# ZALA Terms of Use

**(End User Agreement)**

**Effective Date: July 8, 2026**

These Terms of Use (the "Terms") are an agreement between you and **GDiz LLC** ("ZALA," "we," "us," or "our"), the operator of the ZALA platform. The Terms govern your use of the ZALA service — including the shared ZALA mobile applications, co-branded and white-label mobile applications powered by ZALA, the websites at zala.net and related domains, giving and payment features, livestreams, feeds, groups, events, messaging, and any related software, content, and services (collectively, the "Service") — whether you access it as a guest or a registered user.

**By accessing or using the Service, or by tapping "accept" or "agree" when prompted, you agree to these Terms and to the ZALA Privacy Policy at zala.net/legal/privacy, which is incorporated by reference.** If you do not agree, do not use the Service.

If you are accepting on behalf of a church, ministry, or other organization that subscribes to ZALA, your organization's use is governed by the separate **ZALA Terms of Service** (zala.net/legal/terms-of-service); these Terms govern your individual use of the Service.

## 1. Your Relationship with ZALA and Your Organization

**1.1 How the Service works.** ZALA is a multi-tenant platform. Your access is typically provided through a church, ministry, or other organization that subscribes to ZALA (your "Organization"). Your Organization controls its community on the Service: who can join, what content is published, how posts are moderated, what groups exist, and how donations are used.

**1.2 Organization rules.** Your use may be subject to additional rules, community standards, or terms set by your Organization, which supplement these Terms. Your Organization — not ZALA — is responsible for its own content, conduct, communications, fundraising, and use of donated funds.

**1.3 Your data and your Organization.** Information you share within an Organization's community (profile details, posts, prayer requests, group membership, attendance, giving history) is accessible to that Organization and is handled by it as described in the ZALA Privacy Policy and the Organization's own privacy practices. ZALA processes that information on the Organization's behalf to provide the Service.

**1.4 Multiple organizations.** Accounts on ZALA are scoped to an Organization. If you join more than one Organization on ZALA (for example, using the same email address or phone number), you may have separate accounts and profiles in each, and content or settings in one do not carry over to another.

## 2. Eligibility

The Service is intended for users who can form a binding contract under applicable law. The Service is not directed to children under 13, and children under 13 may not create their own accounts. Users aged 13–17 may use the Service only with the involvement and consent of a parent or legal guardian, who is responsible for the minor's use. An Organization or a parent/guardian may create or administer profiles associated with a child (for example, for children's ministry check-in); in that case, the parent or guardian and the Organization are responsible for that profile as described in the Privacy Policy. By using the Service, you confirm you meet these requirements.

## 3. Accounts, Passwordless Sign-In, and Security

**3.1 Registration.** Some features require an account. You agree to provide accurate, current, and complete information and to keep it updated.

**3.2 Passwordless authentication.** ZALA uses passwordless sign-in: one-time passcodes sent to your email address or phone number, and/or passkeys. **Anyone with access to your email inbox, phone number, or device passkeys may be able to access your account.** You are responsible for securing your email account, phone number (including protecting against SIM-swap and number-recycling risks), and devices, and for all activity under your account. Notify us promptly at hello@zala.net of any suspected unauthorized access.

**3.3 Account actions.** We may suspend or deactivate accounts at our discretion, including for violations of these Terms, at your Organization's request, or to protect the Service and its users.

## 4. Your Content

**4.1 User Contributions.** The Service includes interactive features — feeds, comments, reactions, groups, prayer requests, event registrations, media uploads, and messaging (collectively, "Interactive Features") — through which you can create, post, submit, or transmit content ("User Contributions").

**4.2 License.** You retain ownership of your User Contributions. By posting them, you grant ZALA, its service providers, and your Organization a worldwide, non-exclusive, royalty-free license to host, store, reproduce, adapt (e.g., for formatting, thumbnails, captions, or translation), display, perform, and distribute your User Contributions as needed to operate and provide the Service, consistent with the visibility settings that apply to the content. This license ends when your User Contributions are deleted from the Service, except for content already shared with others, copies in routine backups (which expire on schedule), and retention required by law.

**4.3 Your responsibility.** You represent that you own or have the necessary rights to your User Contributions and that they comply with these Terms. You — not ZALA — are responsible for your User Contributions, including their legality, accuracy, and appropriateness.

