Your data, handled with care.

“HeyPew”, “we” and “us” mean the team that runs the HeyPew service. To ask about this policy or your data, contact us through the form on our demo page, saying in the message what you need.

For church administrators and people who ask us for a demo or an order, we decide how your data is used (we are the data controller).

For a church's own content, the church is responsible for what it publishes on its pages and we host it on its behalf (we are its data processor).

When you request a demo or order tags: your church's name, your name and role, phone number, and optionally your email, city, congregation size, the products, quantity and plan you're interested in, and your message.

When we create an account for you: your email address, your password (stored only in scrambled, hashed form, which no one can read), when you last signed in, and which church you manage.

What churches put on their pages: page titles, links, logos, cover photos and colours.

When someone taps a tag or opens a church page: the time, which tag or page, the type of device (phone, tablet or computer), the country, and how they arrived (NFC tap, QR scan or link). We do not store visitors' IP addresses or names, and we don't use tracking cookies on church pages. Visits from link-preview bots, such as WhatsApp's, aren't counted.

• To reply to your demo or order request, by phone, WhatsApp or email. This is necessary to take the steps you asked for.
• To create and run your church's account, sign you in, and keep it secure. This is necessary to provide the service you signed up for.
• To show churches how many people connected, and how, in their dashboard. This is in the church's legitimate interest and uses no personal data about visitors.
• To protect the service from abuse, for example by limiting how often one connection can request pages.

We don't sell personal data, and we don't use it for advertising.

Church pages and our website don't use advertising or tracking cookies. When an administrator signs in, we use a cookie to keep them signed in. It's needed for the dashboard to work and is removed when they sign out.

We use a small number of trusted providers to run HeyPew. They process data only on our instructions:

• Supabase: our database, sign-in and file storage, hosted in London, United Kingdom.
• Vercel: hosts our website and pages. Our servers run in London, and pages are delivered through its global network. Like most hosts, Vercel briefly processes visitors' IP addresses to deliver pages and block attacks.

Because these providers are outside Nigeria, your data is transferred abroad. We only use providers with strong security and contractual data protection commitments, as the NDPA requires. We may also share data if the law requires it.

• Demo and order requests: for as long as we need them to serve your church, then deleted. Ask us and we'll delete them sooner.
• Accounts and church pages: for as long as the church uses HeyPew. When a church leaves, we delete its account, pages, tags and visit records on request.
• Visit records: shown in the dashboard for the period the church's plan includes.

All traffic to HeyPew is encrypted (HTTPS). Passwords are hashed, sign-in links work only once and expire, and each church's data is kept separate at the database level, so administrators only ever see their own church. Access to our systems is limited to the people who need it.

Under the NDPA you can ask us to:

• tell you what personal data we hold about you, and give you a copy
• correct anything that's wrong
• delete your data
• stop or limit how we use it, or object to a use
• move your data to another service

To use any of these rights, contact us through the form on our demo page, saying in the message what you need. We'll reply within 30 days. If a request is about a church's page, we may pass it to that church, since it controls that content.

If you're unhappy with how we've handled your data, you can complain to the Nigeria Data Protection Commission.

HeyPew accounts are for adults acting for their church. We don't knowingly collect personal data from children. Church pages can be visited by anyone, and we don't collect personal data from visitors.

If we change how we use personal data, we'll update this page and the date at the top, and tell church administrators about significant changes. See also our terms of service.