Legal

Privacy Policy

How Onyi collects, uses, stores, and protects your church's data and member information.

Last updated: May 27, 2026

Privacy Policy

Last updated: May 27, 2026

1. Introduction

Welcome to Onyi ("Platform", "we", "us"), a cloud-based church management SaaS product operated by ONYI. We are committed to protecting the privacy and confidentiality of all personal data entrusted to us by the churches (our "Tenants") and their congregation members ("Members") who use our Platform.

This Privacy Policy explains what data we collect, why we collect it, how it is stored, and the rights you have over your data. It applies to all users of onyi.name.ng and all associated church subdomains.

2. Data We Collect

2.1 Member Profile Data

When a church administrator registers a member or a member self-registers, the following data may be collected:

  • Full name, email address, phone number
  • Profile photograph
  • Date of birth and wedding anniversary
  • Church branch, PCF (Pastoral Care Fellowship), and Cell group assignments
  • Custom registration fields defined by the church administrator

2.2 Attendance & GPS Data

When members check in to cell or PCF sessions using our geofenced self-service portal:

  • The member's browser-provided GPS coordinates are captured at the point of check-in
  • These coordinates are compared against the session leader's registered location to validate presence within a configurable radius
  • GPS data is used solely for attendance verification and is not shared with third parties

2.3 Financial & Donation Data

When members or the public submit seed offerings, tithes, or pledges through the Platform:

  • Transaction amounts, currency, and donation purpose
  • Payment gateway reference IDs (Paystack / Flutterwave)
  • Pledge commitments and fulfilment history
  • Onyi does not store raw card numbers or bank account credentials. All payment processing is handled by PCI-DSS-compliant third-party gateways.

2.4 Communication Preferences

  • Email and SMS notification opt-in/opt-out status
  • Web Push notification subscription tokens (VAPID)

3. How We Use Your Data

  • To provide, maintain, and improve the Onyi platform and its features
  • To verify attendance at cell and PCF meetings using geofence validation
  • To process and record donations, generate giving statements, and track pledge fulfilment
  • To send automated birthday and anniversary celebrations, scheduled messages, and church announcements
  • To generate KPI dashboards, attendance reports, and financial analytics for authorised church administrators
  • To provide support, respond to tickets, and communicate platform updates

4. Data Isolation & Security

Each church group on Onyi operates within a fully isolated tenant. No church can view, access, or modify the data of another church. Data segregation is enforced at the database query level using a church_group_id scoping mechanism.

  • All data is transmitted over TLS (HTTPS) encryption
  • Passwords are hashed using bcrypt and are never stored in plaintext
  • Session tokens are encrypted and stored in a database-backed session store
  • Admin and user authentication use separate guard systems to prevent privilege escalation
  • Database backups are performed regularly and are encrypted at rest

5. Data Sharing

We do not sell, rent, or trade your personal data to third parties. Data is only shared with the following sub-processors, strictly for the delivery of the platform's features:

  • Paystack / Flutterwave — for processing payment transactions
  • Africa's Talking — for delivery of SMS notifications
  • Hostinger — as the infrastructure hosting provider
  • Google Fonts — for font rendering (no personal data transmitted)

6. Data Retention

Data is retained for as long as the tenant's church account remains active. Upon account termination or subscription expiry (beyond a 30-day grace period), tenant data will be scheduled for deletion in accordance with the Data Processing Agreement. Members may request export or deletion of their own data by contacting their church administrator.

7. Your Rights (NDPR & GDPR)

In accordance with the Nigeria Data Protection Regulation (NDPR) and where applicable the General Data Protection Regulation (GDPR), you have the following rights:

  • Right of Access — to request a copy of data held about you
  • Right to Rectification — to correct inaccurate or incomplete data
  • Right to Erasure — to request deletion of your personal data
  • Right to Data Portability — to receive your data in a structured, machine-readable format
  • Right to Object — to object to processing for direct marketing purposes

To exercise these rights, contact your church administrator or email us at support@onyi.name.ng.

8. Cookies

Onyi uses only essential functional cookies required for session management and theme preference storage. We do not use tracking cookies or third-party advertising cookies.

9. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be communicated to Tenant administrators via email. Continued use of the Platform after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related enquiries, please contact: