Privacy policy

Adventist Bot is the shared sign-in portal and staff toolset run by the South NSW Conference. Here is the short version. The sections below explain each point.

Seventh-day Adventist Church (South NSW Conference) Limited (“we”, “us”) runs Adventist Bot at portal.adventist.bot. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy covers:

• The sign-in service. One account that signs you in to the apps connected to Adventist Bot.
• The portal and its tools. People and roles, Benefits Tracker, Vouchers, Asset Compliance, Form Builder, finance tools (Dashboard, ELC Journals, MYOB Agent, Weel Import), the PrayerPulse staff console, Label Printer, and the Steward assistant.

Apps you reach through Adventist Bot, like PrayerPulse, Car Fleet and Simply Tithe, have their own privacy policies for what they collect themselves.

Other organizations can use Adventist Bot for their own people. For those organizations' records, that organization decides what is collected and who can see it, and we run the platform for them.

What we hold about you depends on which tools you use and which tools hold records about you.

Sensitive information

Some information the Privacy Act treats as sensitive. We collect it only when it's needed and with consent, or where the law allows:

• Religious affiliation. Belonging to a church organization can reveal it.
• Health information. A counselling voucher shows someone accessed counselling. We never collect what was discussed. Voucher codes are stored encrypted or hashed.
• Prayer requests. Through the PrayerPulse staff console, authorized moderators may see prayer requests, which can include religious beliefs and health details.

Some finance records, like early learning centre accounts, relate to families with children. Only finance staff with a granted role can see them.

From you. When you create an account, accept an invitation, update your profile, fill in a form or use a tool.

From your organization. Administrators add people, assign roles and grant access. Finance staff import records about staff.

From other systems we connect to. MYOB (accounting), Stripe (payment payouts), Weel (corporate cards), Hub Hello (early learning centre billing) and PrayerPulse.

Automatically. Your IP address and device type when you sign in, and the cookies listed under Cookies.

Where it's held

Our database and the Steward AI model run on servers we manage in Australia. Uploaded files and invoices are kept with Wasabi cloud storage in its Sydney region. See How we protect it.

You can use most of the internet without telling us who you are, but the portal can't work without a named account, because access depends on knowing who you are.

We use your information to:

• sign you in, keep your account secure and stop misuse (for example, locking out repeated wrong passwords)
• give you access to the apps and tools your role allows
• run conference administration: staff benefits, budgets, payroll reporting, journals, vouchers and asset compliance
• send the emails the service needs, like verification, password resets, invitations and scheduled finance reports
• answer your questions through Steward
• keep records that law and audit require, and investigate security incidents

We don't use your information for marketing, and we don't sell or rent it.

Inside your organization. People with the right role can see the records their tool shows. For example, an Area Mentor sees benefits only for the pastors assigned to them.

Connected apps. When you sign in to an app through Adventist Bot, that app receives your name, email and the access you've been granted. You approve this on the consent screen.

Service providers who help us run the service:

When the law requires it. For example, to a court, a regulator, or police with a lawful request.

Within the Seventh-day Adventist Church, we share information with other church entities only when needed to provide our services, or with your consent.

Your information may be sent to these countries:

• United States and other countries. Google processes the emails we send you.
• Singapore. Our public web server is hosted there. Traffic passes through it encrypted on the way to our Australian servers. It doesn't store your records.

Everything else stays in Australia. If this changes, we'll update this list before it happens.

The law requires us to tell you when a computer program uses your personal information to make, or help make, a decision that could significantly affect you.

Decisions made by a program alone

Decisions a program helps people make

In this second group a staff member reviews the result before acting on it.

Steward, the AI assistant

Steward answers questions using an AI model running on our own server in Australia. It doesn't make decisions about you. Your conversations are kept so you can come back to them, and they're not used to train models.

If you think a computer-made decision about you is wrong, contact us at snswcomms@adventist.org.au and a person will review it.

We manage security and privacy risks using the NIST Cybersecurity Framework 2.0 and the NIST Privacy Framework as guides. This means we look after governance, finding risks, protecting data, detecting problems, responding and recovering. We aren't certified against them.

• Encrypted connections (HTTPS) everywhere
• Passwords stored only as one-way hashes
• Two-factor authentication available on every account
• Limits on repeated sign-in attempts, and account lockout
• Access only through grants an administrator gives, limited to each role
• Extra encryption for sensitive items like voucher codes
• A security activity log, and a way to sign out every device at once
• Our database and backend run on a private network, not the open internet

No system is perfectly secure. You can help by using a strong password and turning on two-factor authentication in Account security.

When we no longer need information, we delete it or remove the details that identify you.

If we suspect a data breach, we act quickly to contain it and assess the harm. The law gives us 30 days to finish that assessment, and we aim to be faster.

If a breach is likely to cause serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. We'll also tell you what you can do to protect yourself.

You can ask to see the personal information we hold about you, and ask us to correct it if it's wrong, out of date or incomplete. It's free to ask.

• Change your name in Profile, and manage your devices in Account security.
• For anything else, including closing your account, email snswcomms@adventist.org.au.

We'll reply within 30 days. We'll need to confirm who you are first. If we refuse a request, we'll explain why in writing and tell you how to complain.

We use only the cookies the portal needs to work. There are no advertising or analytics cookies.

1. Write to us first at snswcomms@adventist.org.au. Say what happened and what you'd like us to do.
2. We'll respond within 30 days.
3. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We review this policy at least once a year, and whenever the way we handle information changes. The date at the top shows the last update.

Feedback on this policy is welcome at snswcomms@adventist.org.au. We read every message and use it at our next review.