Privacy

How EmmauOS handles what you tell it

Last updated: October 21, 2026 · Version 2026-10-21 · Version history

Anonymous, combined statistics

In practice: only people who checked the box to share their results with the church’s pastoral team are counted; anyone who may be under 18 is counted only inside one combined “under 18” group, and only when that group is large enough; results are grouped no finer than a church’s size, tradition or country or state, never a city or a church; and a statistic about a group is hidden unless it describes at least 10 people from at least 3 different churches. A church that opts out in Settings is left out of the combined numbers from then on. Only EmmauOS’s platform administrators can see these statistics, and each time they look or download them it is recorded in an audit log.

Our commitment about deidentified information. EmmauOS publicly commits to maintain and use these combined statistics only in deidentified form, and not to attempt to reidentify them. If EmmauOS ever gives deidentified information to another party, it will require that party by contract to make the same commitment.

EmmauOS's own use of an AI provider

Separately from the optional first look above, EmmauOS itself may use an AI provider (models routed through OpenRouter, as EmmauOS's configuration sets) for an "Ask the platform" analyst. Only EmmauOS's platform administrators can open it, and it is used to understand the combined statistics, not any one church or person. It is off unless EmmauOS has set up its own key for it; without one, the page shows plain rule-based insights.

• What is sent for the analyst: only suppressed, rounded, anonymous aggregate tables: groups that are too small are hidden and the numbers are rounded. Never names, emails, free text, church names, or any individual's assessment or answers.
• The administrator's question is screened before it is sent. A question that names a church, or holds an email address or a phone number, is refused, and the question is limited to 300 characters. This screen is automatic and cannot recognize every possible name, so administrators are also instructed to ask only about the combined numbers.
• What the provider keeps: EmmauOS asks that data collection be denied where the provider supports it, so that providers that keep or train on prompts are not used. That request is made on OpenRouter; if EmmauOS ever points the analyst at a different provider that has no such setting, that provider's own terms apply. The provider is listed on the sub-processors page.
• This never involves a church's own AI key, and it is not used for anyone's first look.

Feedback. When a church's staff send feedback with "Send feedback", or a reader leaves a comment on a documentation page, the same AI provider reads it once a day to sort it: whether it is a bug, an idea or a question, and whether it fits what EmmauOS is for. Email addresses and phone numbers are removed before it is sent, and the sender's name and church are never sent. An idea EmmauOS takes up is written up anonymously, in EmmauOS's own words and never quoted, as a private issue on GitHub, where EmmauOS's developers plan their work. Anything the AI is unsure about is decided by a person. If you checked "You may email me back", EmmauOS emails you once what you asked for is live; documentation comments are anonymous and are never answered by email.

The search box in EmmauOS's public documentation can also write a short answer to a question, using Cloudflare AI Search and models Cloudflare runs. It is sent the question typed into the box, with any email address or phone number taken out by EmmauOS first, and it answers only from EmmauOS's public documentation, comparison pages, feature notes, the words of its product films and its blog posts. It is never sent anything about a church, a person or an assessment, so please do not type personal details into it. EmmauOS does not store or log the question; a finished answer is kept for a day under a scrambled form of the question, so the same question can be answered again without asking Cloudflare. When this is not set up, or the day's limit is reached, the box searches the pages by keyword on EmmauOS's own server and nothing is sent. Cloudflare is on the subprocessors list.

EmmauOS staff access to a church's workspace

People with an EmmauOS platform-administrator role can open any church's workspace, including what the church's own pastors can see, in order to support the church and to run the service. When an administrator opens a church they are not a member of, that access is recorded in the audit log (the page opened, never what was looked at, and no more than once an hour for each administrator and church). Viewing or downloading the combined statistics is recorded too. This repeats, in one place, what the sections on who can see your result say.

Who is who

• The church (for example, the church whose page you used) decides why and how your answers are used. In privacy-law terms it is the "controller" (or, in California, the "business"). It is responsible for telling you what it does with your answers, for having a legal basis to collect them, and for answering your requests about them.
• EmmauOS (Zao) runs the software and keeps your answers for the church. In privacy-law terms it is the church's "processor" (in California, its "service provider"). It acts on the church's instructions, which are the settings the church chooses, and under the data processing addendum.
• EmmauOS is in charge of its own purposes for: the accounts of the people who sign in to run a church's EmmauOS; plan and payment records; security and abuse logs; messages sent to us; the emails EmmauOS sends at a person's request (a result shared with a friend, and a "my gifts" link); and the anonymous, combined statistics above. For these EmmauOS is a controller. Whether the statistics make EmmauOS a controller of the data they come from is a question we have flagged for our lawyers.

