Privacy Policy
This policy explains what personal data DisplayWord collects, why, who else sees it, and what you can do about it. It covers the website displayword.com, the DisplayWord software, and the work of the people who help congregations on our behalf.
We have tried to write it as a description of what actually happens rather than as a list of everything we might one day do. Where something is not built yet, we say so instead of promising it.
1. Who is responsible
The data controller is David Willart, an individual entrepreneur registered in Israel (osek patur), trading as DisplayWord.
Contact for any privacy question or request: hello@displayword.com
We have not appointed a Data Protection Officer; the law does not require one for an operation of this size.
2. The short version
- You can use the Software without giving us anything at all. No account, no registration and no payment card is needed — including for the 60 days of full access to a paid edition. If you never subscribe, we never learn who you are.
- When you create an account, we collect very little: an email address, a password and your name. To buy a subscription or to ask for help, you also tell us about your congregation — its name, country and city. Its contact details are optional.
- When you buy a subscription, the purchase is handled by Paddle, our merchant of record. Your card details go to Paddle and never pass through our systems. From Paddle we receive what we need to issue and renew your licence key — the amount, the currency, the country, the edition and the paid period — not your card and not your postal address.
- If your congregation asks us for help, what you write in a support request is seen by the members of our team who help congregations. It is not published anywhere.
- The only analytics on this website is a visitor counter run by Cloudflare, the company that also hosts the site. It sets no cookies and stores nothing in your browser. There is no Google Analytics, no tracking pixels, no advertising cookies and no third-party trackers. We ourselves do not see or store the IP addresses of visitors, buyers or users of the Software.
- One cookie, strictly technical, set only after you sign in. The payment window is Paddle's and follows Paddle's own policy.
- The Software does not phone home unless you agree. It contacts us to activate a licence and to check for updates, and it fetches the list of Bible translations when you open that tab. If — and only if — you answer "Yes" when it asks, it also sends us a short weekly signal that it is in use: no names, no songs, no texts (section 4.4). You can switch it off at any time. Section 4 lists every address the Software talks to.
- Your songbooks, service plans and settings never leave your computer. We cannot see them.
- We do not sell personal data. We do not share it for advertising. There is no advertising.
3. What we collect on the website
3.1 Creating an account
Three things: your email address, a password and your name. The name is simply what we use to address you; it does not have to be your legal name. Nothing else is required — no telephone number, no organisation.
Your password is stored as a cryptographic hash. It is not stored in readable form anywhere and cannot be recovered by us. If you forget it, you can set a new one through a one-time link sent to your email address.
We also generate an internal identifier and record the date the account was created. For security, we count failed sign-in attempts and temporarily lock the account after too many of them in a row; the counter is reset by a successful sign-in. An administrator can also close sign-in to an account, and we record that this was done.
When you register, reset your password, subscribe to the newsletter, register as a team member, download an installer or send us a wish (3.12), your request passes once through Cloudflare's check that you are not a robot. Cloudflare sees your IP address at that moment; we do not record it.
3.2 Your congregation
Your account is only a way to sign in. Everything else — subscriptions, licence keys, support requests — belongs to your congregation, which has its own record. When you create it, we ask for:
| Field | Why we ask |
|---|---|
| Name of your congregation or organisation | Attaching licence keys and subscriptions to it, and addressing you when you write to support |
| Country — two-letter code, ISO 3166-1 alpha-2 | Tax and currency handling when you buy a subscription; knowing where the Software is used |
| City | Support, and understanding where the Software is used |
| "Setup and training" — who helped you set up the Software and learn it: up to three people from a short list of those who work with us, or "Nobody, we found it ourselves" | Knowing which of our people assisted your congregation, so that we can account for their work |
| "Who recommended the Software to you" — a free text of up to 200 characters, asked only if you chose "Nobody" above | Understanding how congregations find us. It is seen only by the administrator and has no effect on anything else |
The "Setup and training" choice is made once, when the congregation is created. After that it can be changed only by us, on request; every change is written to an internal log. The people on that list are members of our team, not other users; nothing about them is shown to you beyond a name.
We also record the date the account's details were last changed, as an internal audit record.
If you came through a team member's link. Members of our team have a personal link to the website. If you arrive through one, your browser keeps a mark of that link — the team member's code and the time you followed it. It is an entry in your browser's local storage, not a cookie. If you create an account within 30 days, the code and the time are also kept with your account until you register your congregation. When you do, that team member is filled in under "Setup and training" — you can change the choice. After the congregation is registered the mark is erased; a mark older than 30 days is not used.
