Privacy Policy

Merakixel builds and runs Kids Pass for Winners Chapel International, WCI-Liverpool Children's Church. Right now Merakixel is the data controller, meaning we're the ones responsible for this data — that's expected to move over to the Church once they take ownership of the service, and we'll update this page when it does. Questions go to main@merakixel.com.

From you:

• Name, email, and password (hashed — we never see or store it as plain text).
• Phone number, address, and emergency contact — either from the Church registering your family, or from you directly.
• Your family code, so staff can find your family fast at check-in and pickup.

About each child:

• Name, date of birth, gender, and an avatar (or photo, if you add one).
• Medical conditions, allergies, medication, and safeguarding notes where relevant. This counts as special category data under UK GDPR, and we only ask for it because the Church needs it to look after your child properly.
• Their check-in and attendance history.

That's it for cookies too — one, and it just keeps you signed in. No analytics, no ads. Details are in the Cookie Policy.

• To run your account and let you register and check in your kids.
• So Church staff can identify your children safely and know about any medical or safeguarding needs during sessions.
• To keep the attendance records the Church needs for safeguarding purposes.

Legally, that's your consent (given at signup, or when the Church registers your family with your say-so) plus a legitimate interest in running children's ministry safely. Medical and safeguarding info needs its own explicit consent under GDPR, which you give when you submit it.

• Sensitive fields — date of birth, medical notes, address, phone — are encrypted in the database, not stored as plain text.
• Passwords are hashed, never logged or stored in the clear.
• Only Church staff and volunteers with an account can see family records, and only what their role needs.
• We log when staff view a child's medical or safeguarding notes.

• Church staff and volunteers, for running check-in and safeguarding — nothing else.
• Supabase (database hosting) and Vercel (app hosting), who process data for us under their own terms.

We don't sell your data or hand it to advertisers.

Parents and guardians use this app on behalf of their children — kids don't have their own accounts or log in. You're responsible for what you tell us about your child being accurate, and for having the right to consent on their behalf (worth a thought if more than one parent or guardian is involved).

Our database is in the EU, London specifically. Our hosting providers may process some data outside the UK/EEA as part of how they run their services — where that happens, it's covered by their own data transfer safeguards.

As long as your account's active or your child's part of the Church's children's ministry, plus whatever extra time the Church needs to keep for safeguarding records. Ask us to delete it any time — see below.

Under UK GDPR you can:

• See what we hold on you and your kids.
• Get anything wrong corrected.
• Ask us to delete it, minus whatever the Church has to keep on file for safeguarding.
• Restrict or object to some of how it's used.
• Get a copy in a portable format.
• Withdraw consent whenever you like.

Reach us at main@merakixel.com for any of that. You can also complain to the ICO at ico.org.uk.

We'll update the date up top when this changes, and tell you first if it's anything significant.

main@merakixel.com