EmmauOS is a subsidiary of Zao.

If you took the assessment

What we collect

• Your name and, if you give it, your email address.
• Your answers to the questions, and the scores and bands worked out from them.
• If you choose to write them: who or what you care about, what you are good at, what your life allows right now, what you would love to grow in, your faith and baptism answers, how you came to faith, and something you have walked through. These are religious or deeply personal information, and are kept only as described below.
• If you are asked and agree: your answers about the gifts of the Spirit.
• Your age band (for example "25 to 34"), if the church asks for it. We keep the band, not your birthday. If the church uses Planning Center we may also hold your birth year from there.
• If the church links you to Planning Center and you shared your results with its pastoral team: your gender, whether there are children in your household, and the town of your address (never the street), from Planning Center. These are used only to order the introductions a pastor might make (for example, putting people close in age first) and to suggest groups that fit you (near you, for your stage of life, and men's or women's groups only to men or women). They are never shown to anyone, never decide whether you are suggested for an introduction, and someone who may be under 18 is never suggested alongside an adult or offered an adults' group.
• Details the church already holds about you, if it connects Planning Center: for example groups, teams and positions, household, check-in history and a few facts from your profile. EmmauOS keeps a copy of these in the church's account so the church can see them next to your result, and re-reads it from Planning Center about once a day (read-only) so it stays current.
• What the church's pastors record about following up with you: that they walked through your result and when, that they had a conversation with you and when (never what was said), and the ministry they placed you on and when. EmmauOS also writes these, and any serving team you said you would like to try, as dated lines on the church's timeline for you, which only the church's staff see. If the church connects Planning Center and you shared with the pastoral team, EmmauOS also keeps, for as long as that placement is being followed, the name of the Planning Center team or group that ministry is linked to, the date you were last scheduled on it and whether your membership looks current.
• The ordinary technical details of a web request: your IP address and browser type, in the sign-in session records and in server logs.
• If you use "tell a friend": the friend's email address and the message you wrote.
• If you sign in to My Path: a one-time code (kept only as a keyed hash, never as typed) and the session that sign-in starts. If you check "remind me to retake": a date, and a note that you asked for it, but not a second copy of your email address.
• If you ask two people to confirm your gifts: what they write goes only to the pastors, and you never see it.

The three checkboxes

• Share my results with the pastoral team. Lets the church's team follow up with you by name, and includes you in introductions, spreadsheets and the church's tools. It is also what makes an optional AI first look possible, and what counts you in the anonymous statistics above.
• Gifts of the Spirit answers. Only asked if the church includes that part, and only kept if you check it.
• Planning Center. Only if the church connects it and asks: lets the church write the results described under "Planning Center" below to your Planning Center profile.

We record when you checked, or did not check, each one.

Who can see it

• You, from the private link to your results.
• The church's pastors (and its admins and owner, who have pastor-level access) can open your result in the app and read everything you wrote, your faith and baptism answers and your story, even if you did not check the box to share your results. Leaders and viewers on the church's team can read what you wrote, and your faith and baptism answers and story, only if you did check it. If you did not check it, you are marked do-not-contact, and your answers stay in the app: you are left out of the spreadsheet (CSV) export, introductions, AI readings, Planning Center and agent tools (agents see only a number, not your name). Your answer about something you have walked through is not kept at all unless you checked the box.
• Even when you shared with pastors, agent (MCP) tools receive what you wrote, your faith and baptism answers and the staff's private notes about you only if the church's owner switched on sensitive agent export (off by default) and the person using the agent has that permission. Otherwise an agent is told only that something exists.
• The something you have walked through answer is for pastors to read in person. It is never in the spreadsheet export, in any AI tool, in agent tools, or in Planning Center. It is included only in the full backup file, which only the church's owner can make (the church can change who), and which is locked with a passphrase.
• The church's owner can make a full backup or migration file of everything, including what you wrote. Each one is recorded in an audit log. People with an EmmauOS platform-admin role can open any church's data in order to support it; see EmmauOS staff access to a church's workspace.
• The two people you ask to confirm your gifts write to the pastors only. You never see their words.

