Privacy Policy

We ask for as little as a form can work with, we keep it where only church staff can reach it, and we delete it the moment you ask. We have never sold or rented anyone’s information, and we never will.

We do measure how the site is used, and we use advertising tools that rely on cookies. That is set out in full under Analytics and advertising below — please read it, because it is the part most people assume a church site does not do.

If you want to know what we hold about you, or want it gone, email info@rumblingwaters.com and a person will deal with it.

The contact form, the visit RSVP, the baptism form, the connection card, the group enquiry form and the RWC Kids pre-registration all do two things: they email the church, and they save what you sent so the team has a list to work through rather than a scrolling inbox. Each one also sends you a confirmation, so you can see what reached us.

What is kept is what you filled in — your name, your email, a phone number if you gave one, whatever you wrote in the message box, and the form-specific parts: the service you picked, the children you are bringing, the decision you marked, the address you added. Nothing else is inferred or added.

Children. Two forms ask about children — the visit RSVP and the RWC Kids pre-registration — and both ask for the least a volunteer needs to write on a name tag: a first name and an age. We do not ask for a surname, a date of birth, a school or a photograph, and a child’s details are never used for anything but check-in on the day. They are kept where the rest of it is kept, deleted when you ask, and deleted along with the rest of a family’s submission.

Who can see it. Only church staff signed in to our admin area. It is never public, and it is not readable through the website by anyone who is not signed in — that is enforced in the software, not just left off the page.

If you mark a connection card confidential, it is locked down further: only senior staff accounts can open it. Staff who look after the website but not pastoral care cannot read it, and cannot see that it exists. It is also flagged before anyone opens the email, and kept out of our system logs.

Getting it removed. Every submission can be deleted, and any staff member who can see it can delete it. Ask us and it goes — you do not need to explain why.

A prayer request is stored, because the prayer team needs to be able to come back to it. It arrives unapproved and stays invisible until a person has read it.

Nothing appears on the public prayer wall unless someone approves it, and a request marked private is never published at all — it goes to the prayer team and no further. A first name is shown on the wall only if you gave one; leave it blank and the request appears anonymously. Ask us and we will delete it.

We never see your card. Card and bank details are entered directly into our payment provider’s own secure fields and go straight to them. They do not pass through this website and we do not store them.

What we do keep is the ledger a church has to keep: your name, email, the amount, the date, the fund, whether it recurs, and a reference from the payment provider. That is what receipts, annual statements and our own accounting are built from, and we are required to retain it.

We also record which version of the terms you accepted and when.

If you create an account we store your name, email address, a securely hashed password — never the password itself — and optionally a mailing address for statements. Signing in sets a single cookie so the site knows it is you. That particular cookie is only used to keep you signed in and does nothing on any other site — the analytics and advertising cookies described below are separate.

This site uses cookies for four things: keeping you signed in, telling people from scripts on our forms, measuring how the site is used, and advertising. The first two are necessary for the site to work. The last two are covered in the next section.

We do not show a cookie banner, so nothing here is waiting on your consent — the cookies are set when you arrive. You can block or clear them in your browser settings at any time, and you can opt out of analytics and advertising cookies using the tools described below. Blocking them does not break the site.

Two small preferences are kept in your browser rather than sent to us: which prayers you have marked as prayed for, and whether you turned the river sound on. Clearing your browser data removes both.

Analytics. We use a third-party analytics service to understand how the site is used — which pages people read, how they arrived, roughly where in the world they are, and what device they are on. It sets cookies and assigns your browser an identifier. We use it to make the site better, not to identify you personally.

Advertising. We also use advertising and remarketing tools. These place cookies that allow us, and the advertising platforms we use, to show you church-related advertising on other websites and social media after you have visited here, and to measure whether those adverts worked. This means those platforms receive a record that your browser visited this site.

Where it runs. Honestly: everywhere. Analytics and advertising tags load on every page of this site, including the giving pages, the member account area, the in-service dashboard and the connection card. They do not receive the contents of a form — not your card details, not your prayer request, not what you marked on a connection card — but they do receive the fact that a browser visited those pages.

Opting out. Your browser settings can block or clear these cookies. Most advertising platforms offer their own opt-out controls, and browser-level privacy settings and tracker-blocking extensions also work here. If you would rather we excluded you entirely, email us and we will tell you exactly how.

We do not sell, rent or trade anyone’s information. We do not share our member or donor list with other organizations. We do not send the contents of any form — giving, prayer, connection card or contact — to an advertising platform. And we make no automated decisions about you.

Running a website and processing gifts means using a handful of specialist suppliers. Each one only receives what it needs to do its job, is contractually required to protect it, and may not use it for its own purposes:

• a payment provider, which handles card and bank details and processes gifts
• a hosting and infrastructure provider, which serves the site
• a database provider, which holds the giving ledger and member accounts
• an email delivery provider, which sends receipts, statements and account emails
• a bot-protection provider, which keeps automated abuse off the forms
• an email marketing provider, used only for church updates and only if you asked for them
• an analytics provider, which measures how the site is used
• advertising platforms, which place the remarketing cookies described above and receive a record that your browser visited this site

We have described these by role rather than by brand. If you want to know exactly who they are, ask us and we will tell you — that is a real offer, not a formality.

We may also disclose information where the law requires it, or where it is necessary to protect someone’s safety.

We photograph and film our services and events, and that footage is used on this site, on social media and in the online stream. If you are in the room, you may appear in it. Coming to a service is taken as agreement to that — it is how a church shows people what a Sunday is actually like.

If you would rather not appear, tell any member of the team and we will work around you, and if something is already published we will take it down on request. The same goes for your children: speak to the kids team or email us and we will keep them out of it.

Giving records are part of the church’s permanent financial records and are kept indefinitely — charities are expected to be able to account for what they received and when. Account information is kept while your account is open. Prayer requests are kept while they are being prayed for and cleared periodically after that. Form submissions are kept while they are being followed up and cleared once they are not — and deleted sooner if you ask. The emails those forms also generate live in the church inbox and are handled like any other correspondence.

This site is not aimed at children and we do not knowingly collect information from a child directly. Where a form asks about a child — a kids check-in or a visit RSVP — it is meant to be filled in by their parent or guardian, and we ask only for what the kids team needs on a Sunday morning. If you believe a child has given us information without a parent’s involvement, tell us and we will remove it.

The site is served over an encrypted connection, passwords are hashed, payment details never reach our systems, and access to giving records is limited to the staff who need it. No system is perfectly secure, but we do not keep what we do not need, which is the most effective protection available to us.

Ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it — subject to records we are legally required to keep, such as gift receipts. Unsubscribe links are in every marketing email, and you can stop a recurring gift at any time from your account.

Depending on where you live you may have additional rights over your information. We apply the same approach to everyone: ask, and we will do it.

If this policy changes, the version and date at the top of the page change with it.

Questions, requests, or anything you want removed: info@rumblingwaters.com, or write to us at 73932 Tallassee Highway, Wetumpka, AL 36092.