Privacy Policy.
Symphonia keeps some of the most sensitive records a community has. This is a plain account of how we handle them, written for a parish rather than a boardroom.
Overview
Symphonia is the parish operating system operated by Ancient Designs LLC (in this policy, "we", "us", or "Symphonia"). This policy explains what personal information we handle, why, and the choices you have. It covers both the people who use our website and sign up for Symphonia, and the parishioners whose records a parish keeps inside Symphonia.
1. Who is responsible for your data
There are two relationships to keep clear, because they carry different legal duties.
Parishioner records inside Symphonia. When a parish enters its members, households, giving history and sacramental records, the parish is the data controller: it decides what is collected and why. Symphonia acts as the data processor, handling that information strictly on the parish's instructions. The full terms of that relationship are set out in our Data Processing Agreement.
Your own account and our website. When you visit symphonia.church, request a demo, or administer a Symphonia account, we are the controller of that information and this policy governs it directly.
2. What we collect
From parishes and their parishioners
On a parish's behalf, Symphonia stores the records the parish chooses to keep, which can include:
- Identity: name, saint name, baptismal name.
- Contact details: email, phone, and mailing address.
- Household structure and family relationships.
- Sacramental records (a special category of data under privacy law, as it reflects religious life).
- Giving and pledge history.
- Pastoral notes, which are kept to the clergy and encrypted at rest.
- Communication history and delivery state.
- Sign-in credentials (stored only as password hashes and second-factor records, never as readable passwords).
From people signed in to Symphonia
While you are signed in, we record the pages you open, with your IP address, browser, and device, to keep accounts secure and to show who is online. These records are deleted after 180 days.
From visitors and prospective parishes
- What you send us: your name, email, parish, role, and anything you write when you request a demo or contact us. With it we keep the IP address, browser, and page you wrote from, to guard against spam and abuse.
- Page counts on symphonia.church: the page you viewed, the domain of the website that sent you, any campaign tag in the link, and whether you are on a phone, tablet, or computer. We do not store your IP address or set a cookie for this.
- To stop abuse, our servers use your IP address for a short time to limit how often requests can be made. Those counters are deleted within a few hours.
3. How we use information
We use information only to run Symphonia and support the parishes on it:
- To provide the service a parish has signed up for, and to keep its records available and accurate.
- To send transactional messages a parish has configured (statements, reminders, announcements) on its behalf.
- To answer your questions and follow up on a demo request.
- To keep the service secure: detecting abuse, preventing fraud, and maintaining an audit trail.
- To meet legal, tax, and accounting obligations.
- To improve reliability and performance, using aggregated, non-identifying signals.
If a parish turns on Symphonia’s optional AI helpers, they run on our own server. No parish data is sent to an outside AI service.
4. What we never do
- We never sell personal information, to anyone, for any purpose.
- We never rent your parish list or share it for another party's marketing.
- We never place third-party advertising trackers inside the parish product.
- We never use parish records to train machine-learning or AI models.
- We never browse pastoral notes. The confession log and the sealed pastoral record are encrypted, open in Symphonia only for the priest they belong to, and are hidden from every support session. Ancient Designs runs the system and holds its encryption keys, so this protection rests on strict access rules and audit logs as well as encryption. Section 10 explains how.
5. Giving and payments
Online giving is processed by Stripe on Stripe's own checkout pages, and gifts settle directly to the parish's own account. Symphonia never receives or stores full card numbers or bank credentials: those are handled inside Stripe's PCI-compliant systems. We keep the giving record (amount, date, fund, and donor, as the parish requires for statements and tax receipts), but not the payment instrument itself. Stripe's own handling of payment data is governed by its privacy policy.
7. Text messages (SMS)
A parish can send text messages through Symphonia to people who have agreed to receive them. To do that, we keep:
- The mobile number the texts go to.
- The consent record: when the person agreed, how they agreed (in the My Parish app, through the parish office, by texting a keyword such as START, or from the parish's own records when those records include a consent column), the exact words they were shown, and who recorded it.
- Every STOP, START and HELP reply, so an opt-out is honoured at once and can be shown later.
- Delivery status reported by the mobile carrier.