Links to your results

Your results are reached by a private link. The link does not expire, and anyone who has it can open your results and erase them. Treat it like a key: do not post it publicly. If you use "tell a friend", the friend gets a separate public link to a page showing your full name, your church, and your gift bands. That link does not expire either; erasing your answers makes it stop working. The "my gifts" page is different: EmmauOS emails a one-time sign-in link to the address you gave (valid for 60 minutes, usable once, followed by a 20-minute session on that browser, at most three emails per result per day).

My Path (signing in to your own results)

If you took the assessment at a church, you can go to that church's My Path page and ask for a code. We email a 6-digit code and a one-time link to an address only if it already has results at that church, and the page reads the same whether it does or not, so it cannot be used to find out who took the assessment. The code and the link work once and for 10 minutes; five wrong tries lock the code. We keep only a keyed hash of the code, never the code itself, and we delete spent and expired codes within a day. We never write a code or a sign-in link to our logs. Signing in starts a session cookie for that church only: it ends after 30 minutes without activity, or 8 hours at most, or when you press Sign out. Pages are marked so browsers and search engines do not store them.

Once you are signed in you see only your own results at that church, as bands and dates (never scores), what moved, and the church's suggestions for growth matched to what you wrote. You never see staff notes, anyone's confirmations of your gifts, an AI first look, the rest of your Planning Center profile or anyone else's results. The one exception is the record of following up with you described under Following up after a result, which your download and the page you can save as PDF include, and which is only about you. If more than one person uses the same email address, you see only the results under the first name on the latest one. A person who may be under 18 is not offered My Path. You can download your results (a JSON file, or a page you can save as PDF; both include what the church recorded about following up with you) and delete them; both ask for a fresh code if you signed in more than ten minutes ago. Deleting removes your results, what you wrote, confirmations of them, any retake reminder and any sign-in codes, and cannot be undone. Values a church already wrote to Planning Center stay in the church's own records.

If you check "remind me to retake" (only possible after you sign in, so we never email an address someone merely typed into a form), we send one plain email about six months after your latest result, with an unsubscribe link, and no marketing. It stops if you unsubscribe, retake the assessment first, erase your results, or the church turns My Path off. A church can see only a combined count of people waiting on a reminder, never who. Churches can switch My Path off in Settings. My Path sends nothing to the anonymous, combined statistics described above, and nothing about it feeds them.

An optional AI first look

A church can switch on a short, staff-only written reading of your result. It uses the church's own account with an AI provider; EmmauOS does not supply a key for it, and does not use its own key for any church's people or results. It is made only if you checked the box to share with pastors, you are not held back for your age, the church has set it up, and you wrote enough to read (at least 40 characters). It is sent your gift bands and strength words (never your scores), your Ephesians 4 first look if you took it, the "sweet spot" answers you wrote (who or what you care about, what you are good at, what your life allows right now, and what you would love to grow in), your quick picks, any self-reported profile result (such as Enneagram, Myers-Briggs, CliftonStrengths or DISC) that a pastor has recorded on your record, and the church's list of serving teams with where the gifts each one asks for fall in your bands. It is never sent your name, your email, your testimony or story, your Spirit-gift answers, or the answer about something you have walked through. The reading is saved with your result and only staff can see it. There is no AI on your own results page.

What the AI provider does with what it receives depends on the provider and on the church's settings with it. EmmauOS does not choose or control those settings. Providers we know a church may use (OpenAI, Anthropic, OpenRouter) say that, by default, they do not train their models on API traffic and keep it for a limited time for abuse monitoring, with some routes through OpenRouter being the exception unless the church limits them in its OpenRouter settings. Ask your church which provider it uses.

Following up after a result

Pastors can mark that they walked through your result with the Conversation Guide, log that they had a conversation with you, and place you on a ministry. Each is saved as who did it, which result it was about and when, and never as notes or anything that was said. About a month and three months after a placement, the church is reminded to check whether it took, so a pastor can follow up. You are never contacted by this. The reminder goes to the church's pastors, in the app and in the weekly email described below.