**4.4 Visibility.** Content you post may be visible to some or all members of your Organization, and in some cases publicly, depending on the visibility settings of the post, group, or feature. **Prayer requests and similar content may be visible to Organization staff and, depending on the option you choose, to groups or the wider community.** Check the visibility setting before posting; do not post anything you are not comfortable sharing at that level.

**4.5 Moderation.** Your Organization's administrators and ZALA may review, approve, decline, remove, or restrict User Contributions at their discretion, and may pin, feature, or reorganize content within the Organization's community.

## 5. Content Standards

User Contributions must comply with all applicable laws and must not:

- Contain defamatory, obscene, indecent, abusive, harassing, violent, hateful, or otherwise objectionable material;
- Contain sexually explicit or pornographic material, or promote violence or discrimination;
- Exploit, endanger, sexualize, or harm minors in any way, or solicit personal information from minors;
- Infringe any copyright, trademark, trade secret, or other intellectual-property or proprietary right (including posting song lyrics, sheet music, recordings, books, or videos you do not have rights to share);
- Violate the privacy, publicity, or other legal rights of others, including posting another person's personal information without permission;
- Be deceptive, impersonate any person, or misrepresent your identity or affiliation with any person or organization;
- Constitute unsolicited advertising, promotions, chain letters, or spam, or unauthorized commercial activity;
- Promote illegal activity or contain malicious code.

## 6. Acceptable Use

You agree to use the Service only for lawful purposes. You must not: (a) interfere with or disrupt the Service, other users, or connected systems; (b) use bots, scrapers, or automated means to access the Service without written permission; (c) attempt to gain unauthorized access to any part of the Service, other accounts, or other Organizations' communities; (d) probe, scan, or test the vulnerability of the Service; (e) introduce viruses or other harmful material; (f) attack the Service via denial-of-service or similar means; or (g) copy, reverse engineer, or create derivative works of the Service except as permitted by law.

## 7. Giving, Donations, and Payments

**7.1 How giving works.** Giving features let you make one-time or recurring donations and payments to your Organization. Payments are processed by third-party payment processors (currently Stripe, Inc.). **Your Organization — not ZALA — is the recipient of your donation and the merchant of record.** ZALA does not hold your funds and does not control how your Organization uses them.

**7.2 Payment authorization.** When you make a payment, you authorize ZALA and its payment processor to charge your selected payment method and, if you save a payment method, to store your payment credentials with the processor for future transactions you initiate. Card details are collected and stored by the payment processor, not by ZALA.

**7.3 Recurring giving.** If you set up recurring giving, you authorize ZALA and its payment processor to automatically charge your selected payment method at the amount and frequency you selected, without further action by you, until you cancel. You can cancel recurring giving at any time through the Service's giving settings; to be safe, cancel at least **ten (10) business days** before the next scheduled charge to ensure it does not process.

**7.4 Fees.** Your Organization's plan determines platform and processing fees. If a "cover the fees" option is offered and you select it, an additional amount will be added to your payment so your Organization receives more of your intended gift; the amount is shown before you confirm.

**7.5 Refunds and disputes.** Refund requests for donations should be directed to your Organization, which is responsible for its own refund decisions and policies, subject to applicable law and card-network rules. Tax receipts and giving statements are issued by your Organization, and their accuracy (including deductibility) is your Organization's responsibility. ZALA does not provide tax advice.

**7.6 Fund use.** All funds given through the Service should be used as described by your Organization. We do not independently verify or guarantee how funds are used once disbursed. By donating, you acknowledge that you do so based on your own judgment and trust in your Organization. If you believe funds are being misused, you may report it to hello@zala.net; we may suspend or terminate giving features in cases of suspected misuse.

**7.7 Prohibited transactions; processor policies.** You may not use payment features for any activity prohibited by law or by our payment processors, and you agree to comply with Stripe's [Acceptable Use Policy](https://support.stripe.com/questions/acceptable-use-policy) and [Restricted Businesses list](https://stripe.com/legal/restricted-businesses).

**7.8 Anti-money laundering and sanctions.** You must not use the Service to launder money, finance terrorism, or transact with individuals, entities, or regions subject to sanctions administered by the U.S. Office of Foreign Assets Control (OFAC) or other applicable authorities. We and our processors may screen transactions, request verification information, block or reverse transactions, suspend or terminate access, and report suspicious activity to authorities, in each case without any obligation to notify you where the law restricts notice. You agree to cooperate with related investigations.