3.3 Contact details of your congregation
If your congregation asks us for support, you may add the details we need in order to reach it. Every field here is optional.
| Field | Why we offer it |
|---|---|
| Street address of the congregation | So that a member of our team who has to visit knows where to go |
| Name of the senior minister — one or two people | Addressing your congregation properly |
| Email address of the congregation | Writing to you about your requests. This is not your sign-in address and changing it here does not change how you sign in |
| Contact person — name, role and a telephone number or messenger | Reaching someone who can actually answer questions about the problem |
| A second contact — name and telephone number | Reaching your congregation when the first person is unavailable |
| A free description of your congregation | Whatever you would like us to know |
These details are entered by your congregation, and some of them are about other people. Please enter only the contacts of people who know that you are giving them to us, and feel free to give a shared congregation number instead of a personal one.
What you enter here is shown to the members of our team who are attached to your congregation, and to those who see your congregation's support requests (section 3.6), wherever the request is shown to them — on their board, on the request itself and in the email that announces it — so that the person helping you can reach you without asking. Our team members are bound by our terms of work. None of this is published anywhere.
3.4 Licence key applications — discontinued on 19 August 2026
Until 19 August 2026 the website had a form for requesting a licence key. It asked for the name of your congregation or organisation, your city and country, a two-letter country code, and the edition requested; optionally, contact details, an approximate number of members and a free-text message.
That form has been removed and we no longer collect any of this. The Church edition is free and needs no key, the paid editions run for 60 days without one, and paid keys are issued automatically after purchase.
Applications submitted before 19 August 2026 remain in our database, together with the decision taken on them, for one year, and are then deleted automatically (section 7). You can have them deleted earlier by asking — see section 10.
3.5 Purchases, subscriptions and licence keys
Purchases are made through Paddle.com Market Limited (and affiliated companies of the Paddle group), acting as merchant of record. You pay Paddle; Paddle collects your billing details, charges your card and issues the receipt. Your card number and your billing address reach Paddle directly and never pass through our systems. Paddle's privacy policy is published at paddle.com/legal/privacy.
Paddle then tells us about the purchase, and we keep from that:
| What | Why |
|---|---|
| Paddle's transaction number and customer number | Matching payments, refunds and disputes to the right congregation |
| Amount, currency, the country of the purchase, the edition bought and the billing period | Issuing the right licence key and, later, calculating what our team members have earned |
| Whether the payment was refunded or disputed | Revoking or keeping the key as our Refund Policy describes |
| The subscription and the date it is paid until | Keeping the key valid for exactly the paid period and extending it on renewal |
| A log of the notifications Paddle sent us | Knowing what we received and when, if something goes wrong |
We do not receive or store the buyer's card, and we do not store the buyer's postal address. The buyer's name is not part of what we keep from Paddle.
Licence keys. For each key we store the key itself, the email address it was sent to, the country, the number of installations it permits and the date it is valid until. The key is attached to your congregation's record. For each installation that has activated the key we store the installation fingerprint (described in 4.1), the version of the Software, the two-letter country code of the activation and the date the installation last checked its key with us.
Actions on keys. When an administrator does something to a licence key — issues it, opens it, resends it, changes its term, frees an installation slot, revokes or deletes it — we record the action, who did it, when, and the administrator's IP address. This is a security trail in case a key leaks. It concerns our own administrator, not you: the IP addresses of buyers and users are not stored anywhere.
3.6 Support requests
Your congregation can ask our team for help from its account on the website. For each request we store the subject, the text you wrote and the whole conversation that follows, the language, the urgency you chose, who opened the request and which of our team members handled it, and a code that lets the request be opened by a link.
Who sees it. The administrator, and the members of our team who are attached to your congregation. If none of them takes the request in time, it appears on a general board that is visible to the team members who speak your congregation's language, so that someone else can help. Everyone who sees the request also sees your congregation's details from section 3.3 — address and contact people — so that they can reach you. Our team members are bound by our terms of work.
What goes into emails. The email that tells a team member about a new request contains the text of the request and the name of the person who wrote it, together with your congregation's details — this is a support request, and the person helping needs the whole picture at first glance. Emails about later messages in the conversation say only that a message is waiting; the message itself is in the account.
