Privacy Policy

Introduction

We are committed to protecting the privacy and security of every individual whose data passes through our platform including church administrators, leaders, members, and first-time visitors.

By creating an account, joining a church on HovaSee, or submitting information through a public HovaSee form, you agree to the practices described in this policy. If you do not agree, please discontinue use of the platform.

This policy is governed by the Nigeria Data Protection Regulation (NDPR) and its implementing guidelines issued by the National Information Technology Development Agency (NITDA).

Information We Collect

Depending on how you interact with HovaSee, we may collect the following categories of information.

A. Account Information

When creating an account, we may collect:

• Full name
• Email address
• Phone number
• Password (encrypted through our authentication provider, Supabase Auth)
• Profile photograph (optional)
• Authentication provider (Email/Password or Google OAuth)
• Account preferences and notification settings

B. Church & Organization Information

Church administrators and owners may provide information including:

• Church name and church code
• Branch information (names, slugs, settings)
• District, zone, and small group structure
• Department and team structure
• Workforce hierarchy and leadership assignments
• Reporting schedules and templates
• Organizational settings (e.g. self-join policies, default join roles)

C. Membership Information

Churches may store member records including:

• Full name, phone number, and email address
• Gender, date of birth, and marital status
• Residential address and occupation
• Emergency contact details
• Branch, district, zone, and small group assignment
• Workforce team and department memberships
• Leadership role assignments and scope

Churches determine which fields they choose to collect. HovaSee provides the infrastructure; the church is the data controller for member records.

D. Visitor & Assimilation Information

When a visitor submits information through a public HovaSee first-timer form (e.g. /c/[churchCode]/b/[branchSlug]/first-timers), we may collect:

• Full name, phone number, and email address
• Residential address, age range, gender, and marital status
• Occupation and how they heard about the church
• Prayer requests and interests
• First-time visit information and follow-up history
• Assimilation status and lifecycle status change history
• Notes entered by church leaders during the follow-up process

Public first-timer forms do not require a login and are submitted anonymously to HovaSee's servers on behalf of the relevant church.

E. Workforce Information

Churches may manage workforce records including:

• Teams and departments
• Roles and leadership assignments
• Rotation schedules and rotation history
• Service history and attendance
• Training records and approval history

F. Report Information

Church leaders may submit operational reports including:

• Attendance and financial figures
• First-timer and new convert counts
• Prayer requests and ministry activities
• Workforce and follow-up metrics
• Custom report fields defined by the church
• Report drafts, submission timestamps, and completion status

G. Workflow & Automation Information

HovaSee stores workflow information necessary to automate church operations, including:

• Workflow definitions and block configurations
• Workflow instance state and execution progress
• Approval decisions and escalation history
• Assignment history and rotation history
• Automation logs and notification delivery logs

H. Device & Usage Information

When accessing HovaSee we may automatically collect:

• IP address, browser type, and device information
• Operating system and time zone
• Pages visited, session duration, and navigation patterns
• Error logs and platform health signals

This information helps us improve platform security, reliability, and user experience. It is not used to build advertising profiles.

Information Submitted Through Public Forms

HovaSee provides public-facing forms that allow individuals to submit information without creating an account. These include the first-timer capture form available at /c/[churchCode]/b/[branchSlug]/first-timers.

Information submitted through these forms is processed on behalf of the relevant church organization. The submitting individual should be aware that:

• Their submission is received by the church they are visiting, not solely by HovaSee.
• Their information may be used by church leaders to follow up with them directly via phone, email, or messaging platforms such as WhatsApp.
• Their assimilation status and follow-up history will be tracked within the platform by authorized church leaders.
• Prayer requests and personal notes may be visible to assigned follow-up team members within the church.

We encourage churches using HovaSee to inform visitors at the point of form submission how their data will be used, consistent with NDPR consent requirements.

How We Use Your Information

We use information collected through HovaSee for the following purposes:

A. Platform Operations

• Creating and managing user accounts and church organizations
• Processing role assignments, invitations, and join requests
• Enabling report requests, submissions, drafts, and compliance tracking
• Running workflow automations (first-timer follow-up, escalations, rotations)
• Managing workforce departments, teams, and scheduling
• Supporting guest assimilation tracking and lifecycle management

B. Communications & Notifications

• Sending report reminders, workflow assignments, and escalation alerts
• Delivering invitation and join request notifications
• Notifying leaders of visitor follow-up tasks and approvals
• Sending security alerts and account-related communications

C. Analytics & Reporting

• Generating dashboard metrics (branches, members, compliance rates, overdue reports)
• Producing report aggregates and trend data for church leadership
• Tracking reporting coverage and church health signals

D. Platform Improvement

• Diagnosing errors and improving platform reliability
• Understanding usage patterns to guide feature development
• Monitoring security and preventing unauthorized access

E. Legal & Compliance

• Complying with applicable Nigerian law and NDPR obligations
• Responding to lawful requests from regulatory authorities
• Enforcing our Terms of Service and resolving disputes

We do not use your information for targeted advertising. We do not sell, rent, or trade personal information to third parties for their own marketing purposes.