To check, a pastor can answer "is this person serving?" by hand. If the church has connected Planning Center and you shared with the pastoral team, EmmauOS can also look at Planning Center, read only, and only for people who have been placed: it is matched to you only by a Planning Center profile already linked to you or by an email address that exactly matches exactly one Planning Center profile, and never by a guess. It keeps only the id and name of the team or group the ministry is linked to, the date you were last scheduled on that team, and whether your membership is current. It does not read or keep giving, notes, contact details or family details for this. It is not done for anyone who did not share with the pastoral team or who may be under 18. Disconnecting Planning Center deletes what was read. When an email match like this is certain, EmmauOS remembers it as the link to your Planning Center profile, so from then on the details described under "What we collect" (groups, teams, household and the rest) are copied for the church as for anyone linked. You can see all of this, for you only, in your My Path download and the page you can save as PDF.

The church also sees how many people a ministry says it needs against how many could serve, from people who shared with the pastoral team, have time to give and lead with a fitting gift. Staff who can see names see yours there; others see only counts. Nobody is told anything because of it.

The weekly email to church staff

Once a week, on the day and hour the church chooses in its own timezone (by default Monday at 8:00 am Pacific), EmmauOS can email the church's pastors, admins and owner (and any leader who opts in) a list of people who took the assessment, shared with the pastoral team and are still waiting for a conversation, with each person's name, their lead gifts, how long they have waited and a suggested next step, plus a count of people placed a month or more ago who are not yet serving, a count of people who have served steadily and took the assessment over a year ago, and a line for each of the church's signals that started rising that week, in counts only. The staff member who follows up with someone placed on a ministry, or who placed them, is also told that person's name once if the placement goes quiet (no longer, or not yet, serving), under the same rules. A leader who has not opted in or out but has been chosen to follow up with someone on the list gets only those people. It is sent only to church staff, never to the people it lists. People who may be under 18 are counted, never named, in the email. It carries no answer you wrote, no scores and no AI text. Staff can turn it off for themselves (a link in every email), and an admin can turn it off for the whole church. We keep, per email, only a week, the counts and whether a link in it was opened; not the list.

Walking with someone

If a church has turned on "Walking with", a pastor can suggest that one adult walk with another for a season (for example, someone newer to faith meeting with someone further along). Nothing starts unless both people say yes. The person being walked with is asked first, by an email from the church that shows the church's commitment for these walks; only after they check that they are 18 or older and agree is the other person asked. Either can say no, or later stop, with a link in their email, and the other is told only that the walk is not going ahead or has ended, never who said no.

For each walk the church keeps, through EmmauOS, who it is with, what it is about (such as "first steps" or "prayer"), its dates, each person's answers and when they gave them, and which pastor suggested it. It never keeps what the two of you say to each other. Pastors at the church can see that a walk exists and whether it is going ahead. The emails carry no gift results, scores or answers, and no images or tracking. If you say no before the walk begins, the suggestion is forgotten; for 24 months we keep only a keyed hash of your address and that it said no, so the church cannot keep asking. The ground for this under GDPR, where it applies, is the church's legitimate interests (Art. 6(1)(f)) and, because a walk can reveal religious belief, the processing of a religious body for its own members and regular contacts (Art. 9(2)(d)). It is hosted in the United States (see where data is stored).

While you are waiting to answer, EmmauOS sends at most two short reminders. Both people get links to a short guide; opening it is not recorded. Once a walk has started, the one walking with someone can ask a pastor at the church, or the person who walks with them, for input: that person gets one email saying so, with replies going to the one who asked, and the church keeps that it was asked, by whom and when, never what is said. Every walk email has a one-click unsubscribe. Before you have answered it counts as a no; after a walk has started it stops EmmauOS's emails to you and nothing else. Our email provider tells us when a walk email bounces or is marked as spam; we use that only to stop emailing that address about the walk, and do not keep the notice.

A pastor can release someone from walking with others. Their walks end, and each person they walked with gets the same "this season has ended" email every ending sends; a pastor may hold that email for up to a day while they speak with that person first. The person released from walking with is not emailed. If they are on the church's team, they lose access to the walking-with pages until the church's owner restores them. Outside the UK nothing more is kept. In a church whose data is held in the UK, and only when the pastor records that it is a safeguarding matter, the church keeps a keyed hash of the person's addresses under their first name, with their name, the pastor who recorded it and the date encrypted, so that they are not asked to walk with anyone at that church again. The ground is the church's legitimate interest in protecting the people it serves (Art. 6(1)(f)) and, for the UK, the Data Protection Act 2018, Schedule 1, paragraph 11 (or 18 where a child or an adult at risk is involved), under the church's own appropriate policy document. The record is reviewed, never kept by default: the church's owner can remove it at any time when a concern is not upheld, and an erasure request or objection is weighed against the reason it was kept.