3.7 Newsletter
If you subscribe, your email address is passed to Brevo, which keeps the subscriber list and sends the newsletter on our behalf. We do not keep a copy of the list ourselves, and nothing else is collected.
3.8 Download statistics
When you download an installer from the download page, we record the name of the file, the date and time, the two-letter country code and an approximate city. The country and city are derived from your connection by our hosting provider at the moment of the request; the IP address itself is neither read nor stored by us. These records are not linked to any account or to any other data about you, and they are seen only by the administrator. Their purpose is to know how many copies are downloaded and roughly where. Automatic updates of an installed copy are not counted.
3.9 Notifications to the administrator
When something needs a human — a payment we could not match, a refund, a dispute — the website emails the administrator. The email contains the kind of event, Paddle's transaction number, the time and a short explanation; for a dispute, also the congregation, the amount and the reason given.
3.10 Visitor statistics, and what we do not collect
Cloudflare, which hosts and serves this website, adds a small visitor-counting script to every public page as it is delivered — Cloudflare Web Analytics. We want to describe it exactly, because "no analytics" would be untrue.
When a page loads, the script sends to Cloudflare: the address of the page and of the page you came from, both stripped of any query parameters; how fast the page loaded; the browser engine and operating-system version; and a random number that identifies that one page load and is forgotten when you leave the page. It sets no cookie, writes nothing to your browser's storage, and Cloudflare states that it does not fingerprint visitors by IP address, user agent or anything else. Cloudflare attributes the visit to a country at its network edge.
What we see in Cloudflare's dashboard is aggregate: page views, visits, which pages, where visitors came from, countries, browsers and device types, page speed. Only the administrator of our Cloudflare account sees it, and it goes nowhere else. Cloudflare keeps the full data for 7 days and a sample afterwards; the dashboard shows the last six months. If you use an ad blocker, the script is usually blocked and you are simply not counted.
Beyond that counter:
- We do not see or store your IP address. Cloudflare, as the company serving the site, processes the address of your connection to deliver the page and to attribute the visit to a country; it does not pass the address to us. What reaches our database is at most a two-letter country code — and, for installer downloads only, an approximate city (3.8). The one place an IP address is stored is our own administrator's, in the key-action log (3.5).
- We do not record your browser's user agent in our database.
- We use no Google Analytics, no advertising pixels, no social-media buttons and no third-party trackers. Our fonts are served from our own domain. Only three scripts come from elsewhere, each described in this policy: the Cloudflare visitor counter (this section), Cloudflare's "not a robot" check (3.1) and Paddle's payment window (section 11).
3.11 Error logs
When something fails — an email does not go out, a third-party service returns an error — a technical message is written to our hosting provider's system log. We deliberately do not print email addresses into these messages. The text of a third-party error response may occasionally contain one. Retention of these logs is governed by the hosting provider's own policy.
3.12 Wishes
At displayword.com/wish anyone can tell us what they would like the Software to do better; the Software opens this page from its settings. No account is needed and nothing identifies the installation the visitor came from.
We keep what you write and, only if you choose to give them, the name of your congregation and an email address for our reply. We also keep the language of the page and the two-letter country code, which Cloudflare derives from the connection; the IP address and the city are not stored. The form passes once through Cloudflare's "not a robot" check (3.1).
A wish is sent to David Willart by email — through Brevo, which sends our email — and is kept in the website's administration, where only the administrators of the website see it. It is deleted automatically two years after it was sent.
4. What the Software collects
4.1 Activation
When you activate a licence key of a paid edition, the Software sends us three things: the key, an installation fingerprint and its own version number. Nothing else — not your language, not your operating system, nothing about your computer beyond the fingerprint described below. It repeats exactly the same request when you start the Software, if more than two weeks have passed since the last check; that is how we know the date an installation last checked its key (3.5).
We want to be precise about what the fingerprint is, because vague wording here is how privacy policies become untrue.
The fingerprint is produced by taking three values from your computer — the computer name, the operating system user name, and the hardware address of the first active network adapter — combining them, applying a SHA-256 hash, and keeping the first half of the result. Keys that work offline never send it anywhere: the Software only shows it to you as an "installation code" to quote when asking for such a key.
What this means in practice:
- The original values cannot be recovered from the fingerprint. The hash is one-way and is additionally truncated. Your computer name, user name and hardware address are never transmitted or stored by us in readable form.
- We do not treat the fingerprint as anonymous data. It is stable and its purpose is precisely to tell one installation from another. Under the GDPR this is pseudonymised personal data, not anonymous data, and we treat it accordingly.
