Privacy policy

Last updated 30 October 2026

Who we are

Sermon Live is run by HFL SRL, [registered address], Romania, [registration number, CUI]. For anything about your data, write to [contact email].

What Sermon Live does

It translates a church's sermon live. The sound of the sermon goes from a computer at the sound desk to the church's translation engine, which turns it into text, translates it, and sends the translation as text and speech to the phones of people listening.

Two kinds of data, two roles

• The church's account: we decide how this is used, so we are its controller.
• The sermon (its sound and text): the church decides to translate its service, so the church is the controller and we process it on the church's behalf, as set out in our terms. People who spoke in or attended a service can also ask the church about it.

What we keep, and for how long

• Account: the email of each person with access, the church's name, how they sign in (a password, which Google stores scrambled and we never see, or a Google account) and when the terms were accepted. Kept while the account exists, deleted within 30 days after it is closed.
• Sign-in on the operator page: a cookie that keeps you signed in for up to 30 days. We store only a scrambled fingerprint of it.
• Sermon sound: sent only while translating or during a sound check, and not recorded, except short clips of the lines marked for checking (for example a word that may have been misheard). Those clips are deleted 30 days after the service.
• Sermon text: what was said and its translation, kept 30 days after the service so the church can check it, then deleted. Our technical logs also contain parts of it; they are deleted after 30 days too.
• A summary of each service: date, start and end time, minutes translated and number of lines. No words of the sermon. Kept while the account exists, for usage and billing.
• The church's glossary and settings: kept while the account exists.
• Listeners need no account and give no name. The listener page remembers their language choice on their own phone, and a random cookie (for 24 hours) counts each phone once per service. Our servers' logs record the address and browser of each connection, for security; they are deleted after 30 days.

Sermons and prayers may mention people or show what someone believes, which the law protects in particular. That is why we keep as little as we can, for as short a time as we can.

What we do not do

We do not sell data, show ads, track anyone across websites, or use sermons to train AI models.

Who processes data for us

• Google (Google Cloud and Firebase): the translation engine, speech recognition, the database and file storage, all in the European Union (Frankfurt); sign-in and this website, which Google may serve from outside the EU.
• xAI (United States): translates the text into English.
• OpenAI (United States): translates the text into Czech, only when a listener chooses Czech.

When data goes outside the European Union, it is protected as the GDPR requires, by the European Commission's standard contractual clauses or its adequacy decision for companies certified under the EU-U.S. Data Privacy Framework.

Why we may use it

• Account data: to provide the service the church signed up for (a contract).
• Security logs: our legitimate interest in keeping the service safe.
• Sermon sound and text: only on the church's instructions, to translate its service.

Your rights

You can ask to see, correct, delete or take a copy of your data, to limit how we use it, or object to it. Write to [contact email]. About a sermon, you can also ask the church. If you think we got it wrong, you can complain to Romania's data protection authority, ANSPDCP (dataprotection.ro), or the one where you live.

Security

Every connection is encrypted. Only the people a church gives access can open its pages, and only our own services can read its data.

Changes

If we change this policy in a way that matters, we tell each church's admin by email before it applies.