Your church’s data, on its terms.

This addendum is part of our terms, the agreement between Voclyn Atelier Inc. (“we”) and your church. It covers the personal information in what your church puts into Voclyn, or has us process for it (“church data”): the speech and words of its services, its saved transcripts and glossary, its team’s names and email addresses, its cloned voices with their consent records, and what its API and webhooks carry.

Your church accepts it by using Voclyn: there is nothing to sign. Where this addendum and the terms differ about church data, this addendum applies.

Your church decides why and how its church data is used: which services are captioned, whether transcripts are saved, who is on its team, whose voice is cloned. For church data, your church is in control (the “controller”, in some laws), and we act for it (its “service provider” or “processor”).

For what we need to run Voclyn ourselves, such as accounts, billing, security, our website’s visit counts and our emails to churches, we are responsible on our own, as our privacy page describes.

Your church is responsible for its side: telling people that a service is captioned and translated where the law requires it, and making sure each person gives their own consent, signing and ticking it themselves, before their voice is cloned (see cloned voices in the terms).

• We process church data only to provide Voclyn to your church, following its instructions: these terms, the settings it chooses, and what it asks of us in writing.
• We don’t sell church data, use it for advertising, or use it to train AI models.
• Only the people who run Voclyn can reach church data, only to keep the service running or to help when your church asks, and they keep it confidential.
• We help your church answer people who ask to see, correct or delete their information, and with any privacy assessment it must make, with what we know about our part.
• If a law requires us to hand church data to an authority, we tell your church first, unless the law forbids us.

We use the companies listed on our privacy page, each for one job and with only what that job needs, under a contract that requires it to protect what it receives. Your church agrees to them by accepting this addendum, and we stay responsible to your church for their part.

Before a new company receives any church data, we add it to that list and email account holders at least 14 days ahead. If your church objects, write to us; if we can’t resolve it, your church may close its account. If we must change sooner to keep the service running or safe, we tell your church as soon as we can.

We protect church data with the measures on our security page, among them encryption in transit, each church walled off from the others in the database itself, and service audio that is never stored. We may change them, but not in a way that protects church data less.

If church data is lost, stolen, or seen by someone who shouldn’t have seen it, we tell your church’s owners without undue delay after we learn of it: what happened, which data it touches, what we are doing about it, and what your church can do. We keep a record of every such incident, help your church with any notice it must give, and tell the regulator and the people affected where the law requires us to.

• While your account is open, your church decides what stays. Saved transcripts are deleted automatically after its plan’s period (14 days later when the free month ends or the plan changes to one that keeps less). Cloned voices beyond its plan are deleted 90 days after the plan stops including them. Your church can delete cloned voices, glossary terms, rooms and webhook addresses and revoke API keys itself, and we delete anything else when it asks.
• When your church closes its account, we delete its church data within 30 days, and its cloned voices at our voice provider, apart from what the law requires us to keep, such as billing records.
• Copies in our database provider’s backups last until those backups expire (see backups).

Church data is processed outside Canada: in the United States (our servers, database, speech recognition, email and payments), in Singapore (the AI voice and cloned voices), and wherever Google processes Gemini requests (translation). Our privacy page says which company works where. Wherever it is, church data is protected by our contracts and these promises, but it may be accessible to courts and authorities there under their laws.

Your church can ask us in writing how we protect its data, and we will answer. Our privacy officer, our founder, answers at hello@voclyn.com.

We change this addendum as we change our terms: when a change matters, we email account holders at least 30 days before it takes effect.