the staff's private notes about you only if the church's owner switched on sensitive agent export (off by default) and the person using the agent has that permission. Otherwise an agent is told only that something exists.
- The something you have walked through answer is for pastors to read in person. It is never in the spreadsheet export, in any AI tool, in agent tools, or in Planning Center. It is included only in the full backup file, which only the church's owner can make (the church can change who), and which is locked with a passphrase.
- The church's owner can make a full backup or migration file of everything, including what you wrote. Each one is recorded in an audit log. People with a GiftWell platform-admin role can open any church's data in order to support it; see GiftWell staff access to a church's workspace.
- The two people you ask to confirm your gifts write to the pastors only. You never see their words.
Links to your results
Your results are reached by a private link. The link does not expire, and anyone who has it can open your results and erase them. Treat it like a key: do not post it publicly. If you use "tell a friend", the friend gets a separate public link to a page showing your full name, your church, and your gift bands. That link does not expire either; erasing your answers makes it stop working. The "my gifts" page is different: GiftWell emails a one-time sign-in link to the address you gave (valid for 60 minutes, usable once, followed by a 20-minute session on that browser, at most three emails per result per day).
My GiftWell (signing in to your own results)
If you took the assessment at a church, you can go to that church's My GiftWell page and ask for a code. We email a 6-digit code and a one-time link to an address only if it already has results at that church, and the page reads the same whether it does or not, so it cannot be used to find out who took the assessment. The code and the link work once and for 10 minutes; five wrong tries lock the code. We keep only a keyed hash of the code, never the code itself, and we delete spent and expired codes within a day. We never write a code or a sign-in link to our logs. Signing in starts a session cookie for that church only: it ends after 30 minutes without activity, or 8 hours at most, or when you press Sign out. Pages are marked so browsers and search engines do not store them.
Once you are signed in you see only your own results at that church, as bands and dates (never scores), what moved, and the church's suggestions for growth matched to what you wrote. You never see staff notes, anyone's confirmations of your gifts, an AI first look, the rest of your Planning Center profile or anyone else's results. The one exception is the record of following up with you described under Following up after a result, which your download and the page you can save as PDF include, and which is only about you. If more than one person uses the same email address, you see only the results under the first name on the latest one. A person who may be under 18 is not offered My GiftWell. You can download your results (a JSON file, or a page you can save as PDF; both include what the church recorded about following up with you) and delete them; both ask for a fresh code if you signed in more than ten minutes ago. Deleting removes your results, what you wrote, confirmations of them, any retake reminder and any sign-in codes, and cannot be undone. Values a church already wrote to Planning Center stay in the church's own records.
If you tick "remind me to retake" (only possible after you sign in, so we never email an address someone merely typed into a form), we send one plain email about six months after your latest result, with an unsubscribe link, and no marketing. It stops if you unsubscribe, retake the assessment first, erase your results, or the church turns My GiftWell off. A church can see only a combined count of people waiting on a reminder, never who. Churches can switch My GiftWell off in Settings. My GiftWell sends nothing to the anonymous, combined statistics described above, and nothing about it feeds them.
An optional AI first look
A church can switch on a short, staff-only written reading of your result. It uses the church's own account with an AI provider; GiftWell does not supply a key for it, and does not use its own key for any church's people or results. It is made only if you ticked the box to share with pastors, you are not held back for your age, the church has set it up, and you wrote enough to read (at least 40 characters). It is sent your gift bands and strength words (never your scores), your Ephesians 4 first look if you took it, the "sweet spot" answers you wrote (who or what you care about, what you are good at, what your life allows right now, and what you would love to grow in), your quick picks, any self-reported profile result (such as Enneagram, Myers-Briggs, CliftonStrengths or DISC) that a pastor has recorded on your record, and the church's list of serving teams with where the gifts each one asks for fall in your bands. It is never sent your name, your email, your testimony or story, your Spirit-gift answers, or the answer about something you have walked through. The reading is saved with your result and only staff can see it. There is no AI on your own results page.
What the AI provider does with what it receives depends on the provider and on the church's settings with it. GiftWell does not choose or control those settings. Providers we know a church may use (OpenAI, Anthropic, OpenRouter) say that, by default, they do not train their models on API traffic and keep it for a limited time for abuse monitoring, with some routes through OpenRouter being the exception unless the church limits them in its OpenRouter settings. Ask your church which provider it uses.