Once both have said yes, the walk gets one question a week from the church. The one walking with someone gives the day they meet, and each week chooses the question with one tap (or "not this week"); the other person gets it the evening before they meet, from the church, with replies going only to the one who chose it. EmmauOS keeps the meeting day and which question went on which date, never an answer. If no question is chosen for three meetings in a row, the questions stop until the one walking with someone starts them again, and the pastor who suggested the walk sees that in the weekly email.

Every invitation links to the church's own privacy notice: a page of the church's, or EmmauOS's starter, which the church adopts in its own name and EmmauOS hosts at the church's address. The church decides who is asked; EmmauOS is its processor. The one walking with someone may be a person the church added by name and address who is not part of the church, only if the church's notice covers it and a pastor asked them in person. For them the ground is their consent (Art. 6(1)(a) and Art. 9(2)(a)), given by saying yes and withdrawn with the stop link; the church also keeps, as a safeguarding record, a pastor's note that they know them and that the church's checks were done. Their name, address and that note are deleted thirty days after their last walk ends or lapses, or sooner if the church erases them.

Either person can raise a concern with the stop link. When the person being walked with says a walk worries them, the walk ends and the church keeps a keyed hash of the leading person's addresses under their first name, with their name, so that they are not asked to walk with anyone at that church until the church's safeguarding contact has followed it up. The record also holds who raised it, which only the safeguarding contact sees. If the contact finds it was not a safeguarding matter, the record is removed. If it was, it is kept and reviewed every three years, and the owner is asked if the contact does not answer; nothing removes it by silence, and nothing keeps it without a review. The ground is the same as for a release above. When the leading person says they are worried for the other, nothing is kept beyond the walk itself and the contact's follow-up.

Planning Center

If the church connects Planning Center, EmmauOS reads the church's own Planning Center records and, where you agreed and the church has chosen the fields, writes to your Planning Center profile: which gifts fall in which group (by name, never your scores), your Ephesians 4 leaning, your quick picks, the serving teams you asked to try, the date you took the assessment, and a link that opens only for a signed-in pastor. Only if the church chooses to map them, and you agreed to save those answers, it also writes the names of the Spirit gifts you marked and how often. It never writes what you wrote in your own words, your story or testimony, or the answer about something you have walked through. Values already written live in the church's own Planning Center database; erasing in EmmauOS does not remove them unless the church chooses to clear them too.

Young people

If you may be under 18, EmmauOS does not make an AI reading of your result, does not send your details to agent tools, and does not write to Planning Center. Young people are not matched one-to-one with adults in the introductions list, and are left out of the gift statistics (they appear only as a head count in one combined "under 18" age group). See also the section for parents and guardians.

If you're a church admin

You are the controller of the answers your people give, and EmmauOS is your processor. The data processing addendum is part of the terms you accept when you use EmmauOS.

• What you can do: choose who on your team has which role (viewer, leader, pastor, admin, owner); choose how long results are kept; ask for age bands and set the youth options; turn on Planning Center, an AI provider you pay for, Gravatar pictures and agent (MCP) access; export your list; make full backup or migration files; erase a person or a single result; opt out of the anonymous statistics.
• What EmmauOS records about you: your name, email and a hashed password; your church's settings; your team's actions in an audit log that keeps ids and counts, never names, emails or answers.
• What you owe the people who answer: your own privacy notice to them, a lawful basis (in some places, explicit consent) for collecting religious information, a parent or guardian's agreement for children where the law requires it, and answers to their requests. The terms say this in more detail.
• Your keys and tokens: Planning Center and AI credentials are stored encrypted. Agent tokens are shown once and stored only as a hash; they expire in 30, 90, 180 or 365 days (90 by default) and you can revoke all of them at any time. Sensitive agent export is off by default.
• Payment: paid plans are paid through a Stripe link. EmmauOS never holds card numbers. Stripe tells EmmauOS that a payment happened: which church it was for (a reference we put in the payment link), the plan, the period it covers, and the payer's email address as Stripe has it. EmmauOS keeps those and Stripe's customer and subscription ids to apply the plan; an EmmauOS administrator can also record a payment by hand.

