Sub-processors
The companies that help us run EmmauOS
The list
| Company | What for | What it receives | Where | When |
|---|---|---|---|---|
| Laravel Cloud, on Amazon Web Services Its terms or policy | Hosts the application, the database (MySQL), the cache and the logs. | Everything EmmauOS stores, including answers, names, emails, IP addresses and the session table. | United States (Amazon Web Services, us-east-2, Ohio) | Always |
| Cloudflare Its terms or policy | Sits in front of giftwell.app: answers for the domain name, encrypts the connection and filters attacks, so every visit passes through it. Also stores and plays the short product films on EmmauOS's public pages and documentation, only when someone presses play, and writes the answers in the documentation search (AI Search and the models Cloudflare runs). | Every request to EmmauOS passes through it in transit, including the IP address, browser details and whatever the page sends or shows. For the films, the IP address and browser details of the person who pressed play. The films themselves hold no personal data. For the documentation search, the question a visitor types (EmmauOS removes email addresses and phone numbers first) and EmmauOS's public documentation and blog posts it answers from; never anything about a church, a person or an assessment. | United States and Cloudflare's global network | Always |
| Resend Its terms or policy | Sends the emails EmmauOS sends: a result a person chooses to share with a friend, the "my gifts" sign-in link, and the My Path sign-in code and the one retake reminder a person asked for; and the weekly list of people waiting for a conversation, sent only to church staff. | Recipient email address, the message text (for the staff email: the names, lead gifts and waiting time of people who shared with the pastoral team), and the private link or one-time code in it. Resend keeps delivery logs for up to 30 days. | United States | Always |
| Stripe Its terms or policy | Takes payment for paid church plans on Stripe's own pages: Stripe Checkout to buy a plan, and Stripe's billing portal to update the card, see invoices or cancel. EmmauOS also asks Stripe to switch a running plan up or down. EmmauOS never sees or stores card numbers. | Sent by EmmauOS: a church number and a signed reference, the plan chosen, and, on a church's first purchase, the church owner's email address. Typed into Stripe by the church: name, email, billing address and card; that stays between the church and Stripe. Sent back to EmmauOS and kept with the church's billing record: the Stripe customer and subscription numbers, the plan, the amounts and dates paid, and the billing email address. | United States and other Stripe locations | Only if the church turns it on |
| An AI provider the church chooses (OpenRouter, OpenAI or Anthropic) Its terms or policy | Writes the optional staff-only "first look" brief about a person. Runs only with the church's own API key; EmmauOS does not supply or use a key for this. | Gift bands and strength words (never scores), the Ephesians 4 first look, the written "sweet spot" answers, quick picks, any self-reported profile result (Enneagram, Myers-Briggs, CliftonStrengths, DISC or similar) a pastor recorded, and the church's serving-team list with where each team's asked-for gifts fall in the person's bands. Never a name, email, testimony, story, Spirit-gift answers or the answer about something a person has walked through. | Set by the provider and by the church's own account settings | Only if the church turns it on |
| An AI provider EmmauOS itself may use for the platform "Ask the platform" analyst and for sorting feedback (OpenRouter-routed models) Its terms or policy | Lets EmmauOS's own platform administrators ask questions about combined, anonymous statistics across churches. Also reads the feedback a church's staff send with "Send feedback" and the comments readers leave on documentation pages, once a day, to sort them and draft an anonymous write-up for EmmauOS's own developers. It is not used for any church's people, results or briefs. | For the analyst: only suppressed, rounded, anonymous aggregate tables (small groups are hidden, numbers are rounded), plus the administrator's typed question after it is screened (a church name, an email address or a phone number is refused). For feedback: the words of the feedback with email addresses and phone numbers removed first, the kind of feedback, the sender's role and the page it was sent from. Never names, church names, or any individual's assessment. Where the provider supports it, data collection is set to deny, so providers that keep or train on prompts are not used. | Set by the provider that OpenRouter routes the request to; OpenRouter is a United States company | Only if EmmauOS has set up its own platform AI key |
| GitHub (GitHub, Inc., a Microsoft company) Its terms or policy | Holds EmmauOS's own source code and the list of changes its developers plan to make. When feedback is accepted, an anonymous write-up of the change is filed there as a private issue, and EmmauOS later reads whether that change was built and released. | Only the write-up: a title and a technical description of the change, written in EmmauOS's words. Never the sender's name, email, church, or the feedback quoted word for word. | United States | Only when EmmauOS files feedback it has taken up |
| Planning Center Its terms or policy | If the church connects it: reads people, groups, teams and check-in history, for people who have been placed on a ministry (and who shared and are not under 18) reads only the id and name of the linked team or group, the date last scheduled and whether the membership is current, and (where the person agreed) writes results to the person's profile, as listed below. | Read: the church's own Planning Center records. Written, only into fields the church chose: gift band names, Ephesians 4 leaning, quick picks, serving teams a person asked to try, a date and a link that opens only for a signed-in pastor; and, if the church maps it and the person agreed, Spirit-gift names. Never anything a person wrote in their own words. | United States | Only if the church turns it on |
| Gravatar (Automattic Inc.) Its terms or policy | Shows a profile picture for a person, only when the church turns the setting on (off by default). | A one-way hash of the email address, plus the IP address of whoever is looking at the page. | United States | Off unless the church switches it on |
| Google Fonts (Google LLC) Its terms or policy | Loads a church's own brand fonts, only for a church that imported them from its website. EmmauOS's own fonts are served by EmmauOS and make no request to Google. | The IP address and browser details of the visitor's browser, as with any web request. | United States and other Google locations | Only if the church turns it on |
"Only if the church turns it on" means EmmauOS does not send anything to that company unless the church has set it up. For the AI provider, the church chooses the provider and holds the account; what the provider keeps, and for how long, depends on that provider and on the church's own settings with it.
