Privacy Policy

Scope of this policy

This policy applies only to the www.heavenlyspring.org website. Other platforms affiliated with or recommended by the Foundation (such as ipray.love, intoone.org, ontherock.family and walkwith.love) are operated separately and have their own privacy policies. Please review those policies when using those platforms.

Information we collect

• Account information: the username, email address and password you provide at registration (passwords are stored using a one-way hash and cannot be read by us), plus your name and phone number if you choose to supply them.
• Profile information: the avatar you upload and the biography you write, both optional.
• Donation information: online giving on this website is provided by the third-party platform Zeffy and completed within Zeffy pages. The name, email, amount and payment details you enter do not pass through and are not stored on this website; they are collected by Zeffy and governed by its privacy policy, while the Foundation as recipient can view donation records in the Zeffy dashboard. If you give by Interac e-Transfer, the related information is passed to our receiving email address by your bank.
• Missionary information (only for users registered as missionaries): sending organization, field location, ministry type, start date, home church, support goal, and testimony and vision text that you choose to provide.
• Content moderation records: while a project, profile or news item you submit is awaiting review, the system retains a copy of the content together with its review status and reviewer notes.
• Session information: a session cookie used to keep you signed in, and your username stored in your browser if you tick "remember username".

How we use your information

• To create and maintain your account, authenticate sign-ins, and process password reset requests.
• To display fundraising progress for projects and missionaries (progress figures are maintained manually by the Foundation based on what is received in the Zeffy dashboard).
• To issue donation receipts and meet the record-keeping obligations required by Canadian tax and charity regulations.
• To display approved missionary profiles, projects and news items on the website.
• To produce aggregate statistics that contain no personally identifying information (such as total funds raised or number of projects) for display on the website.
• To contact you about your account or your donations.

How payment information is handled

This website does not process payments itself and hosts no payment form of its own. Online giving is completed through an embedded Zeffy form, and the entire payment process takes place within Zeffy systems. We do not collect, access or store your card number, card verification code, online banking password or any payment account credentials, and our database holds no donation or payment records at all. For how Zeffy handles your information, please consult the Zeffy privacy policy. The alternative is Interac e-Transfer, where the related information reaches our receiving email address through your bank and is handled manually by staff.

Missionary information and safety considerations

Field location, sending organization and home church details supplied by missionaries may carry personal safety implications in certain countries and regions. All of these fields are provided voluntarily by the missionary; you may use a general description or leave them blank. Submitted information is reviewed by the Foundation before it is published. If you wish to amend, generalize or withdraw information that has already been published, please contact us and we will act promptly.

Donation receipts and statutory retention

The Foundation is a non-profit registered in British Columbia and is currently applying for registered charity status with the Canada Revenue Agency (CRA); donations at this stage may not qualify for a tax receipt. Whether or not that status has been granted, we retain donation records and supporting documents for accounting and audit purposes. Once registered charity status is granted, we will issue receipts for eligible donations as required by the CRA and retain the related records for the period the CRA requires; at that point information connected to donation receipts (such as donor name, amount and date) cannot be deleted during the statutory retention period, even after you close your account. Such records are used solely to meet legal obligations, for accounting, and to support lawful review by the competent authorities.

Whether we share your data

We do not sell your personal information, we do not provide your data to third-party advertisers, and we have not deployed any third-party analytics or advertising tracking code on this website. Your information is accessed only in these limited circumstances: by authorized Foundation administrators within the scope necessary to perform their duties; by the third-party platform Zeffy when you give online (collected independently by Zeffy and handled under its own privacy policy); and where required by law or in response to lawful review by a competent authority.

Use of cookies

This website uses only the cookies necessary for basic functionality: a session cookie that keeps you signed in, and a cookie storing your username if you actively tick "remember username" (valid for 30 days). We do not use advertising cookies and we do not perform cross-site tracking. You may clear or block these cookies in your browser, but doing so will prevent you from staying signed in.

Operational logs

To diagnose faults and safeguard accounts, the server records certain operational logs which may contain usernames, email addresses and password reset tokens. These logs are consulted only by the Foundation technical maintainers when necessary and are not disclosed externally.

Data retention

Your account information is retained until you ask us to delete it. On receiving a deletion request we remove your account information and profile within a reasonable period. However, as described in the "Donation receipts and statutory retention" section above, records connected to donation receipts must be kept for the statutory retention period and are not removed when an account is deleted. Project and news content that has been published and approved may be retained after your personally identifying information has been removed.

Your rights

• Access: sign in and open the Profile page to view your account information.
• Correction: you may update your name, phone number, avatar and biography at any time; changes to missionary information are subject to review before republication.
• Deletion: to delete your account, email intoone.org@gmail.com and we will process the request within 14 business days (except for donation records subject to statutory retention).
• Withdrawing consent: you may stop using this website and request deletion of your account at any time.
• Complaints: if you believe the Foundation has handled your personal information improperly, please contact us first. You also have the right to complain to the Office of the Privacy Commissioner of Canada (OPC) or the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC).

Security measures

This website transmits data over HTTPS, hashes user passwords with the bcrypt algorithm, validates form submissions with CSRF tokens, and requires authenticated, role-based access to the administration area. Although we continue to apply reasonable technical and organizational measures, no method of transmission over or storage on the internet can be guaranteed to be completely secure.

Children privacy

This website is intended for adults and for young people using it under the guidance of a guardian. We do not knowingly collect personal information from children under 13. If you become aware that a child under 13 has registered an account without guardian consent, please contact us and we will delete the information promptly.

Changes to this policy

We may update this policy from time to time. When a material change is made we will update the "Last updated" date at the top of this page and post a notice on the website. Continued use of the website indicates your acceptance of the revised policy.

Contact us and privacy officer