If you're a parent or guardian

• EmmauOS is built for adults and young people in a church's care. It is not designed for children under 13.
• By default, if a person says they are under 13, the form stops and nothing is saved. A church can switch on an option that lets under-13s answer. To switch it on the church confirms that it has a parent or guardian's agreement, and the child is asked to confirm that a parent or guardian said yes. That checkbox is not proof that you agreed. EmmauOS cannot verify who is at the keyboard. A church that switches this on is responsible for getting and keeping your consent itself, outside EmmauOS.
• If your child's answers were collected without your agreement, write to [email protected] and tell us the church and your child's name. We will pass it to the church and, if you ask, erase the result ourselves. The church can also erase it, and your child can erase it from the bottom of their results page.
• For every person who may be under 18 (including anyone under 13), EmmauOS holds back the AI reading, agent-tool detail and Planning Center write-back, and leaves them out of the gift statistics. We store an age band, not a birthday.
• We do not use any child's answers for advertising, profiling or selling. Young people are left out of the gift statistics; the only place they appear in the combined statistics is as a head count inside one combined "under 18" age group.

What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising.
• We do not run advertising, analytics or social-media tracking scripts, or tracking pixels, on EmmauOS.
• We do not use your answers to train an AI model. EmmauOS itself may use an AI provider only for combined, anonymous statistics, as described above, never for your answers.
• We do not send your name, email, testimony, story, Spirit-gift answers or "walked through" answer to an AI provider, whether a church's or EmmauOS's own.
• We do not send marketing email to the people who take an assessment. EmmauOS sends only the two emails described above to people who take an assessment, each at their request. EmmauOS also emails church staff, for example the weekly email described under The weekly email to church staff, which never goes to the people it lists.
• We do not send text messages.
• We do not show your result, or what you wrote, to anyone outside the church's account, other than people you or the church choose to give it to.
• We do not store payment card numbers.
• We do not ask for, or keep, your date of birth. (We keep an age band, and Planning Center's birth year if the church uses it.)
• We do not claim to encrypt everything. See Security.

Other companies that handle data

EmmauOS uses the companies below to run the service. The full list, with what each one receives, is on the sub-processors page.

How long we keep it

Cookies and similar storage

EmmauOS uses only the cookies and storage it needs to work. It does not use advertising or analytics cookies, so there is no cookie banner to dismiss.

We do not set these for advertising and do not read them for any purpose other than the one stated. Our own fonts are served from EmmauOS itself, not from Google. Some church pages load other things from outside EmmauOS, which means your browser sends a normal web request, including your IP address, to that company: a church's own logo (from the church's website), a church's own brand fonts (from Google Fonts, only if the church imported them), and, only if the church turned it on, Gravatar pictures. EmmauOS's own public pages and documentation have short product films: the still you see first comes from EmmauOS, and the film itself is fetched from Cloudflare only when you press play. Cloudflare also carries every visit to EmmauOS; it is on the subprocessors list.

Your rights, and how to use them

These are the things you can do, and they are all real features today.

1. See your results, and download them. Open the private link to your results, or sign in to My Path with a code we email you, where you can download them as a JSON file (your results as bands and dates, what you wrote and picked, your choices, and what the church recorded about following up with you: the ministries you were placed on and the 30 and 90 day marks, the dates a pastor walked through your result or talked with you, and the Planning Center team or group that was checked, with its last-scheduled date; no scores, no staff notes and no staff names). If you want to see everything the church holds about you (including staff notes and an AI first look), ask the church; see step 4.
2. Take your results to another church. If you move to another church that uses EmmauOS, My Path (after a fresh code) can copy your own results to it, at your request only. You choose again whether to share them with that church's pastoral team, and whether what you wrote goes too. Staff notes, confirmations, an AI first look, the something I have walked through answer and Planning Center details never go. Your first church keeps its own copy until you or it erases it.
3. Delete your answers yourself. At the bottom of your results page, or in My Path after a fresh code, there is a button that erases your result, what you wrote and your confirmations, right away. When your last result goes, your name, email, phone, age and the Planning Center details we copied go too. If a pastor wrote notes about you, those notes may stay with no name or contact details attached. Copies may remain in our hosting provider's backups until they expire. (On the demo, the button does nothing.)
4. Change your mind about sharing. Today you can withdraw consent by erasing your result, or by asking the church to do so. There is no switch that turns off sharing and keeps the result; telling the pastors you are interested in a team turns sharing on, with its own checkbox and a date.
5. Ask the church. Pastors with the right role can erase a person's answers, and can also clear the values EmmauOS wrote to Planning Center if they choose to. The church answers requests about correcting, restricting or exporting your information.
6. Ask us. For anything the church does not answer, or about what EmmauOS does as itself, write to [email protected]. Tell us the church and the email address you used. We will confirm you are who you say you are (for example, by replying to that address), tell the church if it is the church's data, and answer within 30 days, or tell you why we need longer.
7. Complain. You may complain to the church, to us, and to your data protection regulator (see regional rights).