Notifications and Communications

HovaSee may send notifications through the following channels:

• Email — via Resend, our transactional email provider
• WhatsApp — via the WhatsApp Business API, where enabled by your church
• In-app notifications — delivered within the HovaSee platform
• SMS — where enabled (future capability)
• Push notifications — planned for future mobile support

Notification types may include:

• Report reminders and overdue report alerts
• Workflow assignments (first-timer follow-up, escalations, rotations)
• Visitor follow-up tasks and reassignment alerts
• Approval requests from automated workflows
• Invitation acceptance and join request updates
• Security alerts (e.g. new login, password changes)

Church administrators control which notification channels are active for their organization. Individual users may manage their personal notification preferences within their account settings. Some security-related notifications cannot be disabled as they are essential to account safety.

Workflow Automation & AI Features

A. Workflow Automation

HovaSee operates a block-based workflow engine that automates operational processes on behalf of churches. Automated workflows may:

• Assign first-time visitors to follow-up teams and notify those teams automatically
• Wait for conditions to be met (e.g. visitor status changes) before proceeding
• Escalate unresolved follow-up cases to church administrators for review and approval
• Rotate workforce team assignments on a scheduled basis
• Update record statuses and create internal approval requests
• Log each block execution in workflow event records for audit purposes

Workflow definitions are created and configured by church administrators. HovaSee executes these definitions on a scheduled basis via Vercel cron jobs. Workflow execution logs are retained as part of your church's operational record.

B. AI Features

HovaSee may use artificial intelligence to provide:

• Intelligent operational insights and dashboard summaries
• Automated recommendations for report follow-up and compliance improvement
• Predictive analytics to help leadership identify at-risk attendance or reporting gaps
• Natural language processing for report generation and summarization

Where AI features process personal data, we apply data minimization principles — the AI receives only the data necessary to produce its output. AI-generated insights are advisory and not used to make legally significant automated decisions about individuals without human review.

Data Ownership and Retention

A. Data Ownership

Churches retain ownership of all data they create and manage within HovaSee. This includes:

• Member and visitor records
• Submitted reports and report templates
• Workforce and department data
• Workflow definitions and automation configurations
• Analytics, aggregates, and trend data
• All operational records generated through use of the platform

HovaSee is a data processor acting on behalf of each church organization, which is the data controller for the personal data of its members and visitors.

B. Retention Periods

We retain different categories of data for different periods:

• Account data — retained for the lifetime of your account and for up to 90 days after account deletion to support recovery requests
• Church & member records — retained for as long as the church organization remains active on HovaSee
• Workflow execution logs — retained for 12 months by default, then purged or anonymized
• Report submissions — retained indefinitely unless deleted by the church administrator
• Visitor & assimilation records — retained for as long as the church organization is active, unless deleted by an authorized administrator
• Device & usage logs — retained for up to 90 days for security and reliability purposes

C. Account Deletion

If you delete your HovaSee account, we will anonymize or purge your personal account data (name, email, phone) within 30 days. Church-level operational records (reports, workflow logs, member records you created) may be retained by the church organization in anonymized form. Contact us if you require full erasure of specific records.

Sharing of Information

We do not sell personal information. We share information only in the following circumstances:

A. Within Your Church Organization

Information you provide, including your profile, role, branch assignment, and contact details, is visible to other authorized members and leaders within your church on HovaSee, consistent with the role-based access controls configured by your church administrator.

B. Trusted Service Providers

We share data with third-party providers that help us operate HovaSee. These providers process data only as necessary to deliver their services and are contractually bound to protect it:

• Resend — transactional email delivery
• Meta / WhatsApp Business API — WhatsApp message notifications
• Hosting Providers — cloud hosting, cron job execution, and serverless functions
• Analytics providers — platform usage analytics (anonymized where possible)
• Payment processors — billing and subscription management

C. Legal Requirements

We may disclose information when required to do so by law, court order, or a lawful request from a Nigerian regulatory authority, including NITDA, or when necessary to protect the rights, property, or safety of HovaSee, our users, or the public.