## 8. Livestreams, Media, and AI Features

**8.1 Media.** The Service may include livestreams, sermon videos, audio, and other media provided by your Organization or third parties. Availability and quality depend on your Organization's plan, your connection, and third-party services (including streams relayed to or embedded from platforms such as YouTube or Vimeo, which are subject to those platforms' terms).

**8.2 AI-assisted features.** Some features may use artificial intelligence, such as automated transcription, captions, translation of posts or sermons, content summaries, or highlight clips. AI-generated output can contain errors — captions, translations, and summaries may be inaccurate or incomplete, and synthesized voices you hear may be AI-generated rather than human recordings. Do not rely on AI output where accuracy matters without verifying against the original. Your Organization controls whether these features are enabled for its community.

## 9. Notifications and Communications

With your consent where required, the Service may send you push notifications, emails, and SMS (text) messages, such as new posts, event reminders, giving receipts, and journey messages configured by your Organization. You can manage push notifications in your device or app settings, unsubscribe from marketing emails via the link in the email, and opt out of SMS by replying STOP. Message and data rates may apply to SMS. Transactional messages (such as sign-in passcodes and payment receipts) are part of the Service.

## 10. Intellectual Property

The Service — including its software, design, text, graphics, logos, and arrangement — is owned by ZALA (GDiz LLC), its licensors, or the relevant Organization and content providers, and is protected by intellectual-property laws. Except as expressly permitted, you may not reproduce, distribute, modify, publicly display, republish, or create derivative works from the Service or its content, or use it for commercial purposes. The ZALA name and logos are trademarks of GDiz LLC; Organization names and logos belong to the respective Organizations. No rights are granted except as expressly stated.

**Copyright complaints.** If you believe content on the Service infringes your copyright, send a notice compliant with the Digital Millennium Copyright Act (DMCA) to our designated agent: GDiz LLC, Attn: DMCA Agent, 440 N Barranca Ave #4348, Covina, CA 91723, United States; email: hello@zala.net. We may remove allegedly infringing content and may terminate repeat infringers.

## 11. Monitoring, Enforcement, and Termination

We reserve the right to: remove or refuse any User Contribution; take any action we reasonably believe necessary regarding content that violates these Terms, infringes rights, threatens safety, or creates liability; disclose your identity or information to third parties or authorities where required by law or where we believe disclosure is necessary to protect rights or safety; refer matters to law enforcement; and suspend or terminate your access for any reason, including violation of these Terms or at your Organization's request. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and cooperate with law enforcement as required by law. We cannot review all material before it is posted and are not liable for user or third-party content.

## 12. Reliance on Information

Content on the Service is provided for general purposes only. ZALA does not warrant the accuracy, completeness, or usefulness of content provided by Organizations, users, or third parties, and is not responsible for it. Any reliance you place on such content is at your own risk. Nothing on the Service constitutes professional advice (legal, tax, financial, medical, or counseling); content of a pastoral or counseling nature is provided by your Organization, not ZALA.

## 13. Third-Party Links and Services

The Service may contain links to, or integrations with, third-party websites and services (for example, video platforms, calendars, or an Organization's own website and tools). These are provided for convenience only; ZALA does not control them and is not responsible for their content, policies, or practices. Your use of third-party services is at your own risk and subject to their terms.

## 14. Geographic Availability

The Service is operated from the United States and is currently intended primarily for users in the United States. If you access the Service from elsewhere, you do so at your own initiative and are responsible for compliance with local laws. Certain features (for example, giving, SMS, or calling features) may be unavailable or restricted in some jurisdictions.

## 15. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. ZALA DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE, OR THAT CONTENT IS ACCURATE OR RELIABLE. SOME JURISDICTIONS DO NOT ALLOW CERTAIN WARRANTY EXCLUSIONS, SO SOME OF THE ABOVE MAY NOT APPLY TO YOU.

## 16. Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY LAW, ZALA, ITS AFFILIATES, AND THEIR OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF DATA, GOODWILL, OR DONATIONS, ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE. TO THE FULLEST EXTENT PERMITTED BY LAW, ZALA'S TOTAL AGGREGATE LIABILITY TO YOU FOR ALL CLAIMS RELATING TO THE SERVICE WILL NOT EXCEED THE GREATER OF (A) ONE HUNDRED U.S. DOLLARS (US$100) OR (B) THE AMOUNTS YOU PAID TO ZALA (EXCLUDING DONATIONS PASSED TO YOUR ORGANIZATION) IN THE TWELVE (12) MONTHS BEFORE THE CLAIM AROSE. NOTHING IN THESE TERMS LIMITS LIABILITY THAT CANNOT BE LIMITED UNDER APPLICABLE LAW.