Its only purpose is to enforce the number of installations a key permits.
The Software does not send us your country. Our server notes the two-letter country code of the connection the request came from. The server's answer — a signed confirmation, your congregation's name and the key's term — is kept by the Software in a small file on your computer.
4.2 Updates
Shortly after it starts, and then every four to six hours while it is running, the Software asks our release server whether a newer version exists; you can also ask it to check at any time. The request carries only what the server needs to hand back the right file: the type of operating system, its architecture, the name of the package and the version you already have. Nothing that distinguishes one installation from another, and nothing about how you use the Software. If a newer version exists, it is downloaded from the same server.
4.3 What stays on your device
Your songbooks, service plans, settings, backgrounds and any media you add are stored locally on your computer. They are never uploaded to us. We cannot read them, and we cannot recover them for you.
4.4 The weekly signal — only if you agree
The Software asks once whether it may send us a short weekly signal that it is in use: in the welcome screen at the first start, or — if you had already seen the welcome screen — once, as a card in the main window when nothing is being shown to the congregation. The two answers, "Yes, send" and "No, don't send", look the same. Until you answer "Yes", nothing is counted and nothing is sent. You can change your answer at any time in Settings → About.
What the signal contains. Once a week the Software sends:
| What | Example |
|---|---|
| A random number of this installation, created by the Software when you agree. It is not derived from your computer, it is not the installation fingerprint (4.1) and it is not linked to your licence key or your congregation | a6b83ac2-… |
| Version of the Software and of the operating system | 0.4.3, windows 11 26100 |
| Edition, and the day of the 60-day trial if it is running | team; trial, day 12 |
| On how many days of the last seven, and for how many minutes in total, slides were shown on the congregation's screen | 3 days, 140 minutes |
| Which parts of the Software were opened during the week | songs, Bible, media, Stage, Speaker, phones, tablets |
| Number of monitors and the language of the Software | 4, ru |
| How many times during the week the Software ended abnormally or was started in safe mode | 1, 0 |
| How many songs are in the songbooks of the Library | 1 250 |
| Where songs were imported from during the week | VisioBible, ProPresenter, EasyWorship, PowerPoint, other |
| Whether syncing is switched on | yes / no |
It contains no name of a congregation or a person, no song titles or texts, no Bible references, no files, no computer name, no network address of your computer and no times of your services. Our server accepts only the items listed above and discards anything else.
How it is sent. At most once a week, not earlier than ten minutes after the Software starts, and never while slides are being shown to the congregation. It goes to displayword.com. Our server derives a two-letter country code from the connection, as it does for downloads (3.8); the IP address is not stored.
Switching it off — "forget me". When you switch the signal off in Settings → About, the Software tells our server once, and the server immediately deletes every signal that came from this installation. If you later agree again, the Software creates a new random number.
What we do with it. We count how many installations are in use and in service, by country and edition, and which versions, parts of the Software and languages are used — to understand what to fix and what to build. Because only those who agreed send the signal, our figures mean "at least". Signals are kept for 12 months and then deleted automatically; weekly totals without the installation number are kept without a time limit.
Crashes. The signal carries only the number of abnormal endings. If the Software crashes, it writes a log file to your own disk and sends nothing else anywhere. The "Collect a report" button in the About window builds a diagnostic archive in a folder on your computer — and stops there; whether to send it to anyone, and how, is your decision.
4.5 Everything else the Software does on the network
- Bible translations. When you open the Translations tab in the Library, the Software fetches the catalogue of available translations from GitHub, where we publish it; GitHub, like any server, sees the address of the connection. Nothing is attached to the request. A translation you choose to download comes from our own server.
- Several computers in one congregation (Team edition) exchange data only over your local network, encrypted. Nothing goes to us.
- Syncing through Google Drive works through a folder that the Google Drive application on your computer keeps in sync. The Software itself never talks to Google and never signs in to any Google account.
- Tablets and phones connect to a small server that runs on the operator's computer, over the local network.
- "Write a wish" in Settings → About opens displayword.com/wish in your web browser, in the language of the Software. Nothing about the installation is passed to the page (3.12).
The Software cannot yet send support requests to us from inside the program. When it can, we will describe here exactly what is sent.
Those are all the addresses the Software talks to: displayword.com for activation and, if you agreed, for the weekly signal; releases.displayword.com for updates; bible.displayword.com and GitHub for Bible translations.