Following up after a result
Pastors can mark that they walked through your result with the Conversation Guide, log that they had a conversation with you, and place you on a ministry. Each is saved as who did it, which result it was about and when, and never as notes or anything that was said. About a month and three months after a placement, the church is reminded to check whether it took, so a pastor can follow up. You are never contacted by this. The reminder goes to the church's pastors, in the app and in the weekly email described below.
To check, a pastor can answer "is this person serving?" by hand. If the church has connected Planning Center and you shared with the pastoral team, GiftWell can also look at Planning Center, read only, and only for people who have been placed: it is matched to you only by a Planning Center profile already linked to you or by an email address that exactly matches exactly one Planning Center profile, and never by a guess. It keeps only the id and name of the team or group the ministry is linked to, the date you were last scheduled on that team, and whether your membership is current. It does not read or keep giving, notes, contact details or family details for this. It is not done for anyone who did not share with the pastoral team or who may be under 18. Disconnecting Planning Center deletes what was read. You can see all of this, for you only, in your My GiftWell download and the page you can save as PDF.
The church also sees how many people a ministry says it needs against how many could serve, from people who shared with the pastoral team, have time to give and lead with a fitting gift. Staff who can see names see yours there; others see only counts. Nobody is told anything because of it.
The weekly email to church staff
Once a week, on the day and hour the church chooses in its own timezone (by default Monday at 8:00 am Pacific), GiftWell can email the church's pastors, admins and owner (and any leader who opts in) a list of people who took the assessment, shared with the pastoral team and are still waiting for a conversation, with each person's name, their lead gifts, how long they have waited and a suggested next step, plus a count of people placed a month or more ago who are not yet serving. It is sent only to church staff, never to the people it lists. People who may be under 18 are counted, never named, in the email. It carries no answer you wrote, no scores and no AI text. Staff can turn it off for themselves (a link in every email), and an admin can turn it off for the whole church. We keep, per email, only a week, the counts and whether a link in it was opened; not the list.
Planning Center
If the church connects Planning Center, GiftWell reads the church's own Planning Center records and, where you agreed and the church has chosen the fields, writes to your Planning Center profile: which gifts fall in which group (by name, never your scores), your Ephesians 4 leaning, your quick picks, the serving teams you asked to try, the date you took the assessment, and a link that opens only for a signed-in pastor. Only if the church chooses to map them, and you agreed to save those answers, it also writes the names of the Spirit gifts you marked and how often. It never writes what you wrote in your own words, your story or testimony, or the answer about something you have walked through. Values already written live in the church's own Planning Center database; erasing in GiftWell does not remove them unless the church chooses to clear them too.
Young people
If you may be under 18, GiftWell does not make an AI reading of your result, does not send your details to agent tools, and does not write to Planning Center. Young people are not matched one-to-one with adults in the introductions list, and are left out of the gift statistics (they appear only as a head count in one combined "under 18" age group). See also the section for parents and guardians.
If you're a church admin
You are the controller of the answers your people give, and GiftWell is your processor. The data processing addendum is part of the terms you accept when you use GiftWell.
- What you can do: choose who on your team has which role (viewer, leader, pastor, admin, owner); choose how long results are kept; ask for age bands and set the youth options; turn on Planning Center, an AI provider you pay for, Gravatar pictures and agent (MCP) access; export your list; make full backup or migration files; erase a person or a single result; opt out of the anonymous statistics.
- What GiftWell records about you: your name, email and a hashed password; your church's settings; your team's actions in an audit log that keeps ids and counts, never names, emails or answers.
- What you owe the people who answer: your own privacy notice to them, a lawful basis (in some places, explicit consent) for collecting religious information, a parent or guardian's agreement for children where the law requires it, and answers to their requests. The terms say this in more detail.
- Your keys and tokens: Planning Center and AI credentials are stored encrypted. Agent tokens are shown once and stored only as a hash; they expire in 30, 90, 180 or 365 days (90 by default) and you can revoke all of them at any time. Sensitive agent export is off by default.
- Payment: paid plans are paid through a Stripe link. GiftWell never holds card numbers. Stripe tells GiftWell that a payment happened: which church it was for (a reference we put in the payment link), the plan, the period it covers, and the payer's email address as Stripe has it. GiftWell keeps those and Stripe's customer and subscription ids to apply the plan; a GiftWell administrator can also record a payment by hand.