If you are walking with someone, you can end it any time with the stop link in your email; the record is then kept for twelve months and deleted. While a walk is going on, erasing your results keeps your name and email so the walk can still reach you.

Values already written to Planning Center are in the church's own Planning Center database. Erasing in EmmauOS does not remove them unless the church chooses to; ask the church to remove them if you want them gone. A person who erased their answers may still be named in the church's own notes if a pastor wrote them; those notes are the church's records and have no name or contact details left on them in EmmauOS.

Regional rights

Privacy laws differ. The rights below apply where the law applies to the church or to us; the steps above are open to everyone. EmmauOS is designed first for churches in the United States, and this section is a summary, not a legal opinion.

European Economic Area, United Kingdom and Switzerland

You may ask the church (and, for what we do as ourselves, us) to give you access to your information, correct it, erase it, restrict its use, give you a copy in a portable form, and stop using it for a purpose you object to. If you gave consent you may withdraw it at any time. You may complain to your national data protection authority (in the UK, the Information Commissioner's Office). Information about your religious beliefs gets extra protection: a church needs a specific legal ground to use it, most often your explicit consent. If your information leaves your country, the church and EmmauOS must protect it in the ways the law requires; see where data is stored.

California and other US states

Residents of California and of a growing number of other states (including Colorado, Connecticut, Oregon, Virginia, Texas and others) may have the right to know what is held about them, correct it, delete it, receive a copy, and say no to the sale of their information, to targeted advertising and to profiling. Many of these laws treat information about religious beliefs as sensitive and require your opt-in before it is used. We do not sell information and do not share it for advertising. We use sensitive information only to run the service for your church and to produce the deidentified statistics above. We will not treat you differently for using any of these rights. To use one, follow the steps in Your rights; a church may handle it itself. Where an authorized agent writes for you, we will ask for proof.

Canada

You may ask to see, correct and withdraw consent for the personal information held about you, and to complain to the Office of the Privacy Commissioner of Canada or your province's regulator. In Quebec, information about religion is sensitive and needs your express consent, and a church or company must name someone responsible for protecting personal information; the contact above is that person until we say otherwise.

Brazil, Australia and elsewhere

Most countries that have a privacy law give you rights to access, correct and delete your information and to complain to a regulator. Religious belief is sensitive information in Brazil's LGPD and in Australia's Privacy Act. Write to the contact above and we will use the same steps.

Information about children

See the section for parents and guardians. Several laws set special rules for children (in the US, under 13 under the federal COPPA law, and higher ages in some states; in the EU, a country-by-country age between 13 and 16 below which a parent must agree to online services).

Security

Results are reached only by a private link or by signed-in church staff. Exactly what is encrypted in the database: the “something you have walked through” answer, the private confirmation links, the church's Planning Center and AI credentials, and temporary files of data being imported. Everything else (your name, email, answers, scores, what you wrote, faith and baptism answers, your story, Spirit-gift answers, the Planning Center details copied for the church, and staff notes) is stored as ordinary database values and protected by access rules, not by field-level encryption. Passwords are stored as one-way hashes, and agent tokens as one-way hashes. Connections are encrypted in transit. Full backup and migration files are locked with a passphrase. No system is perfectly safe; if something goes wrong that affects you, the church and we will tell you, and, where the law sets a deadline for that, within it.

Where data is stored

EmmauOS's database and servers are in United States (Amazon Web Services, us-east-2, Ohio). If you or your church are outside the United States, taking part means your information is sent to and stored in the United States. Some of the companies on the list above are US companies, or can process data outside your country; where the law requires a safeguard for that, such as the EU's Standard Contractual Clauses or the EU-US Data Privacy Framework, it is the church's and EmmauOS's job to put one in place. The data processing addendum says how.