5. If you work with us as a team member
Some of the people who help congregations are not our employees but independent team members who work with us under published terms of work. If you are one of them, this section is about you.
What we store. Your name, email address, the country where you pay taxes (with the history of its changes), the city where you work and the languages you work in. Before you can work, you accept the terms of work for your country; for each acceptance we keep a record — your account's email address, the document and its language, the revision and the time. When a new revision is published you accept it again, and the earlier record stays. Your IP address is not stored. The details you enter for your payment documents — the name, address and tax number that must appear on them — and the email address of your Payoneer account, which is how we pay you. The documents you upload — invoices and receipts — are kept in our file storage. We also keep what the service calculates for you: your accruals, the payout statements, which congregations you are attached to and for how long, and the record of your work under the terms of work — warnings, the periods you marked yourself unavailable, and the miles you earn for helping.
Who sees it. The administrator. The congregations you help see your name. Nobody else sees your payment details or documents.
Where it goes. To pay you, we pass your name, your Payoneer email address and the amount to Payoneer. Your payment documents and our payout records go to our accountant, because Israeli tax law requires us to keep and account for them. They go nowhere else.
How long. For as long as you work with us, and afterwards for as long as tax and accounting law requires us to keep the records of what we paid and why. Those records are a legal obligation and cannot be deleted at your request; everything that is not needed for them can. The records of your acceptance of the terms of work are kept without a time limit, including after you stop working with us: they are the evidence of what we agreed.
6. Why we are allowed to process this (legal bases)
For readers in the EU, EEA and UK, the GDPR requires us to state a legal basis for each purpose.
| What | Purpose | Legal basis |
|---|---|---|
| Email, password and name | Operating your account | Performance of a contract (Art. 6(1)(b)) |
| Failed sign-in counter and temporary lock | Protecting your account from password guessing | Legitimate interests (Art. 6(1)(f)) |
| Your congregation — name, country, city | Attaching keys and subscriptions to it, supporting you, and applying the right tax and currency at checkout | Performance of a contract (Art. 6(1)(b)) |
| "Setup and training" choice and the date it was made; "Who recommended the Software" | Accounting for the work of the people who assist congregations; understanding how congregations find us | Legitimate interests (Art. 6(1)(f)) — the default is "Nobody", and the free text is yours to leave empty |
| Contact details of the congregation — address, minister, email, contact people | Answering your support requests and, where necessary, visiting you | Performance of a contract (Art. 6(1)(b)) |
| Free description of the congregation | Understanding your situation better | Legitimate interests — the field is optional and you write what you wish |
| What we receive from Paddle — transaction and customer numbers, amount, currency, country, edition, period, refund and dispute marks, paid-until date | Issuing, renewing and revoking your licence key; accounting for the money we receive | Performance of a contract; legal obligation (Art. 6(1)(c)) for the accounting records |
| Licence keys and activation records, including the installation fingerprint | Issuing keys and enforcing the installation limit of your licence | Performance of a contract for the key; legitimate interests for the fingerprint — protecting the licensed product against unlimited copying, using the least identifying method we could design |
| Support requests and their conversations | Helping your congregation with the Software | Performance of a contract (Art. 6(1)(b)) |
| Download statistics — file, time, country, approximate city | Knowing how many copies are downloaded and where | Legitimate interests — no account is involved and no IP address is kept |
| Visitor statistics (Cloudflare Web Analytics) | Knowing how the website is used | Legitimate interests (Art. 6(1)(f)) — no cookie, no identifier that persists between visits, aggregate figures only |
| Country code | Statistical understanding of where the Software is used; fraud prevention | Legitimate interests |
| Administrator key-action log, including the administrator's IP address | Accountability for actions on licence keys | Legitimate interests |
| Notifications to the administrator | Handling payments that need a human | Legitimate interests |
| Newsletter | Sending you the newsletter | Consent (Art. 6(1)(a)) — withdrawable at any time |
| The weekly signal from the Software (4.4) | Knowing how many installations are in use and what to improve | Consent (Art. 6(1)(a)) — asked in the Software, nothing is sent without "Yes"; withdrawn in Settings → About, which also deletes what was sent |
| Wishes (3.12) | Reading what you would like improved and, if you gave an address, answering | Consent (Art. 6(1)(a)) — you decide what to write and whether to leave contact details |
| Mark of a team member's link (3.2) | Knowing which team member brought a congregation, so that we can account for their work | Legitimate interests (Art. 6(1)(f)) — the mark is short-lived and the choice can be changed |
| Licence application details, collected before 19 August 2026 | Assessing and issuing your key at the time | Performance of a contract, and steps taken at your request before entering one |
| Team members' data — profile, payment details, documents, accruals, payout statements | Working together and paying you | Performance of a contract with you; legal obligation (Art. 6(1)(c)) for the payment and tax records |
| Records of team members' acceptance of the terms of work | Proving what was agreed and when | Performance of a contract; legitimate interests (Art. 6(1)(f)) in keeping evidence of the agreement |
7. How long we keep it
We keep personal data only as long as it serves the purpose it was collected for. Here is what actually happens today, rather than what would sound reassuring.