D. Business Transfers

If HovaSee is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify affected users before any such transfer takes place and before information becomes subject to a different privacy policy.

Security Measures

We take the security of your data seriously and implement multiple layers of protection:

• Encryption in transit — all data transmitted between your device and HovaSee is encrypted using TLS (HTTPS)
• Encryption at rest — data stored in our database is encrypted at rest through Supabase/PostgreSQL infrastructure
• Row Level Security (RLS) — database access is enforced at the row level, ensuring users can only access data within their authorized church and role scope
• Authentication security — passwords are hashed and never stored in plain text; Google OAuth is available as a secure sign-in alternative
• Role-based access control (RBAC) — every API endpoint and UI section enforces permission rules based on the user's church role and assignment scope
• Serverless execution isolation — workflow processing and public hooks run in isolated serverless functions on Vercel
• Access controls — internal access to production data is restricted to authorized personnel
• Security monitoring — error logs and access patterns are monitored to detect and respond to suspicious activity

While we take every reasonable precaution, no system is entirely immune to risk. We encourage users to use strong, unique passwords and to report any suspected security incidents to us immediately at security@hovasee.com.

Your Rights Under the NDPR

Under the Nigeria Data Protection Regulation (NDPR), you have the following rights regarding your personal data:

• Right to Access: You may request a copy of the personal data we hold about you at any time.
• Right to Correction: You may ask us to correct inaccurate or incomplete personal data. Most profile fields can be updated directly in your HovaSee account settings.
• Right to Deletion (Right to be Forgotten): You may request the erasure of your personal data, subject to our legal obligations and the legitimate interests of your church organization. We will respond within 30 days.
• Right to Data Portability: You may request a copy of your personal data in a structured, machine-readable format (e.g. JSON or CSV) where technically feasible.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Object: You may object to certain types of processing, including processing for analytics or non-essential communications.
• Right to Lodge a Complaint: If you believe your data rights have been violated, you have the right to lodge a complaint with NITDA, the Nigerian data protection supervisory authority.

To exercise any of these rights, contact us at privacy@hovasee.com. We will acknowledge your request within 72 hours and respond in full within 30 days. We may ask you to verify your identity before processing requests that involve access to or deletion of personal data.

Cookies and Tracking

HovaSee uses cookies and similar technologies to keep you signed in and to support platform functionality. Specifically:

• Authentication cookies — set by Supabase Auth to maintain your login session. These are strictly necessary and cannot be disabled without breaking platform access.
• Preference cookies — store your interface preferences (e.g. sidebar state, theme) for a better experience across sessions.
• Analytics cookies — used to understand how the platform is used in aggregate. Where possible, this data is anonymized.

We do not use advertising cookies or permit third-party advertising trackers on HovaSee. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to log in and use the platform.

Children's Privacy

HovaSee is not intended for use by individuals under the age of 13. We do not knowingly collect personal information directly from children under 13.

Churches may maintain member records that include minors (e.g. children's ministry rosters or youth group members). In such cases, the church is responsible for obtaining appropriate parental or guardian consent before entering a minor's personal information into the platform. HovaSee provides the tools; the church is the data controller for those records.

If you believe we have inadvertently collected personal data from a child under 13 without appropriate consent, please contact us at privacy@hovasee.com and we will take prompt steps to delete that information.

Third-Party Links and Integrations

HovaSee may contain links to third-party services or integrate with external platforms (e.g. WhatsApp, Google). These third parties have their own privacy policies and we are not responsible for their data practices. We encourage you to review the privacy policies of any third-party services you interact with through or alongside HovaSee.

Our current third-party integrations and their relevant policies include:

• Google OAuth — Google Privacy Policy
• Resend — Resend Privacy Policy
• WhatsApp Business API (Meta) — WhatsApp Privacy Policy
• Hosting Providers — Vercel Privacy Policy

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our platform, legal requirements, or data practices. When we do:

• We will update the "Last Updated" date at the top of this page.
• For material changes, we will notify church administrators and account holders via email and/or an in-app notification at least 14 days before the change takes effect.
• Continued use of HovaSee after the effective date of any update constitutes acceptance of the revised policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how your personal data is handled, please contact us:

• Email: privacy@hovasee.com
• Security issues: security@hovasee.com

For data rights requests (access, correction, deletion, portability), please email privacy@hovasee.com with the subject line "Data Rights Request" and include your full name and the email address associated with your HovaSee account. We will acknowledge your request within 72 hours.

For complaints relating to NDPR compliance, you may also contact the National Information Technology Development Agency (NITDA) directly at info@nitda.gov.ng.