Privacy Policy

1. Who we are

Versiah (the website at versiah.com, the iOS and Android apps, and related services) is provided by United Castles Ltd, a company registered in England and Wales under company number 16364716, with its registered office at 75 Prince George Drive, Derby DE22 3XA, United Kingdom. In this policy, “Versiah”, “we”, “us” and “our” mean United Castles Ltd.

We are the controller of the personal data described here, which means we decide why and how it is used. You can reach us about anything in this policy at [email protected]. Where the law of your country requires us to name a local representative or data protection officer, you will find the details in section 17.

This policy covers people who use Versiah, people who receive a gift or sponsorship through it, ministers and ministries who publish on it (“Ministry Partners”), and visitors to our website. It does not cover other websites or services we link to, which have their own policies.

2. The short version

• We never sell or rent your personal data, and we do not show advertising.
• We never use your chats, notes, onboarding answers or a minister’s uploads to train or fine-tune AI models, and we use AI providers under terms that do not allow them to either.
• Every demographic question is optional, and “prefer not to say” is always available. Your answers only shape which examples you see.
• Ministers can see how many conversations a reader has had with their Guide, never what was said.
• You can see, correct, download and delete your data, and withdraw consent at any time, by writing to [email protected]. You can delete your account inside the app or at versiah.com/account/delete.

3. What we collect

Information you give us

• Account details: your email address and, depending on how you sign in, your name and profile picture from Apple or Google. We do not see or store your Apple or Google password.
• Profile: your name, display name, nickname, profile photo, short bio, language, Bible translation, time zone and appearance settings.
• Optional personal details: birthday or age range, gender, relationship status, whether you are a parent or caregiver, how familiar you are with the Bible, your goals, the topics you are interested in, and when you like to pray or read. Every one of these can be skipped.
• Your conversations: the questions you ask Versiah (typed or spoken), the answers it gives, conversation titles and short summaries that help it follow a long conversation.
• What you save: saved passages, highlights and the notes you write on them, and your reading position.
• Fellowship rooms: the rooms you join, messages you send in room chat, your voice while you are speaking in a live audio room, and reports you make about other people or content.
• Purchases and gifts: what you buy, the price and currency, your email for receipts, and, for gifts and sponsorships, the recipient’s name, email address and any message you write.
• Messages to us: anything you send to support.

Information collected automatically

• Device and usage: app version, device type and operating system, language, the pages and screens you open, the features you use, and diagnostic and error information.
• Approximate location: the country your connection comes from, worked out from your IP address. We use it to show prices in your currency and choose the right payment provider. We do not collect precise or GPS location.
• Logs: our servers record IP addresses and request details to keep the service secure and working.
• Push notification tokens if you allow notifications.
• Cookies and similar technologies on our website, described in section 12.

Information from others

• Sign-in providers (Apple, Google) confirm your email address and may share your name.
• Payment providers and app stores tell us whether a payment succeeded, failed or was refunded. They never give us your full card number.
• Someone who buys you a gift gives us your name and email address (see section 15).
• Identity verification results for Ministry Partners (see section 16).

You do not have to give us any of the optional information. Without an email address we cannot create an account, and without payment we cannot provide paid features; nothing else is required.

4. Your faith and other sensitive information

Using a Bible app, and what you ask it, can reveal your religious beliefs. What you share in a conversation, or topics you choose such as grief, healing or mental health, can also reveal things about your health, relationships or family. Many laws, including the GDPR, the UK GDPR, Nigeria’s Data Protection Act and several US state laws, treat this as special or sensitive data, and so do we.

We process this information only with your explicit consent, which you give when you create your account and choose to use Versiah, and separately when you answer each optional question. We use it only to provide the features you ask for. We never use it for advertising, never sell it, never use it to make decisions about you that have legal or similarly significant effects, and never share it with a minister in identifiable form.

You can withdraw consent at any time by clearing your optional answers in your profile, deleting conversations, or deleting your account. Withdrawing consent does not affect what happened before. Because Versiah cannot work as a Bible companion without processing what you ask it, withdrawing consent for your conversations means you would no longer be able to use the chat features.

Please do not share information you do not need to, such as the full names of other people or details of a medical condition. Versiah does not need them to help you.

5. How we use it, and our legal bases

Some laws, including the GDPR and UK GDPR, require us to tell you the legal basis for each use. Where we rely on legitimate interests, we have balanced them against your rights, and you can object (see section 11).