Since 5 October 2026 the website deletes data automatically by age, every night. The periods below are the ones actually in force; where a period will start to apply later, we say so.
| Data | Retained |
|---|---|
| Account — email, password, name | For as long as the account exists |
| Your congregation — name, country, city, "Setup and training", "Who recommended" | For as long as the congregation's record exists; the "Setup and training" choice can be changed only by us after it is made (see 3.2) |
| Details of the congregation and its contact people | For as long as the congregation's record exists; your congregation can change or clear any of them at any time |
| Mark of a team member's link (3.2) | In your browser: until your congregation is registered; not used after 30 days. With your account: until your congregation is registered |
| Support requests and their conversations | Two years after the request is closed. Automatic deletion of closed requests will be switched on before the first of them reaches that age (autumn 2028); until then they are kept. A contact detail that appears inside a conversation stays with that conversation |
| Purchases, subscriptions, refunds and disputes; payouts to team members and their documents | Seven years from the filing of our first annual tax report, as Israeli tax law requires; until that date is set they are not deleted. These records are not deleted on request |
| Licence keys and activation records | For as long as the key exists, so that the installation limit can be enforced |
| Administrator key-action log | Two years |
| Records of team members' acceptance of the terms of work | Without a time limit, including after the team member leaves (section 5) |
| Download records | One year |
| The weekly signal from the Software (4.4) | 12 months, or until you switch the signal off, whichever comes first. Weekly totals without the installation number — without a time limit |
| Wishes (3.12) | Two years |
| Visitor statistics | Held by Cloudflare: full data 7 days, a sample afterwards; the dashboard shows six months |
| Newsletter address | Until you unsubscribe |
| Any licence application submitted before 19 August 2026 | One year |
| Technical records of the website — for example, emails that failed to send | Six months. The record that an account was deleted, and the summaries of nightly checks, are kept |
| Sign-in session | 30 days, then it expires |
| Email confirmation link; link to confirm a new sign-in address | 24 hours, then they expire |
| Password reset link | One hour, then it expires |
Deleting on request. Write to hello@displayword.com and we will act within 30 days. What deletion does:
- Deleting your account removes your sign-in: the email address, password and name, your sessions, confirmation links and any licence applications you submitted. Your congregation's record, its purchases and subscriptions, its support requests and its licence keys are attached to the congregation, not to your account, so they remain, and the keys keep working. On request, we can give another person from your congregation access to them.
- Deleting your congregation's contact details — address, ministers, contact people, description — is done on request as well, and usually the same day.
- What we cannot delete is the record of money: purchases, refunds, payouts and the documents behind them, for as long as the law requires us to keep them.
8. Who else sees your data
We use a small number of service providers. They process data on our instructions.
| Provider | What they handle | Where |
|---|---|---|
| Cloudflare | Website hosting, database, file storage, DNS; the visitor counter (3.10); the "not a robot" check (3.1); receiving the weekly signal from the Software (4.4) | Global network |
| Google Workspace | Our mailbox: what you write to hello@displayword.com is received and kept there | Google's data centres, under Google's data processing terms |
| Brevo | Sending transactional email and the newsletter, including the email that brings us a wish (3.12) | European Union |
| Paddle.com Market Limited | Purchases and subscriptions, as merchant of record: your billing details, card and receipts reach Paddle directly (section 3.5) | United Kingdom and the Paddle group's affiliates |
| Payoneer | Paying our team members only: their name, Payoneer email address and the amount (section 5). Nothing about congregations or buyers goes there | Global |
| Bank of Israel | We fetch currency exchange rates from it. Nothing about you is sent | Israel |
Our source code is hosted on GitHub, and the Software fetches its catalogue of Bible translations from there (4.5); neither contains personal data, but GitHub sees the address of a connection that fetches the catalogue.