If you're a parent or guardian
- GiftWell is built for adults and young people in a church's care. It is not designed for children under 13.
- By default, if a person says they are under 13, the form stops and nothing is saved. A church can switch on an option that lets under-13s answer. To switch it on the church ticks that it has a parent or guardian's agreement, and the child is asked to confirm that a parent or guardian said yes. That tick is not a check that you agreed. GiftWell cannot verify who is at the keyboard. A church that switches this on is responsible for getting and keeping your consent itself, outside GiftWell.
- If your child's answers were collected without your agreement, write to hello@giftwell.app and tell us the church and your child's name. We will pass it to the church and, if you ask, erase the result ourselves. The church can also erase it, and your child can erase it from the bottom of their results page.
- For every person who may be under 18 (including anyone under 13), GiftWell holds back the AI reading, agent-tool detail and Planning Center write-back, and leaves them out of the gift statistics. We store an age band, not a birthday.
- We do not use any child's answers for advertising, profiling or selling. Young people are left out of the gift statistics; the only place they appear in the combined statistics is as a head count inside one combined "under 18" age group.
What we do not do
- We do not sell personal information, and we do not share it for cross-context behavioural advertising.
- We do not run advertising, analytics or social-media tracking scripts, or tracking pixels, on GiftWell.
- We do not use your answers to train an AI model. GiftWell itself may use an AI provider only for combined, anonymous statistics, as described above, never for your answers.
- We do not send your name, email, testimony, story, Spirit-gift answers or "walked through" answer to an AI provider, whether a church's or GiftWell's own.
- We do not send marketing email to the people who take an assessment. GiftWell sends only the two emails described above to people who take an assessment, each at their request. GiftWell also emails church staff, for example the weekly email described under The weekly email to church staff, which never goes to the people it lists.
- We do not send text messages.
- We do not show your result, or what you wrote, to anyone outside the church's account, other than people you or the church choose to give it to.
- We do not store payment card numbers.
- We do not ask for, or keep, your date of birth. (We keep an age band, and Planning Center's birth year if the church uses it.)
- We do not claim to encrypt everything. See Security.
Other companies that handle data
GiftWell uses the companies below to run the service. The full list, with what each one receives, is on the sub-processors page.
| Company | What for | Where | When |
|---|---|---|---|
| Laravel Cloud, on Amazon Web Services | Hosts the application, the database (MySQL), the cache and the logs. | United States (Amazon Web Services, us-east-2, Ohio) | Always |
| Resend | Sends the emails GiftWell sends: a result a person chooses to share with a friend, the "my gifts" sign-in link, and the My GiftWell sign-in code and the one retake reminder a person asked for; and the weekly list of people waiting for a conversation, sent only to church staff. | United States | Always |
| Stripe | Takes payment for paid church plans through a Stripe Payment Link. GiftWell never sees or stores card numbers. | United States and other Stripe locations | Only if the church turns it on |
| An AI provider the church chooses (OpenRouter, OpenAI or Anthropic) | Writes the optional staff-only "first look" brief about a person. Runs only with the church's own API key; GiftWell does not supply or use a key for this. | Set by the provider and by the church's own account settings | Only if the church turns it on |
| An AI provider GiftWell itself may use for the platform "Ask the platform" analyst (OpenRouter-routed models) | Lets GiftWell's own platform administrators ask questions about combined, anonymous statistics across churches. It is not used for any church's people, results or briefs. | Set by the provider that OpenRouter routes the request to; OpenRouter is a United States company | Only if GiftWell has set up its own platform AI key |
| Planning Center | If the church connects it: reads people, groups, teams and check-in history, for people who have been placed on a ministry (and who shared and are not under 18) reads only the id and name of the linked team or group, the date last scheduled and whether the membership is current, and (where the person agreed) writes results to the person's profile, as listed below. | United States | Only if the church turns it on |
| Gravatar (Automattic Inc.) | Shows a profile picture for a person, only when the church turns the setting on (off by default). | United States | Off unless the church switches it on |
| Google Fonts (Google LLC) | Loads a church's own brand fonts, only for a church that imported them from its website. GiftWell's own fonts are served by GiftWell and make no request to Google. | United States and other Google locations | Only if the church turns it on |
How long we keep it
| What | How long |
|---|---|
| A result, what you wrote, your confirmations and share records | Until you or the church erases them, or automatically after the period the church chose: never, or 12, 24, 36 or 60 months after the result was made. The clean-up runs nightly. A church that has not chosen keeps results until someone erases them. |