Changes

We will post changes here and update the date at the top. If a change is material, we will say so on this page and email church owners before it takes effect. The version history below lists what changed.

Who we are and how to reach us

EmmauOS is provided by Zao. EmmauOS is a subsidiary of Zao.

Version history

We keep this list so you can see what changed and when. If a change is one you would reasonably care about (for example, a new kind of data we collect or a new sub-processor), we will say so at the top of the page and email church owners before it takes effect.

• October 22, 2026. Updated the Stripe entry in the sub-processor list. Churches now pay on Stripe Checkout and manage their plan in Stripe's billing portal instead of a payment link, and the entry now lists what EmmauOS sends to Stripe (a church number, the plan and the owner's email on a first purchase) and what Stripe sends back (customer and subscription numbers, plan, amounts, dates and the billing email). Card details still never reach EmmauOS.
• October 21, 2026. Described how feedback is handled: once a day EmmauOS's own AI provider reads new feedback and documentation comments (with email addresses and phone numbers removed) to sort them; accepted ideas are filed as anonymous, private write-ups on GitHub, now listed as a sub-processor; and a person who checked "You may email me back" is told by email when what they asked for is live.
• October 21, 2026. Described the documentation search. The search box on EmmauOS's public documentation can write a short answer using Cloudflare AI Search: it is sent the visitor's question, with email addresses and phone numbers removed first, and answers only from EmmauOS's public documentation and blog posts. EmmauOS does not store the question. Without Cloudflare, the box searches by keyword on EmmauOS's own server. Added this to Cloudflare's row on the subprocessors list.
• October 21, 2026. Described "Walking with", for churches that turn it on: a pastor can suggest that one adult walk with another, nothing starts unless both say yes (the person being walked with is asked first), either can stop at any time, and the church keeps who, what it is about, the dates and the answers, never what is said, until twelve months after the walk ends. Added the retention lines for walks and the record that an address said no. Flagged for counsel review.
• October 21, 2026. Listed Cloudflare as a subprocessor. It sits in front of giftwell.app for every visit (domain name, encryption and protection from attacks), and it now also stores and plays the short product films on EmmauOS's public pages and documentation. A film is fetched from Cloudflare only when someone presses play; the still shown before that comes from EmmauOS itself.
• October 18, 2026. Described how pastors follow up after a result: the walked-through and conversation log (who and when, never what was said), placing a person on a ministry and checking 30 and 90 days later whether they are serving (by the pastor's own answer, or by a read-only Planning Center check matched only by a linked profile or one exact email, and never for anyone who did not share or may be under 18), the staff-only view of ministry needs against people who could serve, and a weekly email to church staff naming people who shared and are still waiting. The email never goes to the people it lists, and goes out on a day and hour each church chooses in its own timezone (by default Monday 8:00 am Pacific). A person's My Path download and printable page now also include the follow-up record kept about them (placements, the dates of conversations and walk-throughs, and the Planning Center team or group that was checked), and only theirs. Flagged for counsel review.
• October 17, 2026. Clarified what the optional staff-only AI first look is sent: it also includes the Ephesians 4 first look and any self-reported profile result (such as Enneagram or Myers-Briggs) a pastor recorded for the person, and where the gifts each serving team asks for fall in the person's bands. The same consent and age rules apply, and the never-sent list is unchanged.
• October 17, 2026. Added My Path, a passwordless page where a person signs in with a one-time emailed code to see their own results over time, ask for one retake reminder email, and download or delete their own results. Described the code and session handling, what is and is not shown, the reminder, and the new retention periods. Flagged for counsel review.
• October 17, 2026. Disclosed that EmmauOS itself may use an AI provider (models routed through OpenRouter) for the platform-level "Ask the platform" analyst, sent only suppressed, rounded, anonymous aggregate tables and never names, emails, free text or individual assessments; listed it as a sub-processor; and stated plainly that platform administrators can open any church's workspace for support and operations, with each access recorded in the audit log.
• October 17, 2026. Rewrote the terms and privacy pages; added the data processing addendum and the sub-processor list; spelled out what each role (taker, church, parent or guardian) can see and do; added regional rights, cookies, retention, and what EmmauOS does not do. EmmauOS's own fonts are now served from EmmauOS itself.

EmmauOS is a subsidiary of Zao.