We do not send marketing emails unless you ask for them, and every marketing email will let you unsubscribe in one step.

6. How the AI works with your data

Versiah uses artificial intelligence. When you ask a question you are talking to an AI system, not a person, a pastor or a minister.

• Scripture lookups never reach an AI model. If you ask for a passage by reference, we answer directly from our own database.
• Other questions are sent, with the relevant recent turns of the conversation, a short summary of earlier ones, passages we retrieved, and (if you gave them) your nickname and optional details such as your age range, to an AI model provider through our AI infrastructure provider. The kinds of providers we use are described in section 8.
• Voice: if you use read-aloud, the text is sent to a text-to-speech provider. If you dictate a question, the recording is sent for transcription and is not kept by us after it has been transcribed. On some phones, dictation uses Apple’s or Google’s speech recognition, which is covered by their privacy policies.
• Search: to find relevant passages and teaching, your question is converted into a numerical representation (an “embedding”) by an embedding provider.
• Shared answers: to save cost, if someone with the same language, translation and preferences asks exactly the same first question within seven days, they may receive the same answer. Only the question and answer are stored for this, never who asked, and only for questions our safety checks do not flag.
• No training. We do not use your content to train or fine-tune any model, and our AI providers process it only to return a response to us.
• No automated decisions about you. The AI personalises answers; it does not make decisions that have legal or similarly significant effects on you. An automatic safety check may add crisis resources to an answer; it never locks you out.

AI can be wrong. Every Scripture quotation comes from our database with a citation you can open, and anything the AI says that is not Scripture is labelled as reflection. Our Terms say more.

7. What other people can see

• Your conversations, notes and optional answers are private. No other user, and no minister, can read them.
• Your Versiah card at a public link shows your display name, profile photo, bio, rank, activity counts and when you joined. Anyone with the link can see it.
• Leaderboards show your display name, profile photo, points, rank and country to other users.
• Fellowship rooms: people in a room see your display name, profile photo and what you say or write there.
• Ministers whose Guide you use can see your first name and last initial, profile photo, how many conversations you have had with their Guide and when you were last active, and, if you bought their Guide, your name and purchase date. They never see what you asked or what was answered.
• People you invite or gift see your name as the sender, and the person who invited you may see your first name and last initial.

You can use a display name that is not your real name, remove your photo and bio at any time, and ask us to hide you from leaderboards by writing to [email protected].

8. Who we share it with

We share personal data only with the service providers below, who act on our instructions under contracts that require them to protect it and use it for nothing else, and in the limited cases listed after the table.

Apple and Google also process your data when you download the app, buy a subscription through their stores, or use their sign-in. They act as independent controllers under their own privacy policies.

We may also share personal data:

• With the people you choose, such as a gift recipient or the members of a room, as described in section 7.
• To follow the law: when we believe in good faith that disclosure is required by law or a valid legal process, and we will push back on requests that are overbroad and tell you where the law allows.
• To protect people: to prevent a serious threat to someone’s life or safety, or to protect the rights and safety of our users, the public or Versiah.
• With professional advisers such as lawyers, auditors and insurers, under confidentiality.
• In a business transfer: if United Castles Ltd or Versiah is merged, acquired or sold, your data may transfer to the new owner, who will be bound by this policy. We will tell you before that happens and before your data becomes subject to a different policy.

We name the providers you deal with directly, such as payment and verification providers, and describe the others by category. If you ask, we will tell you the specific companies that receive your data. We may update our providers; where the law requires, we will tell you about a new one before it starts processing your data.

9. International transfers

We are based in the United Kingdom, and several of our providers are in the United States, Nigeria and other countries. Those countries may not have data protection laws equivalent to yours. When we transfer personal data out of the UK, the European Economic Area, Switzerland, Nigeria, or another country that restricts transfers, we use a lawful transfer mechanism, such as:

• an adequacy decision or regulation for the destination country;
• the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the Swiss equivalents;
• the EU-US, UK-US or Swiss-US Data Privacy Framework, where the provider is certified;
• for data from Nigeria, the safeguards required by the Nigeria Data Protection Act 2023 and the NDPC’s directives;
• otherwise, the specific grounds your law allows, such as your explicit consent after being told of the risks.

You can ask us for a copy of the safeguards that apply to your data.

10. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for.