| Your profile (name, email, phone, Planning Center details) | Removed when your last result is erased. If a pastor wrote notes about you, or the church added timeline entries, those stay with no name or contact details attached (see "Your rights"). |
| An AI first look | Saved with your result and erased with it. |
| Files of data being imported (previews) | Held encrypted for 30 minutes and then deleted. |
| Sign-in sessions (including IP address and browser type) | A session ends after 120 minutes without activity. Expired session records are swept by a clean-up that runs on a sample of requests, so a record can remain in the table longer than that. |
| "Remember me" sign-in (church staff only) | Up to 400 days, or until you sign out. |
| Rate-limit counters (limits on how many times something can be done) | Up to a day. |
| My GiftWell sign-in code and link | 10 minutes, once. Spent and expired codes (stored only as a keyed hash) are deleted within a day. |
| My GiftWell session | 30 minutes without activity, 8 hours at most, or until you sign out. |
| A retake reminder you asked for | Until it is sent once, you unsubscribe, you retake the assessment, or your results are erased. After an unsubscribe we keep only a record that you said stop. |
| The older "my gifts" sign-in link | 60 minutes, once; the browser session it starts lasts 20 minutes. |
| Result links, shared-with-a-friend links and confirmation links | They have no expiry. They stop working when the result is erased. A pastor can also make a new confirmation link, which replaces the old one. |
| Agent (MCP) tokens | 30, 90 (default), 180 or 365 days, or until revoked. |
| Audit log (ids and counts, never names, emails or answers) | Kept for as long as the church's account exists; it is not automatically pruned. |
| Backups at our hosting provider | Copies of erased data can remain in provider backups until those backups expire. |
| A pastor's record of following up (walked through, conversation, placement) | Until the person's results are erased, when it goes with them, or until a pastor stops following a placement (the record of the placement itself stays until erasure). |
| What was read from Planning Center to follow a placement (team or group, last-scheduled date, current or not) | Replaced each time it is read, and deleted when the church disconnects Planning Center or the person is erased. |
| Weekly staff email records (week, counts, whether a link was opened) | Kept for as long as the church's account exists. They hold no names or addresses. |
| Email delivery logs at Resend | Up to 30 days. |
| A church's account and its people | Until the church asks us to close it, or erases its people. After a request to close an account we will delete it; there is not yet a button for that, so write to us. |
Cookies and similar storage
GiftWell uses only the cookies and storage it needs to work. It does not use advertising or analytics cookies, so there is no cookie banner to dismiss.
| Name | What it does | How long |
|---|---|---|
| A session cookie named for the site, ending in "-session" | Keeps you signed in as a church user, carries one-off messages between pages and protects forms. Set on pages you visit, with the HttpOnly and SameSite=Lax flags. | 120 minutes without activity |
| giftwell-embed-session | Only when you take a church's assessment inside a box on that church's own website. It does the same small job as the session cookie above (carries a one-off message such as "please pick your age range", and protects forms) and nothing else. It is set Secure and HttpOnly, SameSite=None and Partitioned, which means your browser keeps a separate copy for each website that shows the box, and it is never used to sign anyone in. | 2 hours |
| The same session cookie, when you sign in to My GiftWell | Holds your sign-in for that one church. It carries no results. It is set Secure on an https site, with HttpOnly and SameSite=Lax. | 30 minutes without activity, 8 hours at most |
| XSRF-TOKEN | Protects forms from being submitted by another site. | With the session |
| A "remember" cookie (starts with "remember_web") | Only if a church user ticks "Remember me". | Up to 400 days |
| Browser storage (localStorage), key starting "giftwell-" | While you take the assessment, your answers, quick picks and the free text you type are saved on your own device so you can come back. Never your name or email, or the answer about something you have walked through. It is removed when you reach your results page. If you abandon the assessment, it stays on that device until you clear your browser's data, so clear it if the device is shared. If you take the assessment in a box on a church's website and choose "Open in a new window", your saved answers travel in the part of that link after the # sign (your browser never sends that part to anyone) so the new window can carry on from the same place. They are put into the new window's own storage and the part is removed from the address bar. | Until your results page opens |
| Browser storage (localStorage), key "gw-theme" | Remembers your colour theme choice (Light or Dark) on this device, so the page does not flash the wrong colours. It holds one word and nothing about you. If you leave the theme on System, nothing is stored. | Until you choose System or clear your browser's data |
We do not set these for advertising and do not read them for any purpose other than the one stated. Our own fonts are served from GiftWell itself, not from Google. Some church pages load other things from outside GiftWell, which means your browser sends a normal web request, including your IP address, to that company: a church's own logo (from the church's website), a church's own brand fonts (from Google Fonts, only if the church imported them), and, only if the church turned it on, Gravatar pictures.