## 17. Indemnification

You agree to defend, indemnify, and hold harmless ZALA, its affiliates, and their officers, directors, employees, and agents from claims, liabilities, damages, and costs (including reasonable attorneys' fees) arising from your violation of these Terms, your User Contributions, or your use of the Service beyond what is authorized.

## 18. Governing Law; Disputes; Time Limit on Claims

These Terms are governed by the laws of the State of Delaware and the U.S. Federal Arbitration Act, without regard to conflict-of-laws principles.

**PLEASE READ THIS SECTION CAREFULLY — IT AFFECTS YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE A LAWSUIT IN COURT.**

**18.1 Informal resolution first.** Before filing a claim, you and ZALA agree to try to resolve the dispute informally: contact us at hello@zala.net with a description of the dispute, and both parties will attempt in good faith to resolve it within sixty (60) days. Most concerns can be resolved this way.

**18.2 Binding arbitration.** If the dispute is not resolved informally, you and ZALA agree that any dispute, claim, or controversy arising out of or relating to these Terms or the Service will be resolved by **binding individual arbitration** administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules then in effect, rather than in court. The AAA rules are available at www.adr.org. Payment of filing, administration, and arbitrator fees will be governed by the AAA rules. The arbitration will be conducted in English; hearings, if any, will take place in your county of residence or remotely by videoconference, as provided by the AAA rules. Judgment on the arbitration award may be entered in any court of competent jurisdiction. The arbitrator has exclusive authority to resolve disputes about the interpretation, applicability, or enforceability of this arbitration agreement.

**18.3 Exceptions.** Either party may (a) bring an individual claim in small-claims court if it qualifies, and (b) seek injunctive or other equitable relief in a court of competent jurisdiction to protect intellectual property. Nothing in this Section prevents you from reporting issues to government agencies or bringing claims that cannot be arbitrated as a matter of law.

**18.4 Class action waiver.** YOU AND ZALA AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate claims of more than one person. If this class action waiver is found unenforceable as to a particular claim, that claim (and only that claim) will proceed in the state or federal courts located in Wilmington, Delaware, and the remainder of this Section remains in effect.

**18.5 Opt-out.** You may opt out of this arbitration agreement by emailing hello@zala.net with the subject line "Arbitration Opt-Out," your name, and the email/phone associated with your account, within **thirty (30) days** of first accepting these Terms. Opting out does not affect any other provision of these Terms.

**18.6 Consumer rights.** If you use the Service as a consumer in a jurisdiction whose laws give you non-waivable rights (including the right to bring claims in your local courts), nothing in these Terms limits those rights. To the maximum extent permitted by law, any claim arising out of these Terms or the Service must be filed within **one (1) year** after the cause of action accrues, or it is permanently barred.

## 19. Changes to These Terms

We may update these Terms from time to time. When we do, we will post the revised Terms and update the "Effective Date"; for material changes, we will provide reasonable advance notice through the Service or by email where required by law. Continued use of the Service after changes take effect constitutes acceptance.

## 20. Waiver, Severability, and Entire Agreement

No waiver of any term is a continuing waiver. If any provision of these Terms is held invalid or unenforceable, it will be limited or eliminated to the minimum extent necessary, and the remaining provisions remain in effect. These Terms and the Privacy Policy are the entire agreement between you and ZALA regarding the Service and supersede prior agreements. Any additional terms between you and your Organization are between you and that Organization.

## 21. Contact

GDiz LLC — 440 N Barranca Ave #4348, Covina, CA 91723, United States
Email: hello@zala.net · Web: zala.net

# ZALA Privacy Policy

**Effective Date: July 8, 2026**

This Privacy Policy (the "Policy") explains how **GDiz LLC** ("ZALA," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the ZALA platform — including the websites at zala.net and related domains, the shared ZALA mobile applications, co-branded and white-label applications powered by ZALA, giving features, and related software and services (collectively, the "Service").

This Policy should be read together with the **ZALA Terms of Use** (for individual users) and the **ZALA Terms of Service** (for subscribing organizations), available at zala.net/legal. If you do not agree with this Policy, do not use the Service.

