Privacy Notice

1. Who we are

Bourne Apps Ltd, trading as Bourne Apps, is the controller responsible for personal information used in connection with AppForWorship, this website and related support services.

Our contact details are in section 12 below. This notice is written with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK privacy rules in mind.

2. Information we may collect

The information collected depends on which parts of the App and website you use:

• Information you give us: your name, email address, church or organisation, feedback, support messages and any files or screenshots you choose to send.
• Technical information: device type, operating system, App version, language, approximate region derived from an IP address, diagnostic events, crash reports and error logs.
• Usage information: which features are used, general interaction events, session timing and performance information. We aim to minimise this information and use aggregated statistics where practical.
• Website and download information: IP address, browser type, requested pages or files, timestamps and standard server security logs.
• Store information: limited information supplied by Apple, Google or another store about an installation, subscription or purchase. We do not receive your complete payment card details from an app store.

Service content: lyrics, readings, audio, images and service plans that you add are not collected by us unless you deliberately send them to support or use a feature that clearly says it uploads or synchronises them.

We do not intentionally collect special category information, such as health, religious-belief or biometric data, through analytics. Because the App is used in worship settings, support messages or user content may reveal religious beliefs. Please avoid sending personal or sensitive information unless it is necessary.

3. How and why we use information

Before relying on legitimate interests for analytics, we will consider whether the use is necessary, proportionate and within your reasonable expectations. Where consent is required, you may withdraw it at any time.

4. Who we share information with

We do not sell personal information. We may share only what is necessary with:

• hosting, storage, email, support, analytics and crash-reporting suppliers acting for us;
• Apple, Google, Microsoft or other platform providers where their services are used;
• professional advisers, insurers, auditors or potential purchasers of the business under appropriate confidentiality protections; and
• courts, regulators, law enforcement or other parties where disclosure is required by law or necessary to protect legal rights.

Our current infrastructure providers are:

• Amazon Web Services (AWS): Amazon S3 storage and backup in the UK (London) region.
• DigitalOcean: cloud server hosting in its UK (London) datacentre.

We require service providers to protect information, use it only for agreed purposes and delete or return it when their work ends.

5. International transfers

We use Amazon Web Services (AWS) for S3 storage and backup in its UK (London) region, and DigitalOcean for cloud server hosting in its UK (London) datacentre. Our primary customer data is stored in the United Kingdom.

AWS and DigitalOcean are international providers. Their personnel, group companies or subprocessors may process or access limited personal information outside the United Kingdom where necessary to provide, secure or support their services.

Where a transfer is made to a country that is not covered by UK adequacy regulations, we rely on contractual safeguards provided through the relevant supplier’s data processing terms. These include the UK International Data Transfer Addendum or other safeguards recognised under UK data protection law. We also use appropriate security measures and limit the information transferred.

You may contact us at support@bourneapps.com for more information about the safeguards used for international transfers.

6. How long we keep information

We keep personal information only for as long as needed for the purpose collected, including support, security, legal and accounting needs. We consider the amount and sensitivity of the information, the risk of harm, whether the purpose can be achieved another way and applicable legal requirements.

• Account and service data: while the account or backup feature is active, then deleted within 90 days after the account is closed or deletion is requested.
• Backup copies: removed through our normal rolling backup cycle within 90 days after deletion from the live service.
• Support requests and correspondence: 2 years after the request is closed.
• Analytics and diagnostic events: 12 months, after which they are deleted or anonymised.
• Security and website server logs: 90 days.
• Transaction and accounting records, if applicable: 6 years from the end of the company financial year to which they relate.

We may keep relevant information for longer where reasonably necessary to investigate an active security incident, resolve a dispute, establish or defend legal claims, or comply with a legal requirement. We review longer retention and delete or anonymise the information when that reason ends.

We may keep anonymised statistics that no longer identify anyone.

7. How we protect information

We use proportionate technical and organisational measures intended to protect personal information against loss, misuse, unauthorised access, alteration and disclosure. These may include access controls, encryption in transit, secure development practices, backups and supplier reviews.

No system is completely secure. If we identify a personal data breach that is likely to create a high risk to you, we will notify you as required by law.

8. Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for a copy of your personal information;
• correct inaccurate or incomplete information;
• ask us to delete information;
• restrict how information is used;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to the Information Commissioner’s Office.

To exercise a right, email us using the details below. We may ask for information needed to confirm your identity. There is normally no fee, and we normally respond within one month.

9. Children’s information

AppForWorship is intended for adults organising or presenting worship and is not directed at children. We do not knowingly use analytics to build profiles of children. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

10. Analytics, cookies and similar technologies

We do not currently use analytics or diagnostic tools in the App or on the website. If we introduce any in the future, we will update this notice before they are enabled and obtain consent where UK law requires it.

Website cookie

We use one first-party authentication cookie. It stores an identity token so that the website can recognise a signed-in user, maintain their session and protect access to their account. It is used only for authentication and security, not for analytics, advertising or tracking activity across other websites.

Because this cookie is necessary to provide the sign-in service requested by the user, it cannot be disabled through the website without preventing signed-in features from working. Users can block or delete it using browser settings, but they will need to sign in again.

11. Changes to this notice

We may update this notice when the App, our suppliers or the law changes. We will update the date above and take reasonable steps to draw attention to significant changes.

12. Contact and complaints

Please contact us first if you have a privacy concern so we can try to resolve it.

You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to another data protection regulator where applicable.