Your rights, and how to use them
These are the things you can do, and they are all real features today.
- See your results, and download them. Open the private link to your results, or sign in to My GiftWell with a code we email you, where you can download them as a JSON file (your results as bands and dates, what you wrote and picked, your choices, and what the church recorded about following up with you: the ministries you were placed on and the 30 and 90 day marks, the dates a pastor walked through your result or talked with you, and the Planning Center team or group that was checked, with its last-scheduled date; no scores, no staff notes and no staff names). If you want to see everything the church holds about you (including staff notes and an AI first look), ask the church; see step 4.
- Delete your answers yourself. At the bottom of your results page, or in My GiftWell after a fresh code, there is a button that erases your result, what you wrote and your confirmations, right away. When your last result goes, your name, email, phone, age and the Planning Center details we copied go too. If a pastor wrote notes about you, those notes may stay with no name or contact details attached. Copies may remain in our hosting provider's backups until they expire. (On the demo, the button does nothing.)
- Change your mind about sharing. Today you can withdraw consent by erasing your result, or by asking the church to do so. There is no switch that turns off sharing and keeps the result; telling the pastors you are interested in a team turns sharing on, with its own tick and a date.
- Ask the church. Pastors with the right role can erase a person's answers, and can also clear the values GiftWell wrote to Planning Center if they choose to. The church answers requests about correcting, restricting or exporting your information.
- Ask us. For anything the church does not answer, or about what GiftWell does as itself, write to hello@giftwell.app. Tell us the church and the email address you used. We will confirm you are who you say you are (for example, by replying to that address), tell the church if it is the church's data, and answer within 30 days, or tell you why we need longer.
- Complain. You may complain to the church, to us, and to your data protection regulator (see regional rights).
Values already written to Planning Center are in the church's own Planning Center database. Erasing in GiftWell does not remove them unless the church chooses to; ask the church to remove them if you want them gone. A person who erased their answers may still be named in the church's own notes if a pastor wrote them; those notes are the church's records and have no name or contact details left on them in GiftWell.
Regional rights
Privacy laws differ. The rights below apply where the law applies to the church or to us; the steps above are open to everyone. GiftWell is designed first for churches in the United States, and this section is a summary, not a legal opinion.
European Economic Area, United Kingdom and Switzerland
You may ask the church (and, for what we do as ourselves, us) to give you access to your information, correct it, erase it, restrict its use, give you a copy in a portable form, and stop using it for a purpose you object to. If you gave consent you may withdraw it at any time. You may complain to your national data protection authority (in the UK, the Information Commissioner's Office). Information about your religious beliefs gets extra protection: a church needs a specific legal ground to use it, most often your explicit consent. If your information leaves your country, the church and GiftWell must protect it in the ways the law requires; see where data is stored.
California and other US states
Residents of California and of a growing number of other states (including Colorado, Connecticut, Oregon, Virginia, Texas and others) may have the right to know what is held about them, correct it, delete it, receive a copy, and say no to the sale of their information, to targeted advertising and to profiling. Many of these laws treat information about religious beliefs as sensitive and require your opt-in before it is used. We do not sell information and do not share it for advertising. We use sensitive information only to run the service for your church and to produce the deidentified statistics above. We will not treat you differently for using any of these rights. To use one, follow the steps in Your rights; a church may handle it itself. Where an authorised agent writes for you, we will ask for proof.
Canada
You may ask to see, correct and withdraw consent for the personal information held about you, and to complain to the Office of the Privacy Commissioner of Canada or your province's regulator. In Quebec, information about religion is sensitive and needs your express consent, and a church or company must name someone responsible for protecting personal information; the contact above is that person until we say otherwise.