## 1. Our Two Roles: Service Provider and Controller

ZALA is a multi-tenant platform used by churches, ministries, and other organizations ("Organizations") to engage their communities. Because of this, we handle personal information in two distinct roles:

**1.1 ZALA as a service provider / processor (Member Data).** When you use the Service as a member, visitor, donor, volunteer, or attendee of an Organization, the personal information collected within that Organization's community — such as your contact record, profile, posts, prayer requests, group memberships, event registrations, attendance, messages, and giving history ("Member Data") — is **controlled by your Organization**. ZALA processes Member Data on the Organization's behalf and under its instructions, solely to provide the Service. Your Organization decides who in its community can see what, how it communicates with you, and how it uses your information; its own privacy practices also apply. **If you want to access, correct, or delete Member Data, or have questions about how your Organization uses it, contact your Organization first.** We will support Organizations in responding to such requests and will refer requests we receive directly to the relevant Organization where appropriate.

**1.2 ZALA as a controller (our own data).** ZALA is the controller of personal information we collect for our own purposes, including: account and billing information for Organization administrators; information about visitors to zala.net; support communications; marketing data; and technical, security, and product-usage data we use to operate, secure, and improve the Service.

## 2. Information We Collect

**2.1 Information you provide directly.**

- **Account and profile information:** name, email address, phone number, profile photo, and organization affiliation. ZALA uses passwordless sign-in, so we do not collect or store passwords; we process one-time passcodes and/or passkey credentials to authenticate you.
- **Content you create:** posts, comments, reactions, prayer requests, testimonies, messages, media uploads, event registrations and responses, and group activity.
- **Giving and transaction details:** donation amounts, designations (funds/campaigns), dates, and receipts. **Payment card and bank details are collected and processed directly by our payment processor (currently Stripe, Inc.) — ZALA does not store full card numbers or bank credentials.**
- **Organization administrator information:** business contact details, billing information, tax-exemption documentation, and payment-onboarding information collected by our payment processor (which may include identity-verification and beneficial-ownership information required by law).
- **Support and communications:** information you provide when you contact support, complete forms, or respond to surveys.

**2.2 Information collected automatically.** When you use the Service, we and our service providers automatically collect technical and usage information: IP address, device identifiers, device type and operating system, app version, browser type, language, referring/exit pages, dates and times of access, crash logs, and interactions with features. We use cookies, SDKs (software development kits), and similar technologies for authentication, preferences, security, performance measurement, and product analytics (see Section 7).

**2.3 Information from Organizations and other sources.** Organizations may add or import information about you into the Service (for example, contact records from a previous system, attendance, or group assignments) — this is Member Data controlled by the Organization (Section 1.1). We may also receive information from authentication providers, payment processors (transaction confirmations and fraud signals), app stores, and security and analytics vendors.

**2.4 Location information.** We may derive general (city-level) location from your IP address for security, regional settings, and analytics. Precise device location is collected only if you affirmatively enable it for a specific feature, and you can disable it in your device settings at any time.

**2.5 Sensitive information, including religious information.** By its nature, use of the Service may reveal or include information about religious affiliation or beliefs — for example, membership in a church community, prayer requests, small-group participation, baptism interest, or pastoral-care notes. We treat this as sensitive personal information: we process it only to provide the Service requested by you and your Organization, to secure the Service, and to comply with law. **We do not use sensitive information for advertising, do not sell it, and do not disclose it except as described in this Policy.** Visibility of content like prayer requests is determined by the settings you and your Organization choose — review visibility options before posting.

## 3. How We Use Information

We use personal information to:

- Provide, operate, administer, and maintain the Service and your accounts;
- Authenticate users (including delivering one-time passcodes), secure accounts, and prevent fraud and abuse;
- Process donations and other transactions you initiate, and deliver receipts;
- Deliver notifications, reminders, and messages configured by you or your Organization;
- Provide features such as feeds, groups, events, livestreams, and — where enabled — AI-assisted features like transcription, captions, and translation;
- Provide customer support and respond to questions, requests, and feedback;
- Understand how the Service is used, and improve, develop, and test the Service and new features;
- Communicate with Organization administrators and, where permitted, prospective customers about products, updates, and offers (with opt-out at any time);
- Enforce our terms, protect the safety of users (including minors), and comply with legal obligations.

We may aggregate or de-identify personal information so it no longer reasonably identifies anyone, and use that information for any lawful purpose. Where required by law, we maintain de-identified data as de-identified and do not attempt to re-identify it.