The members of our team who help congregations see the support requests and congregation details described in 3.3 and 3.6. They work under our terms of work, which bind them to use what they see only to help.
We do not sell personal data, do not share it for advertising, and do not transfer it to anyone else except where required by law.
Where your data is processed
Our database runs on Cloudflare's global network and is not restricted to a particular jurisdiction: no regional limitation was set when it was created, and replication is disabled. Your data may therefore be processed outside the European Economic Area.
Where that happens, the transfer is covered by the standard contractual clauses in Cloudflare's data processing agreement, which we have accepted as their customer. We will not tell you that your data stays in the EU, because it may not.
Brevo, which sends our email, processes data in the European Union. Paddle processes your purchase under its own privacy policy.
9. Emails we send
| Contains | |
|---|---|
| Email confirmation | A one-time link, valid 24 hours |
| Password reset | A one-time link, sent only when you ask for it |
| Licence key ready | Sent automatically after purchase: that your key is waiting in your congregation's account, and a download link. The key itself is not in the email |
| Subscription renews soon | Three days before a monthly charge and seven days before a yearly one: the amount, the date, and links to cancel or manage the subscription |
| Change of sign-in address | A confirmation link to the new address and a notice to the old one — whether you change it yourself or ask us to |
| Confirmation resent | The same one-time link as at registration, when you ask for it again |
| Support requests | To our team members: the request, the name of the person who wrote it and your congregation's contact details. To you: that help has been given, that the request was closed, or that a message is waiting — without the text of the messages themselves |
| Newsletter | Marketing content; unsubscribe link in every message |
Receipts for your purchases, and any emails about your payment itself, come from Paddle.
Your licence key is never sent by email. It is shown in your congregation's account, masked, with a button to copy it.
10. Your rights
If you are in the EU, EEA or UK, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable form, and withdraw consent where consent is the basis. Similar rights exist under other privacy laws, and we apply them to everyone regardless of where you live — it is simpler and fairer than sorting people by jurisdiction.
How to exercise them: write to hello@displayword.com. We will respond within 30 days.
Being straightforward about the mechanics: you can edit or clear your congregation's details yourself (except the "Setup and training" choice, which only we can change once it is made), but there is no self-service button that deletes the account itself. Requests are handled manually by a person, and section 7 describes exactly what is deleted and what has to remain. This is a small operation; a request by email reaches the same person either way.
If you are named as a contact person for a congregation and you would like your name and telephone number removed, write to us and we will remove them from that congregation's record — within 30 days, and usually the same day. We will not, however, edit them out of support conversations that have already taken place: those are a record of what was said.
You also have the right to complain to a supervisory authority in your country.
11. Cookies and local storage
One cookie:
| Name | Purpose | Properties | Duration |
|---|---|---|---|
dw_session | Keeps you signed in | HttpOnly, Secure, SameSite=Strict | 30 days |
It is set only after you sign in. It is strictly necessary for the account to work. The visitor counter described in 3.10 sets no cookie and writes nothing to your browser.
We also store in your browser's local storage your chosen interface language and, if you came through a team member's link, the mark described in 3.2. They are not readable by other websites; the mark is passed to us only if you create an account within 30 days.
There are no advertising cookies, no analytics cookies and no third-party cookies set by us. We do not display a cookie consent banner because we do not set anything that requires consent.
One boundary to be clear about: when a signed-in buyer opens the payment window on the pricing page, Paddle's own script is loaded for that window. Anything Paddle stores in your browser at that point is Paddle's, under Paddle's policy. On every other page, and for every visitor who is not buying, nothing of Paddle's is loaded.
12. Children
DisplayWord is intended for use by congregations and organisations, and accounts are meant to be held by adults. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.
13. Security
Passwords are stored hashed. Traffic to the website is encrypted. Access to the administrative interface is restricted. Accounts are locked temporarily after repeated failed sign-in attempts. Every action on a licence key is logged.
We will not claim more than that. This is a small operation without a dedicated security team, and you should weigh that when deciding what to entrust to any service, including this one.
If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, notify you directly.
14. Changes to this policy
We may update this policy. The current version, with its effective date, is always at displayword.com. Where a change materially affects you, we will give notice by email at least 30 days beforehand.
15. Contact
hello@displayword.com