Brazil, Australia and elsewhere
Most countries that have a privacy law give you rights to access, correct and delete your information and to complain to a regulator. Religious belief is sensitive information in Brazil's LGPD and in Australia's Privacy Act. Write to the contact above and we will use the same steps.
Information about children
See the section for parents and guardians. Several laws set special rules for children (in the US, under 13 under the federal COPPA law, and higher ages in some states; in the EU, a country-by-country age between 13 and 16 below which a parent must agree to online services).
Security
Results are reached only by a private link or by signed-in church staff. Exactly what is encrypted in the database: the “something you have walked through” answer, the private confirmation links, the church's Planning Center and AI credentials, and temporary files of data being imported. Everything else (your name, email, answers, scores, what you wrote, faith and baptism answers, your story, Spirit-gift answers, the Planning Center details copied for the church, and staff notes) is stored as ordinary database values and protected by access rules, not by field-level encryption. Passwords are stored as one-way hashes, and agent tokens as one-way hashes. Connections are encrypted in transit. Full backup and migration files are locked with a passphrase. No system is perfectly safe; if something goes wrong that affects you, the church and we will tell you, and, where the law sets a deadline for that, within it.
Where data is stored
GiftWell's database and servers are in United States (Amazon Web Services, us-east-2, Ohio). If you or your church are outside the United States, taking part means your information is sent to and stored in the United States. Some of the companies on the list above are US companies, or can process data outside your country; where the law requires a safeguard for that, such as the EU's Standard Contractual Clauses or the EU-US Data Privacy Framework, it is the church's and GiftWell's job to put one in place. The data processing addendum says how.
Changes
We will post changes here and update the date at the top. If a change is material, we will say so on this page and email church owners before it takes effect. The version history below lists what changed.
Who we are and how to reach us
GiftWell is provided by Zao, the parent company of DiscipleOS. GiftWell is part of the DiscipleOS family of products. DiscipleOS is a subsidiary of Zao.
Privacy and data requests: hello@giftwell.appEverything else: hello@giftwell.app
Version history
We keep this list so you can see what changed and when. If a change is one you would reasonably care about (for example, a new kind of data we collect or a new sub-processor), we will say so at the top of the page and email church owners before it takes effect.
- . Described how pastors follow up after a result: the walked-through and conversation log (who and when, never what was said), placing a person on a ministry and checking 30 and 90 days later whether they are serving (by the pastor's own answer, or by a read-only Planning Center check matched only by a linked profile or one exact email, and never for anyone who did not share or may be under 18), the staff-only view of ministry needs against people who could serve, and a weekly email to church staff naming people who shared and are still waiting. The email never goes to the people it lists, and goes out on a day and hour each church chooses in its own timezone (by default Monday 8:00 am Pacific). A person's My GiftWell download and printable page now also include the follow-up record kept about them (placements, the dates of conversations and walk-throughs, and the Planning Center team or group that was checked), and only theirs. Flagged for counsel review.
- . Clarified what the optional staff-only AI first look is sent: it also includes the Ephesians 4 first look and any self-reported profile result (such as Enneagram or Myers-Briggs) a pastor recorded for the person, and where the gifts each serving team asks for fall in the person's bands. The same consent and age rules apply, and the never-sent list is unchanged.
- . Added My GiftWell, a passwordless page where a person signs in with a one-time emailed code to see their own results over time, ask for one retake reminder email, and download or delete their own results. Described the code and session handling, what is and is not shown, the reminder, and the new retention periods. Flagged for counsel review.
- . Disclosed that GiftWell itself may use an AI provider (models routed through OpenRouter) for the platform-level "Ask the platform" analyst, sent only suppressed, rounded, anonymous aggregate tables and never names, emails, free text or individual assessments; listed it as a sub-processor; and stated plainly that platform administrators can open any church's workspace for support and operations, with each access recorded in the audit log.
- . Rewrote the terms and privacy pages; added the data processing addendum and the sub-processor list; spelled out what each role (taker, church, parent or guardian) can see and do; added regional rights, cookies, retention, and what GiftWell does not do. GiftWell's own fonts are now served from GiftWell itself.
GiftWell is part of the DiscipleOS family of products. DiscipleOS is a subsidiary of Zao.