## 4. How We Disclose Information

**We do not sell personal information, and we do not share it for cross-context behavioral advertising.** We disclose personal information only as follows:

**4.1 To your Organization.** Member Data is, by design, available to your Organization and its authorized staff according to its roles, permissions, and location-access settings — including your contact details, activity, and, if you donate, donor information needed to record and receipt your gift (name, contact information, amount, designation, and date).

**4.2 To other users.** Content you post is visible to other users according to the visibility settings of the post, group, or feature — organization-wide, group-only, staff-only, or public, as applicable. Information shared in community areas may be read, collected, or reshared by others; post accordingly.

**4.3 To service providers.** We use vetted third parties to run the Service, under agreements that restrict their use of personal information and require appropriate safeguards. Categories include: cloud hosting and infrastructure; content delivery and media storage/streaming; payment processing; communications delivery (email, SMS, push notifications); product analytics and crash reporting; customer support tooling; AI processing for features such as transcription, captioning, and translation; security, fraud-prevention, and abuse-detection (including child-safety scanning of uploaded media); and professional advisors.

**4.4 Payment processing.** Payments are processed by Stripe, Inc. (and, in some regions, other processors we may add). Payment data you provide at checkout is collected by the processor under its own privacy policy and terms. Your Organization is the recipient/merchant of record for donations.

**4.5 Legal, safety, and compliance.** We may disclose information where we believe in good faith it is necessary to: comply with law, legal process, or government requests; enforce our agreements; detect, prevent, or address fraud, security, or technical issues; protect the rights, property, or safety of ZALA, our users, minors, or the public; or meet anti-money-laundering, sanctions, and reporting obligations. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as required by law.

**4.6 Business transfers.** If ZALA or GDiz LLC is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy's commitments; we will provide notice and, where required by law, choices.

## 5. Communications: Email, SMS, and Push

We send transactional and account communications (such as sign-in passcodes, receipts, and security notices) as part of the Service. Marketing emails are sent only where permitted and always include an unsubscribe mechanism, honored in accordance with applicable law (including the CAN-SPAM Act). SMS messages are sent only where permitted by law and, where required, only with prior express consent obtained by us or your Organization; **reply STOP to opt out of SMS at any time** (message and data rates may apply). Push notifications can be managed in your device or in-app settings. Organizations are responsible for the messages they send to their communities through the Service and for obtaining any consents required for those messages.

## 6. Cookies and Analytics

We and our providers use cookies, SDKs, pixels, and similar technologies to keep you signed in, remember preferences, secure the Service, measure performance, and understand feature usage. We use product analytics (including session-level usage analytics) to understand how the Service is used and improve it; analytics identifiers are pseudonymous where feasible. You can control cookies through browser settings; disabling them may affect functionality. Because we do not sell personal information or engage in cross-context behavioral advertising, there is generally no sale/sharing activity to opt out of; where we receive a legally recognized opt-out preference signal such as Global Privacy Control (GPC), we will process it consistent with applicable law.

## 7. Security

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect personal information — including encryption in transit, access controls, tenant isolation between Organizations, permission- and location-scoped staff access, and logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect access to your email inbox, phone number, and devices, since passwordless sign-in relies on them. If a breach affecting personal information occurs, we will notify affected Organizations and/or individuals and regulators as required by applicable law.

## 8. Retention

We retain personal information for as long as reasonably necessary to provide the Service and maintain accounts; to comply with legal, tax, accounting, payment-network, and reporting obligations; to resolve disputes and enforce agreements; and to protect the security and integrity of the Service. Member Data is retained according to the subscribing Organization's instructions and subscription status: following termination of an Organization's subscription, its tenant data is made available for export for thirty (30) days and then deleted or de-identified within a commercially reasonable period, except for residual copies in routine backups (which expire on schedule) and records we must keep by law. De-identified or aggregated data may be retained longer.

## 9. Children and Minors

**9.1 Children under 13 (COPPA).** The Service is a general-audience service and is not directed to children under 13. Children under 13 may not create their own accounts, and we do not knowingly collect personal information directly from children under 13. Organizations and parents/guardians may create or administer child-associated profiles (for example, for children's ministry rosters or check-in); in those cases, the parent/guardian and the Organization are responsible for the profile, and we process the information as a service provider to the Organization. Where we have actual knowledge that we are collecting personal information directly from a child under 13, we will obtain verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA) or delete the information. We do not use children's personal information for advertising and do not disclose it to third parties for marketing.

**9.2 Parents and guardians.** Parents or guardians may review, correct, or request deletion of their child's information, or revoke consent, by contacting their Organization (for Member Data) or us at hello@zala.net; we will respond promptly and delete information collected without proper consent.

