Privacy Policy

Prayer request data — When a congregant or staff member submits a prayer request, we collect: first name, last name, request details, category, hospital name (if applicable), the submitter's name, and dates (start and expiration).

Note: Prayer request data may include sensitive information such as health conditions, family circumstances, or other personal matters. Please only submit information that the subject has consented to share.

Account data — For authenticated staff users (admins, operators, and kiosk accounts), we collect name, email address, and role. Authentication is managed by Lifted. Passwords are securely hashed and are never stored in plain text. Email addresses are used to send transactional messages such as account invitations and password resets.

Prayer request data — Prayer requests submitted through Lifted are displayed on screens visible to the congregation. By submitting a request with knowledge that it will be publicly displayed within the church, the submitter is deliberately making that information available to others. We therefore rely on two legal bases depending on how a request is submitted:

• Article 9(2)(e) — data manifestly made public by the data subject — applies where a congregant submits a request themselves, with knowledge that it will be displayed on a screen visible to the congregation.
• Article 9(2)(a) — explicit consent — applies as a fallback where a staff member submits a request on behalf of a third party (such as a congregant who is not present, or a minor). In these cases, the Organization is responsible for ensuring appropriate consent has been obtained before submission.

Organizations are responsible for determining and documenting the correct legal basis for each submission within their operational context. Lifted processes data only as instructed by the Organization and does not independently verify consent for individual submissions.

Right to withdraw — Where processing is based on explicit consent, data subjects have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of any processing that took place prior to withdrawal. To exercise this right, contact your church directly — they are the data controller and are responsible for actioning withdrawal requests.

Staff account data — Account data for admins, operators, and kiosk users is processed on the basis of the contractual relationship between Lifted and the Organization.

Prayer requests may contain special category data under applicable data protection law, including health information (e.g. hospital admissions), religious beliefs, and family circumstances. This data is processed solely for the purpose of displaying and managing prayer requests within the Organization's platform. It is not used for any other purpose, shared with third parties, or used for profiling or advertising.

Organizations should not submit prayer requests containing sensitive data about individuals without their knowledge or consent. Where a request is submitted about a third party (including a minor), the Organization is responsible for ensuring appropriate authorization exists before submission.

Prayer request data is used solely to display requests on screens within the church and to allow authorized staff to moderate and manage those requests.

Account data is used to authenticate staff, enforce role-based access within the platform, and send transactional emails (such as invitations to join an Organization and password reset links).

We do not sell personal data. We do not use personal data for third-party marketing or advertising.

Prayer requests are retained until they expire (as configured by the Organization's staff) or are explicitly deleted by an admin. Organizations control their own retention timelines for live data.

Infrastructure-level backups maintained by our hosting provider (Railway) may retain copies of data for up to 7 days beyond deletion from the live platform. These backups are not accessible to Lifted staff in the normal course of operations.

Account data is retained for as long as the account remains active. When an account is removed by an Organization admin, associated data is deleted from the live platform.

In the event of a personal data breach, Lifted will notify affected Organizations without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, the categories and approximate number of individuals affected, likely consequences, and measures taken or proposed to address it. Organizations, as data controllers, are responsible for notifying their relevant supervisory authority and affected individuals where required by applicable law.

Lifted implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or disclosure. These measures include:

• Application hosting and database storage on Railway, which provides encrypted volumes and infrastructure-level security on Google Cloud Platform
• Authentication managed by Lifted with securely hashed password storage
• Role-based access controls limiting data access to authorized staff within each Organization
• No passwords stored in plain text

No method of transmission or storage is 100% secure. Organizations are responsible for managing their staff access and ensuring kiosk accounts are appropriately secured within their environment.

Lifted uses the following third-party sub-processors to operate the platform:

Railway's infrastructure operates on Google Cloud Platform. Each sub-processor is engaged under a data processing agreement. We will notify Organizations at least 14 days before making any material changes to our sub-processor list.

Lifted's infrastructure is hosted in the United States. If your Organization is located in the United Kingdom, European Union, or another jurisdiction with data transfer restrictions, please be aware that your data will be processed in the US. We rely on appropriate safeguards — including Standard Contractual Clauses and data processing agreements with our sub-processors — to govern these transfers. If your Organization requires specific transfer documentation, please contact us at hello@lifted.app.

Depending on where you are located, you may have rights under applicable data protection law, including the right to:

• Access the personal data held about you
• Correct inaccurate data
• Request deletion of your data
• Withdraw consent (where processing is based on consent)
• Restrict or object to processing
• Data portability (where applicable)
• Lodge a complaint with your local data protection supervisory authority

To exercise these rights, contact your church directly — they are the data controller for your personal data and are responsible for actioning requests. Lifted will process all erasure requests received from data controllers within 30 days as follows:

• If the request concerns a prayer request subject, all records where that individual appears as the subject will have their first name, last name, details, and hospital name removed in full
• If the request concerns a submitter, all records where that individual appears as the submitter will have their name removed

A non-identifying anonymized record is retained for statistical and audit purposes, containing only the request category and submission metadata.

Lifted is not directed at minors. Prayer requests submitted about or on behalf of minors should only be submitted by a parent, guardian, or authorized church staff member. Organizations are responsible for ensuring appropriate consent exists before submitting personal data relating to minors.

Each Organization that uses Lifted is the data controller for the personal data of their congregants. Lifted is the data processor — we process data only as instructed by the Organization and do not use it for any purpose outside of operating the platform on their behalf. Organizations that require a Data Processing Agreement (DPA) with Lifted may request one at hello@lifted.app.

Lifted uses functional cookies and session tokens to maintain authenticated staff sessions. These are strictly necessary for the platform to operate and are managed directly by Lifted. We do not use advertising cookies or third-party tracking cookies.

Lifted's primary infrastructure and operations are based in the United States. Depending on the location of your Organization and its congregants, U.S. state privacy laws (including the California Consumer Privacy Act and similar state-level legislation) may apply. We are committed to honoring applicable rights under these frameworks. If you have questions about your rights under U.S. state law, please contact us at hello@lifted.app.

We will provide Organizations with at least 14 days' notice before making any material changes to this policy. Continued use of the platform after that period constitutes acceptance of the updated policy. The current version will always be available on our website.

For requests related to your personal data (access, correction, deletion, or withdrawal of consent), please contact your church directly.

For questions about Lifted's data practices, sub-processor list, or to request a Data Processing Agreement, contact us at hello@lifted.app.