The second AI row is different: EmmauOS itself may use an AI provider (models routed through OpenRouter, as EmmauOS's configuration sets) for the platform-level "Ask the platform" analyst that only EmmauOS's platform administrators can open. It is sent only suppressed, rounded, anonymous aggregate tables, never names, emails, free text, church names or any individual's assessment, and an administrator's typed question is screened so it cannot carry a church's name, an email address or a phone number; it is also limited in length, and administrators are instructed to ask only about the combined numbers. EmmauOS asks that provider data collection be denied where the provider supports it. Once a day it also reads new feedback and documentation comments, with email addresses and phone numbers removed and never with a name or church, to sort them; what EmmauOS takes up is filed on GitHub as an anonymous write-up. It is never used for a church's own people or results, and it is off unless EmmauOS has set it up. See the privacy page.
Things that are not on the list
- No advertising, analytics or tracking companies. None are used.
- No fonts or scripts from Google on EmmauOS's own pages. EmmauOS's own fonts are served by EmmauOS. A church that imported its own brand fonts adds a Google Fonts request on its own pages, which is listed above.
- No text-message provider. EmmauOS does not send text messages.
The church's own logo, if it uses one, is loaded from the church's own website.
Who we are and how to reach us
EmmauOS is provided by Zao. EmmauOS is a subsidiary of Zao.
Privacy and data requests: [email protected]Everything else: [email protected]
Version history
We keep this list so you can see what changed and when. If a change is one you would reasonably care about (for example, a new kind of data we collect or a new sub-processor), we will say so at the top of the page and email church owners before it takes effect.
- . Updated the Stripe entry in the sub-processor list. Churches now pay on Stripe Checkout and manage their plan in Stripe's billing portal instead of a payment link, and the entry now lists what EmmauOS sends to Stripe (a church number, the plan and the owner's email on a first purchase) and what Stripe sends back (customer and subscription numbers, plan, amounts, dates and the billing email). Card details still never reach EmmauOS.
- . Described how feedback is handled: once a day EmmauOS's own AI provider reads new feedback and documentation comments (with email addresses and phone numbers removed) to sort them; accepted ideas are filed as anonymous, private write-ups on GitHub, now listed as a sub-processor; and a person who checked "You may email me back" is told by email when what they asked for is live.
- . Described the documentation search. The search box on EmmauOS's public documentation can write a short answer using Cloudflare AI Search: it is sent the visitor's question, with email addresses and phone numbers removed first, and answers only from EmmauOS's public documentation and blog posts. EmmauOS does not store the question. Without Cloudflare, the box searches by keyword on EmmauOS's own server. Added this to Cloudflare's row on the subprocessors list.
- . Described "Walking with", for churches that turn it on: a pastor can suggest that one adult walk with another, nothing starts unless both say yes (the person being walked with is asked first), either can stop at any time, and the church keeps who, what it is about, the dates and the answers, never what is said, until twelve months after the walk ends. Added the retention lines for walks and the record that an address said no. Flagged for counsel review.
- . Listed Cloudflare as a subprocessor. It sits in front of giftwell.app for every visit (domain name, encryption and protection from attacks), and it now also stores and plays the short product films on EmmauOS's public pages and documentation. A film is fetched from Cloudflare only when someone presses play; the still shown before that comes from EmmauOS itself.
- . Described how pastors follow up after a result: the walked-through and conversation log (who and when, never what was said), placing a person on a ministry and checking 30 and 90 days later whether they are serving (by the pastor's own answer, or by a read-only Planning Center check matched only by a linked profile or one exact email, and never for anyone who did not share or may be under 18), the staff-only view of ministry needs against people who could serve, and a weekly email to church staff naming people who shared and are still waiting. The email never goes to the people it lists, and goes out on a day and hour each church chooses in its own timezone (by default Monday 8:00 am Pacific). A person's My Path download and printable page now also include the follow-up record kept about them (placements, the dates of conversations and walk-throughs, and the Planning Center team or group that was checked), and only theirs. Flagged for counsel review.
- . Clarified what the optional staff-only AI first look is sent: it also includes the Ephesians 4 first look and any self-reported profile result (such as Enneagram or Myers-Briggs) a pastor recorded for the person, and where the gifts each serving team asks for fall in the person's bands. The same consent and age rules apply, and the never-sent list is unchanged.
- . Added My Path, a passwordless page where a person signs in with a one-time emailed code to see their own results over time, ask for one retake reminder email, and download or delete their own results. Described the code and session handling, what is and is not shown, the reminder, and the new retention periods. Flagged for counsel review.
- . Disclosed that EmmauOS itself may use an AI provider (models routed through OpenRouter) for the platform-level "Ask the platform" analyst, sent only suppressed, rounded, anonymous aggregate tables and never names, emails, free text or individual assessments; listed it as a sub-processor; and stated plainly that platform administrators can open any church's workspace for support and operations, with each access recorded in the audit log.
- . Rewrote the terms and privacy pages; added the data processing addendum and the sub-processor list; spelled out what each role (taker, church, parent or guardian) can see and do; added regional rights, cookies, retention, and what EmmauOS does not do. EmmauOS's own fonts are now served from EmmauOS itself.
EmmauOS is a subsidiary of Zao.