**9.3 California minors.** California residents under 18 who are registered users may request removal of content they publicly posted by contacting hello@zala.net. Removal may not be complete or comprehensive (for example, where content was reshared by others or must be retained by law).

## 10. Your Privacy Rights (U.S. State Laws)

Depending on where you live (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws), you may have rights to: **know/access** the personal information we hold about you and obtain a copy; **correct** inaccuracies; **delete** your personal information; **data portability**; **opt out** of sale, sharing for targeted advertising, or certain profiling (we do not engage in these activities, but you may still submit a request); **limit the use of sensitive personal information** to what is necessary to provide the Service; and **non-discrimination** for exercising your rights.

**How to exercise your rights.** For Member Data, contact your Organization (Section 1.1); we will assist it in fulfilling your request. For information ZALA controls, email **hello@zala.net**. We will verify your identity (for example, against your account email and recent activity) before acting, and will respond within the timeframes required by applicable law (generally 45 days, with permitted extensions). You may use an authorized agent, subject to verification, and you may submit requests on behalf of your minor child. If we deny a request and your state provides an appeal right, you may appeal by emailing hello@zala.net with the subject line "Privacy Request Appeal"; we will respond within the legally required period.

**California-specific disclosures.** In the preceding 12 months, we have collected these categories of personal information (as defined by the CCPA (California Consumer Privacy Act)): identifiers (name, email, phone, IP address, device and online identifiers); customer records (billing and giving history, processed by our payment processor); protected classifications (religion, only as inherent in your voluntary use of a faith-based service); commercial information (donation records and feature engagement); internet/network activity (usage and log data); geolocation (general location from IP; precise only if you enable it); audio/visual information (profile photos and media you post); professional information (role within an Organization, where provided); inferences (to provide and personalize the Service); and sensitive personal information (information revealing religious beliefs, such as prayer requests or group participation, where you choose to share it). Sources and purposes are described in Sections 2–3; disclosures are described in Section 4. **We do not sell personal information and do not share it for cross-context behavioral advertising, including personal information of minors under 16.** We use sensitive personal information only for purposes permitted under California law. We do not offer financial incentives in exchange for personal information. We do not track users across third-party websites for targeted advertising and therefore do not respond to Do Not Track signals; we honor GPC signals as described in Section 6.

**Nevada.** We do not sell covered information as defined under Nevada law. Nevada residents may contact hello@zala.net with questions.

## 11. Users Outside the United States

The Service is operated from the United States, and the initial market for the Service is the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the United States (and in other locations where our infrastructure or service providers operate), where privacy laws may differ from those in your jurisdiction. Where the Service is offered to Organizations in other regions, ZALA will implement transfer and localization measures required by applicable law, and region-specific terms may be provided in the applicable Data Processing Addendum. If you do not consent to processing in the United States, do not use the Service.

## 12. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the revised Policy and update the "Effective Date". For material changes, we will provide additional notice (through the Service or by email) at least 30 days before the change takes effect where feasible and required by law. Please review this Policy periodically.

## 13. Contact Us

**GDiz LLC**
440 N Barranca Ave #4348, Covina, CA 91723, United States
Email: **hello@zala.net**
Web: zala.net

If you have questions, concerns, or complaints about this Policy or our privacy practices, contact us at hello@zala.net; we will review and address privacy-related concerns in good faith and in accordance with applicable law.

ZALA Terms of Use

(End User Agreement)

Effective Date: July 8, 2026

These Terms of Use (the "Terms") are an agreement between you and GDiz LLC ("ZALA," "we," "us," or "our"), the operator of the ZALA platform. The Terms govern your use of the ZALA service — including the shared ZALA mobile applications, co-branded and white-label mobile applications powered by ZALA, the websites at zala.net and related domains, giving and payment features, livestreams, feeds, groups, events, messaging, and any related software, content, and services (collectively, the "Service") — whether you access it as a guest or a registered user.

By accessing or using the Service, or by tapping "accept" or "agree" when prompted, you agree to these Terms and to the ZALA Privacy Policy at zala.net/legal/privacy, which is incorporated by reference. If you do not agree, do not use the Service.

If you are accepting on behalf of a church, ministry, or other organization that subscribes to ZALA, your organization's use is governed by the separate ZALA Terms of Service (zala.net/legal/terms-of-service); these Terms govern your individual use of the Service.

