Privacy at Pave

The church decides what to collect and why. Under New Zealand’s Privacy Act 2020 and Australia’s Privacy Act 1988, the church is the organisation accountable to the people whose details it holds.

Pave provides and runs the software on the church’s behalf. We only handle that information to make the service work — never for our own purposes, never to build a profile of anyone, and never for advertising.

People a church is following up: name, phone, email, and optionally date of birth, suburb, stage of life, how they heard about the church, what they said they were interested in, notes staff write, and a record of contact attempts and milestones. Some of this touches on religious belief — an interest in baptism, a decision recorded on a Sunday. In Australia that is sensitive information and needs consent, which is why Pave gives every church a collection notice to put on its cards.

Church staff and volunteers: name, email address, role, and follow-up capacity.

Sunday numbers: attendance and outcome counts. These are totals, not people.

Only to run that church’s follow-up: showing their team who to contact, tracking the journey, and producing their own summary statistics. We never sell it, never use it to advertise, and never pass someone’s personal details to anyone else. There is one thing a church can choose to share, described below — and it is totals, not people.

Each church’s data is isolated at the database level — one church can never see another’s, and within a church, access depends on the person’s role.

Some churches are part of a denomination or network — a movement. A church joins one by entering a code its movement office gives them, and can leave again whenever it likes. Nothing is shared unless a church chooses to join.

Once it has, Pave sends that movement office:

• weekly attendance and outcome totals, service by service
• the monthly giving total the church confirms, and any levy calculated from it
• the email addresses of the people at that church who hold the Finance and Admin roles, so the office can send invoices and reminders to the right people
• a note when the church joins or leaves

It never sends anything about the people a church is following up. No names, no contact details, no notes, no journeys — only the totals and the two staff contacts above. That boundary is enforced by the software itself: a message carrying anything else is refused before it leaves.

Nothing travels the other way. A movement office cannot sign in to Pave, see a church’s screens, or put anything into them.

In a managed PostgreSQL database hosted by Supabase in Sydney, Australia, with the application served from the same region. Traffic is encrypted in transit. Passwords are handled by Supabase Auth and are never visible to us or to a church.

Each church sets a retention window. When someone finishes their journey and has been handed to the church’s own database, a nightly job anonymises them once the window passes: name, email, phone, date of birth, suburb and notes are removed, and contact records are deleted. Aggregate counts survive so a church’s history doesn’t break — but the person is no longer identifiable in Pave.

A church can also delete a person outright at any time, which removes every trace of them immediately.

You can ask to see, correct, or delete what a church holds about you. Contact the church directly — they can produce a full copy of your record, correct it, or delete it from Pave themselves. If you’d rather come to us, or you can’t reach the church, write to caleb@forgepartners.co.nz and we’ll help you get to the right people.

Pave sets one cookie, to keep you signed in. There is no advertising, no analytics tracking of individuals, and no third-party trackers.

If personal information is exposed in a way likely to cause serious harm, we notify the affected churches promptly and support them in reporting it — to the Office of the Australian Information Commissioner in Australia, or the Office of the Privacy Commissioner in New Zealand — within the timeframes those regimes require.

If this policy changes materially, we’ll let churches know through the app before it takes effect.