• Account and profile: while your account is open. When you delete your account, we remove your name, email address, photo, bio, sign-in link, optional personal details and devices straight away.
• Conversations, notes and saved passages: until you delete them or your account. Deleted items are hidden immediately and permanently erased within 30 days, and removed from backups within a further 30 days.
• Shared answer cache: seven days, with no link to who asked.
• Purchases, receipts and payment records: seven years after the transaction, because tax and accounting law requires it. After your account is deleted, these records are kept without your name or profile.
• Gift details (recipient name, email, message): until the gift is claimed or expires, then as part of the purchase record above.
• Ministry Partner verification and payout records: for as long as the law requires after the partnership ends, usually five to seven years for anti-money-laundering and tax rules.
• Fellowship room chat: while the room exists, or until the message is deleted. Reports and moderation records: up to two years, or longer if needed for a legal claim.
• Server logs: up to 30 days. Analytics: up to 24 months, and deleted or de-identified when you delete your account.
• Support messages: up to three years after the conversation ends.

We may keep information longer where the law requires it, or where we need it to establish, exercise or defend a legal claim, and only for that purpose.

11. Your rights and choices

Depending on where you live, you have some or all of the following rights. We give every user the core rights below, wherever you are.

• Access: find out what we hold about you and get a copy.
• Correction: fix anything inaccurate or incomplete. Most of it you can edit yourself in your profile.
• Deletion: delete conversations in the app, delete your account in the app’s settings or on the web at versiah.com/account/delete (no app needed), or ask us to erase your data.
• Portability: receive the data you gave us in a common, machine-readable format, or have it sent to another service.
• Objection and restriction: object to processing based on legitimate interests, or ask us to limit how we use your data while a concern is resolved.
• Withdraw consent at any time, without affecting earlier processing.
• Not be subject to automated decisions with legal or similarly significant effects. We do not make such decisions about users.
• Complain to us, and to your data protection authority (see section 17).

To use any right, write to [email protected] from the email address on your account, or have someone you authorise write for you. We may need to confirm your identity, but we will ask only for what we need. We reply within one month (45 days where US state law applies), and tell you if we need longer, as the law allows. We do not charge for this, and we will never treat you differently for using your rights.

If you are not happy with how we handled a request or complaint, tell us: we acknowledge complaints within 30 days and explain what we have done. You can also go straight to your data protection authority.

12. Cookies and similar technologies

Our website uses a small number of cookies and similar storage. We do not use advertising or cross-site tracking cookies, and we do not allow third parties to track you across other websites.

Where the law requires consent for analytics (for example in the EEA and Switzerland), we ask before setting analytics cookies, and you can change your mind at any time. In the UK and elsewhere you can opt out at any time. You can also block or delete cookies in your browser settings; the site will still work, but you may be signed out.

Do Not Track and Global Privacy Control: we do not sell or share personal data for cross-context advertising, so there is nothing for these signals to opt you out of. We treat a Global Privacy Control signal as a valid opt-out request where the law requires it.

The mobile apps do not use advertising identifiers and do not track you across other companies’ apps or websites. They use our analytics provider to record which screens are opened, linked to your account.

13. Children and teenagers

Versiah is not for children under 13, and we do not knowingly collect personal data from anyone under 13. If you are under 18, or under the age at which you can consent to data processing where you live (for example 16 in some EU countries, and 18 in Nigeria and India), you may use Versiah only with the permission and involvement of a parent or guardian. People under 18 cannot make purchases or become Ministry Partners.

If you tell us you are under 18, Versiah adapts its answers for a younger reader. If we learn that we have collected data from a child under 13, or from a young person without the permission their law requires, we will delete it. Parents or guardians who believe this has happened can contact [email protected].

14. How we protect it

We use encryption in transit (HTTPS/TLS) and at rest through our providers, sign-in without passwords stored by us, access controls that limit who at Versiah can see data, and logging of staff access. Staff can open a user’s conversation history only to handle a report, a safety issue, a support request or a legal obligation, must record a reason each time, and every access is logged.

No system is perfectly secure. If a breach puts your data at risk, we will tell the relevant authorities (within 72 hours where the law requires) and tell you without undue delay when the law requires or when it would help you protect yourself.

15. If someone gave you a gift

If someone bought Versiah for you, sponsored you, or shared a gift link, we received your name, email address and their message from them. We use these only to deliver the gift and let you claim it, and we keep them as described in section 10. We never add you to marketing lists because of a gift. If you do not want the gift, ignore it or write to [email protected] and we will delete your details from it.

