Privacy policy

1Who manages your data

This website belongs to Gereja Isa Almasih (GIA) Kudus. The church is responsible for personal data collected through this site, in line with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022).

Site content is managed by church staff through the admin panel. Technical maintenance is handled by the site’s technical administrator (developer).

2When you read the site

• You don’t need to sign up or log in. We don’t show ads or use ad trackers or third-party analytics.
• Two small cookies remember your choices for a year: “bahasa” (Indonesian/English) and “tema” (light/dark). Neither is used to track you.
• The hosting provider’s servers log technical visit data, such as IP address, browser type, and pages opened, for security and troubleshooting.
• To prevent abuse (for example, forms sent over and over), your IP address, and on the login form also your email address, is turned into a one-way random code (hash) and kept for at most two days.
• Site search terms are not stored in our database.

3Prayer request form

• What we receive: the request type, the request itself, whether it may be prayed for in the prayer fellowship without your name, and, if you fill them in, your name and phone/WhatsApp number or email. Your name is optional; contact details are required for counselling and visits.
• We process it based on the consent you give in the form.
• Requests are read and followed up by the prayer & pastoral team. Other staff (admins, office, multimedia, group leaders) cannot see them. The site’s technical administrator has access only for system maintenance and security.
• Requests are never sent by email; the team reads them in a panel protected by a password and an email verification code.
• Requests are deleted automatically 90 days after they are sent. The prayer team can delete them sooner, and you can ask for this through the church office.
• Status changes are logged without your name, contact details, or request.

4GIA Assistant (Gia)

• The questions you type are sent to a third-party AI service provider, together with church information from this site, to compose an answer.
• We don’t store conversations in our database or write them to server logs. Chat history stays only in your browser tab and disappears when you close it.
• The AI provider may process and keep your questions under its own terms, including to improve its services. Don’t share personal data or confidential matters in the chat; for personal matters, use the prayer request form or contact the church.

5Photos, videos, and the bulletin

• Event photos in the gallery may show members of the congregation. Photos that still contain location (GPS) data are rejected on upload. If you object to a photo of you being shown, contact the church office and it will be taken down.
• Videos play from YouTube in privacy-enhanced mode (youtube-nocookie.com). The player only loads after you press play; from then on, YouTube’s privacy policy applies.
• The weekly bulletin may include names of church members (for example birthdays or prayer topics) and may open from the church’s Google Drive, where Google’s privacy policy applies. If you object to your name being included, contact the church office.

6Staff accounts (admin panel)

• Staff who register provide their full name, username, email, password, and the role and group they request. This data is used to manage access to the panel.
• Passwords are stored as a hash by the authentication service, so no one can read them. Each time you log in, a 6-digit code is sent to your email.
• Emails we send: registration confirmation, login codes, links to create a new password, notices of password, role, or account decisions, and account deletion. Account approvers are notified of new registrations (name, username, and requested role).
• While you are logged in, a session cookie keeps you signed in to the panel.
• Changes to site content and account decisions are logged (who, when, and what changed) for security and accountability. These logs are kept after an account is deleted.
• You can change your name, username, and password, or delete your own account, on the panel’s Account page.

7Storage and third parties

• We use service providers for site hosting, the database and file storage, email delivery, Cloudflare Turnstile anti-bot protection on forms, request limiting, and the AI service for Gia. Some of their servers are outside Indonesia, including in Singapore and Japan.
• Data travels over encrypted connections (HTTPS), and access to personal data is limited by staff role.
• We don’t sell your data or share it for advertising.

8Your rights

You have the right to request a copy, correction, or deletion of your personal data, and to withdraw consent you have given, for example by asking for your prayer request to be deleted early. Contact the church office using the details below; we will respond as soon as possible.

9Changes to this policy

We update this policy when the way the site works changes. The date of the last update is shown at the top of this page.

10Contact us

For questions, or to request a copy, correction, or deletion of your data, contact the church office:

Gereja Isa Almasih Kudus

Address

Jl. Kepodang 13, Kudus 59317

Phone

+62 291 432773

Email

giakudus@gmail.com