We use this only to send the texts a parish has chosen to send, to honour opt-outs, and to keep the consent record that the law and the mobile carriers require. Texts are delivered by our messaging provider, Telnyx, which is listed on our sub-processors page.
Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors that support the service, such as the messaging provider that delivers the texts. Text messaging originator opt-in data and consent will not be shared with any third parties.
Reply STOP to any parish text to stop receiving texts, or HELP for help. You can also turn texts off in your My Parish profile. The full terms for text messages are in our Terms of Service.
10. How long we keep information
A parish's records are kept for as long as the parish uses Symphonia. When a parish leaves, we return or delete its data within thirty days, at the parish's choice, except where a specific record must be retained by law.
Two categories are treated with care by design: sacramental records, which are a canonical history the parish is responsible for keeping, and giving records, which are kept for seven years for tax documentation and then anonymised. Deletion flows explain both to the person at the moment they act.
Sign-in activity records are deleted after 180 days. Website and demo enquiries, with the technical details kept alongside them, are kept while they are useful for following up, and we delete them when you ask. Page counts on symphonia.church contain no personal information.
11. How we protect it
All parishes share one database, and every record in it belongs to exactly one parish. Symphonia limits every request to the signed-in parish, and for the most sensitive tables (members, households, sacramental and giving records, and pledges) the database enforces the same limit again with row-level security.
Contact details, sacramental notes, and pastoral notes are encrypted at rest with a key for each parish, and a key for each priest for pastoral notes. Those keys come from a root key that Ancient Designs holds, protected by Amazon Web Services’ key management service. Encryption protects your records if a copy of the database or a backup is ever taken. Access by our own staff is controlled separately: it is limited to staff roles, and every support session inside a parish is written to that parish’s audit log.
All traffic is encrypted in transit, sensitive actions are written to a tamper-evident audit log, and nightly backups are encrypted before they are copied off the server. The full picture, including the limits, is on our security page.
12. Your rights and choices
Depending on where you live, you have rights to access, correct, export, restrict, object to, or delete your personal information. Symphonia is built so parishioners can exercise most of these themselves, from inside the member app:
- Access and export a full copy of your record (in a portable format).
- Correct your own contact details and family information.
- Set your communication preferences, per channel.
- Request deletion of your record, subject to the sacramental and tax carve-outs above.
Because a parish is the controller of parishioner data, a request made directly to us is passed to the parish without delay rather than acted on unilaterally. For your own account or a website enquiry, simply write to us and we will help. We do not charge for rights requests and we do not retaliate for making one.
13. Children
Symphonia is not directed at children and we do not knowingly collect information from children through our website. A parish may keep records for the young people in its community (for example a baptism record or a church-school roster) as part of its own pastoral responsibility; that information is handled under the parish's instruction and is never used for marketing.
14. Where your data lives
Symphonia is hosted in the United States. Our application and database server is in Los Angeles, California, provided by Ethernet Servers Ltd, a company based in the United Kingdom. Encrypted backups and uploaded files are kept in Cloudflare R2. Most of our other providers are also in the United States, and each one’s location is on the sub-processors page.
If you or your parish are outside the United States, your information is transferred to and stored in the United States. A parish that needs a transfer agreement for this, such as the EU Standard Contractual Clauses, can write to us. Ancient Designs LLC is a company organised in the United States.
15. Changes to this policy
When we make a material change, we update the date at the top of this page and, for anything significant, we notify parish administrators directly. Continuing to use Symphonia after a change means the updated policy applies. Older versions are available on request.
16. Contact us
Privacy questions from a parish are answered within one business day. The quickest way to reach a real person is to write to us here or email hello@symphonia.church. For formal notices, the responsible legal entity is Ancient Designs LLC, the operator of Symphonia.
This policy is written to be read, not to be survived. If a passage is unclear, tell us and we will make it plainer.
8. Social media
A parish can connect its own Facebook Page, Instagram account, Threads account and Bluesky account to Symphonia, and post to them from the same place it sends email and text messages.
Disconnecting an account in Symphonia deletes its access key and stops every post still waiting to go to it. If you remove Symphonia in your Facebook, Instagram or Threads settings, Meta tells us and we end the connection the same way, straight away. To have us delete what we hold about a social media connection, follow these instructions.