16. Ministry Partners

If you apply to publish on Versiah, we collect your name, ministry name, biography, website, logo and the material you upload (documents, transcripts and links to your public videos). Your public profile and Guide are visible to everyone. Your uploaded source files are stored privately and used only to build and power your Guide; the AI may quote short passages from them in answers, with a citation to you.

Before you can withdraw earnings, you verify your identity with our provider Dojah. You give your ID document, a selfie and, in Nigeria, your BVN or NIN directly to Dojah, which may use facial recognition to match your selfie to your document. This is biometric data: it is processed only with your explicit consent, for fraud prevention and legal compliance, and Dojah keeps it under its own obligations. We receive and store only the result, your name, ID type and country. We also verify your bank account name and store only the bank name and last four digits of the account number.

17. Information for your region

United Kingdom

United Castles Ltd is the controller and is based in the UK. You can complain to the Information Commissioner’s Office at ico.org.uk.

European Economic Area and Switzerland

You have the rights in section 11 under the GDPR and the Swiss Federal Act on Data Protection. We are appointing a representative in the EU under Article 27 GDPR and a legal representative under the Digital Services Act; until their details appear here, contact us directly at [email protected] and we will reply in English, French or Spanish. You can complain to the data protection authority where you live or work (list of authorities), or in Switzerland to the FDPIC.

Nigeria

We process data of people in Nigeria in line with the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive. Religious beliefs and health data are sensitive personal data and are processed only with your explicit consent. You have rights to be informed, to access, correct and erase your data, to restrict processing, to data portability, to object, to withdraw consent and not to be subject to decisions based solely on automated processing. You can complain to us and to the Nigeria Data Protection Commission at ndpc.gov.ng.

Kenya, South Africa, Ghana and other African countries

You have the rights given by your local law, including the Kenya Data Protection Act 2019, South Africa’s Protection of Personal Information Act and Ghana’s Data Protection Act 2012. Sensitive data such as religious belief is processed only with your consent. You can complain to the Office of the Data Protection Commissioner (Kenya), the Information Regulator (South Africa) or the Data Protection Commission (Ghana).

United States

In the last 12 months we have collected these categories of personal information, for the purposes and from the sources described above: identifiers (name, email, account ID, IP address); customer records (purchases, gift details); characteristics of protected classifications (age range, gender, marital status, religion); commercial information (purchase history); internet or network activity (usage, device and log data); audio (voice while dictating or in live rooms); approximate geolocation (country); inferences (reading and topic preferences); and sensitive personal information (religious beliefs, and for Ministry Partners, identity documents and biometric data processed by Dojah). We disclose these only to the service providers in section 8 for business purposes.

We do not sell or share (for cross-context behavioural advertising) personal information, including that of anyone under 16, and have not done so in the last 12 months. We use sensitive personal information only to provide the services you request and for other purposes the law permits, so we do not offer a separate “limit” option. Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with privacy laws may have rights to know, access, correct, delete and port their data, to opt out of sale, sharing, targeted advertising and profiling, and to appeal our decision on a request by replying to it. If we deny your appeal, you can contact your state attorney general. California residents may also ask, under the “Shine the Light” law, about disclosures for direct marketing; we make none.

We do not process consumer health data for any purpose other than providing the feature you are using, and never sell it. Washington and Nevada residents can use the rights in section 11 for any such data.

Canada and Quebec

Your data may be processed outside Canada, including in the US and UK, where it may be accessed by courts and authorities under local law. The person responsible for protecting personal information at Versiah can be reached at [email protected]. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Brazil

You have the rights in Article 18 of the LGPD, including confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and withdrawal of consent. Our data protection contact (encarregado) can be reached at [email protected]. You can complain to the ANPD.

Australia

We handle personal information in line with the Australian Privacy Principles. Your data may be disclosed to recipients in the US, UK, EU, Nigeria and the other countries listed in section 8. You can complain to us and then to the Office of the Australian Information Commissioner.

India

You can access, correct and erase your data, withdraw consent, nominate someone to exercise your rights, and raise a grievance with us at [email protected]. If we do not resolve it, you can complain to the Data Protection Board of India.

18. Changes to this policy

We may update this policy as Versiah or the law changes. The date at the top shows when it last changed. If a change is significant, for example a new use of your data or a new kind of provider, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires.

19. Contact us

United Castles Ltd, 75 Prince George Drive, Derby DE22 3XA, United Kingdom. Email [email protected]. We read every message and reply in English, French or Spanish.