Embed Partner Privacy & Data Processing

When you host our widget, we process your seekers' personal information to provide the chat service. For that processing we act as a processor on your behalf, under your instructions and the DPA. We also use aggregated, de-identified data to operate and improve the service. (The precise controller/processor allocation is set out in, and governed by, the executed DPA.)

• Conversation content between the seeker and the AI.
• Approximate location derived from IP (country/city) and language.
• Interaction signals used for analytics (e.g. topics, engagement, journey milestones).
• Contact details only where a seeker chooses to share them to be followed up with (e.g. a name and a contact method such as email or WhatsApp).

These conversations concern religion and belief, which is “special category” data under laws such as the GDPR. We handle it with heightened care and process it to provide the service you've engaged us for. The DPA and the seeker-facing notice address the basis for this processing; this area is subject to counsel review.

We use a limited set of vetted providers to run the service:

• Anthropic — AI model provider (chat generation).
• Supabase — database, authentication, and storage.
• Vercel — application hosting and delivery.
• Stripe — payment processing for partner billing.
• Resend — transactional email.

The authoritative, maintained sub-processor list is Annex 3 of the DPA.

Because seekers are global and our providers operate internationally, personal data may be transferred across borders. Where required, transfers rely on appropriate safeguards. The specific mechanisms are set out in the DPA and are subject to counsel review.

We retain conversation and seeker data for as long as needed to provide the service, support ministry follow-up, and meet legal obligations. We apply industry-standard technical and organizational security measures (Annex 2 of the DPA). We do not sell personal information.

Sharing contact details is optional — a seeker chooses whether to provide a name or contact method in order to be followed up with. To make a privacy request (such as access to, or deletion of, personal information), a seeker or partner can contact us at hello@envoymission.org and we will respond as required by applicable law. As the partner, you are responsible for providing seekers on your properties with any privacy notice the law requires.

Envoy Mission Inc is a 501(c)(3) organization (EIN 41-4924473). Privacy questions: hello@envoymission.org. See also our general Privacy Policy.