1. Scope and roles
This policy explains how WinASoul handles personal data. For contacts collected by a church, that church normally determines the purpose and means of processing and acts as data controller; WinASoul processes the records on the church’s instructions. WinASoul acts as controller for account, billing, security, support, and service-operation information.
2. Information we process
- Administrator name, email, church name, role, onboarding answers, and settings.
- Contact details and custom form fields entered manually or extracted from submitted images.
- Consent records, database membership, automation schedules, SMS content, recipients, Sender IDs, and delivery events.
- Plan, wallet, VAT, payment reference, transaction, and usage information.
- IP address, device, browser, security-check, support, error, and audit information.
3. How we use information
We use information to authenticate users, provide forms and databases, extract requested contact information, schedule and send SMS, calculate costs, process payments, prevent duplicates and abuse, provide analytics and exports, support users, protect the service, and comply with law.
4. Legal bases
Depending on the activity, we rely on contract, consent, legitimate interests, legal obligations, and the documented instructions of a church customer. Churches remain responsible for the lawful basis and notices used when collecting contact information and sending follow-ups.
5. Providers
We use Supabase for authentication and database services, Cloudflare for hosting and Turnstile security verification, Paystack for payments, KudiSMS for SMS delivery, OpenAI for image text extraction, and DeepSeek for structuring extracted contact data. Providers receive only the information needed for their function and process it under their own security and contractual obligations.
6. International transfers
Some providers may process information outside Nigeria. Where required, we use contractual and organisational safeguards intended to provide appropriate protection and assess the destination and provider before processing.
7. Retention
Active workspace information is retained while the account is open. After account deletion, operational copies are scheduled for removal within 30 days and encrypted backups may persist for up to 90 days before rotation. Payment, tax, fraud-prevention, audit, and transaction records may be retained for up to seven years where legally required. A church may export or delete records sooner through the product.
8. Security
We use access controls, row-level database security, encrypted transport, restricted secrets, audit records, provider-signature checks, Turnstile, and operational monitoring. No online service is risk-free. Customers should protect passwords and collect only information necessary for follow-up.
9. Your rights
Subject to the Nigeria Data Protection Act 2023, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. A church contact should normally contact the church that collected the information first. We will assist the church or respond directly where WinASoul is the controller.
10. Cookies and security technology
WinASoul uses essential session storage and authentication data needed to keep users signed in and protect accounts. Cloudflare Turnstile may process device and network signals to distinguish legitimate visitors from abuse. We do not currently use advertising cookies.
11. Complaints and updates
Send privacy requests to help@winasoul.online. You may also complain to the Nigeria Data Protection Commission. We may update this policy when the service or law changes and will publish the revised effective date.