Privacy shaped for sensitive ministry context.

This Privacy Policy applies to the Kartios website, walkthrough process, accounts, and ministry coordination service (collectively, the “Service”). Kartios is operated by Jacob Tozier, a Virginia sole proprietor doing business as Kartios (“Kartios,” “we,” “us,” or “our”).

This policy does not govern a church’s or ministry’s practices outside Kartios, including information it collects or shares through other systems.

Kartios operates its public site and determines how public inquiries, support communications, technical operations, and website analytics are handled. When a church or ministry uses the Service, the organization generally decides whose ministry records are entered, why they are used, which roles and relationships are assigned, and who may see them. Kartios processes that information to provide the Service.

The organization is responsible for having appropriate authority and permissions, assigning access carefully, and responding first to requests from the people it serves. Kartios assists organizations and responds to escalated requests as described below.

Depending on how the Service is used, we may process:

• Identity and account information: name, email address, optional phone number, birthday month and day, avatar, authentication identity, invitations, account state, organization membership, and assigned roles.
• Ministry information: small groups, mentor-led discipleship relationships, meetings, attendance, curriculum, assignments, participation, prayer, care, notes, resources, uploaded documents, responsibilities, outcomes, and retained follow-through history.
• Public inquiries and communications: name, email, organization, role, approximate size, walkthrough interests, and messages sent to Kartios.
• Technical information: authentication and workspace-selection cookies, request and operational logs, IP-derived request information, browser and device characteristics, page or route information, referrer, approximate location, performance information, and aggregated analytics.

We receive information directly from individuals, from organizations and their authorized leaders, through use of the Service, from browsers and devices, and from service providers that help operate Kartios. A person can have a managed ministry profile without creating or controlling a Kartios login.

We use information to provide, secure, maintain, and improve the Service; authenticate accounts; enforce workspace and role boundaries; support ministry workflows; respond to inquiries and support requests; deliver account communications; prevent abuse; diagnose failures; meet contractual obligations; protect rights and safety; and comply with law.

We do not use recorded participation or curriculum completion to determine a person’s spiritual maturity.

Prayer, care, discipleship, meeting, and follow-through information can reveal religious beliefs, health circumstances, family matters, relationships, or other deeply personal concerns. Visibility within Kartios follows selected audiences, active workspace membership, assigned roles, and entrusted group or discipleship relationships.

Organizations and authorized users should enter only information appropriate for the ministry purpose and should not treat Kartios as an emergency, medical, mental-health, safeguarding, or abuse-reporting service.

• Kartios does not sell personal information.
• Kartios does not share personal information for cross-context behavioral advertising.
• Kartios does not display advertising.
• Kartios does not use ministry content to train Kartios or third-party artificial intelligence models.
• Kartios does not currently create or use de-identified or aggregate product datasets. We may later use information that has been properly de-identified or aggregated solely to operate, understand, and improve Kartios, without attempting to re-identify it.

We may disclose information to authorized people within the relevant organization; to the infrastructure and delivery providers listed on our Subprocessors page; at the direction of the organization or individual; and when reasonably necessary for support, security, abuse prevention, legal process, protection of rights or safety, or a potential business reorganization or succession.

A successor would remain subject to this policy for information collected under it unless people receive notice of a materially different practice as required by law.

Separately authorized Kartios personnel may access customer information when reasonably necessary for support, security, abuse prevention, legal compliance, or reliable operation. Ordinary support views are designed to avoid unnecessarily exposing prayer titles, bodies, authors, and pastoral details.

When practical, Kartios will notify the organization before or after accessing content for a support purpose. This describes our operating practice; it does not claim that privileged infrastructure operators are technically incapable of accessing underlying systems.

Kartios uses essential cookies to authenticate accounts, maintain sessions, complete secure account flows, and remember the active workspace. Blocking these cookies may prevent the Service from functioning.

Vercel Web Analytics and Speed Insights provide privacy-oriented, aggregated traffic and performance information without third-party advertising cookies. Kartios does not use advertising cookies or build cross-site behavioral profiles. Do Not Track and Global Privacy Control signals do not change our practices because Kartios does not sell personal information or share it for cross-context behavioral advertising.

We retain information while an organization uses Kartios and as reasonably needed to provide the Service, maintain security and records, resolve disputes, enforce agreements, and comply with law. Inactivating one person removes current participation and pricing count but preserves authorized ministry history; it is different from terminating an entire workspace.

An organization may request a reasonable tenant-scoped export during service or within 30 days after termination. Unless continued retention is legally necessary, Kartios will complete deletion from active systems within 90 days after termination. These are currently manual, verified operator processes rather than self-service features.

Residual copies may remain until overwritten through service-provider backup cycles. Backup copies are isolated from ordinary use and will not be restored except for legitimate disaster recovery, legal, or security needs.

If information was entered or managed by a church or ministry, contact that organization first. It is usually best positioned to verify the relationship, understand the ministry context, and decide what should be corrected, exported, restricted, or deleted.

Kartios will assist the organization or receive an escalated request at jdtozier@gmail.com. We may verify identity, authority, and organizational context before acting. Rights vary by jurisdiction, and some information may be retained where permitted or required by law.

Kartios is sold to organizations, is marketed primarily for adult ministry, and is not directed to children under 13. A person must be at least 13 to hold a Kartios account. Users under 18 may use an account only when authorized by their organization and by a parent or guardian where required.

An organization may maintain a managed ministry profile for someone under 13 only when it has lawful authority to do so, but that person cannot receive a Kartios login. The organization is responsible for required notices, permissions, and parental consent. If Kartios learns that an account holder is under 13, we may disable the account and work with the organization on appropriate next steps.

Kartios uses workspace separation, server-enforced authorization, private hosted storage, and responsibility-aware visibility. No security measure can guarantee absolute protection. Review our Security & Privacy page for current safeguards and honest boundaries.

Kartios initially serves U.S.-based organizations. The Service and its providers process and store information in the United States, including current hosted infrastructure in the U.S. East region.

After public launch, Kartios will provide at least 30 days’ advance notice of material changes when reasonably practicable. Changes needed for urgent legal, security, or abuse-prevention reasons may take effect sooner, with notice as practical. The effective and last-updated dates above identify the current version.