1. Your Relationship with ZALA and Your Organization

1.1 How the Service works. ZALA is a multi-tenant platform. Your access is typically provided through a church, ministry, or other organization that subscribes to ZALA (your "Organization"). Your Organization controls its community on the Service: who can join, what content is published, how posts are moderated, what groups exist, and how donations are used.

1.2 Organization rules. Your use may be subject to additional rules, community standards, or terms set by your Organization, which supplement these Terms. Your Organization — not ZALA — is responsible for its own content, conduct, communications, fundraising, and use of donated funds.

1.3 Your data and your Organization. Information you share within an Organization's community (profile details, posts, prayer requests, group membership, attendance, giving history) is accessible to that Organization and is handled by it as described in the ZALA Privacy Policy and the Organization's own privacy practices. ZALA processes that information on the Organization's behalf to provide the Service.

1.4 Multiple organizations. Accounts on ZALA are scoped to an Organization. If you join more than one Organization on ZALA (for example, using the same email address or phone number), you may have separate accounts and profiles in each, and content or settings in one do not carry over to another.

2. Eligibility

The Service is intended for users who can form a binding contract under applicable law. The Service is not directed to children under 13, and children under 13 may not create their own accounts. Users aged 13–17 may use the Service only with the involvement and consent of a parent or legal guardian, who is responsible for the minor's use. An Organization or a parent/guardian may create or administer profiles associated with a child (for example, for children's ministry check-in); in that case, the parent or guardian and the Organization are responsible for that profile as described in the Privacy Policy. By using the Service, you confirm you meet these requirements.

3. Accounts, Passwordless Sign-In, and Security

3.1 Registration. Some features require an account. You agree to provide accurate, current, and complete information and to keep it updated.

3.2 Passwordless authentication. ZALA uses passwordless sign-in: one-time passcodes sent to your email address or phone number, and/or passkeys. Anyone with access to your email inbox, phone number, or device passkeys may be able to access your account. You are responsible for securing your email account, phone number (including protecting against SIM-swap and number-recycling risks), and devices, and for all activity under your account. Notify us promptly at hello@zala.net of any suspected unauthorized access.

3.3 Account actions. We may suspend or deactivate accounts at our discretion, including for violations of these Terms, at your Organization's request, or to protect the Service and its users.

4. Your Content

4.1 User Contributions. The Service includes interactive features — feeds, comments, reactions, groups, prayer requests, event registrations, media uploads, and messaging (collectively, "Interactive Features") — through which you can create, post, submit, or transmit content ("User Contributions").

4.2 License. You retain ownership of your User Contributions. By posting them, you grant ZALA, its service providers, and your Organization a worldwide, non-exclusive, royalty-free license to host, store, reproduce, adapt (e.g., for formatting, thumbnails, captions, or translation), display, perform, and distribute your User Contributions as needed to operate and provide the Service, consistent with the visibility settings that apply to the content. This license ends when your User Contributions are deleted from the Service, except for content already shared with others, copies in routine backups (which expire on schedule), and retention required by law.

4.3 Your responsibility. You represent that you own or have the necessary rights to your User Contributions and that they comply with these Terms. You — not ZALA — are responsible for your User Contributions, including their legality, accuracy, and appropriateness.

4.4 Visibility. Content you post may be visible to some or all members of your Organization, and in some cases publicly, depending on the visibility settings of the post, group, or feature. Prayer requests and similar content may be visible to Organization staff and, depending on the option you choose, to groups or the wider community. Check the visibility setting before posting; do not post anything you are not comfortable sharing at that level.

4.5 Moderation. Your Organization's administrators and ZALA may review, approve, decline, remove, or restrict User Contributions at their discretion, and may pin, feature, or reorganize content within the Organization's community.

5. Content Standards

User Contributions must comply with all applicable laws and must not:

• Contain defamatory, obscene, indecent, abusive, harassing, violent, hateful, or otherwise objectionable material;
• Contain sexually explicit or pornographic material, or promote violence or discrimination;
• Exploit, endanger, sexualize, or harm minors in any way, or solicit personal information from minors;
• Infringe any copyright, trademark, trade secret, or other intellectual-property or proprietary right (including posting song lyrics, sheet music, recordings, books, or videos you do not have rights to share);
• Violate the privacy, publicity, or other legal rights of others, including posting another person's personal information without permission;
• Be deceptive, impersonate any person, or misrepresent your identity or affiliation with any person or organization;
• Constitute unsolicited advertising, promotions, chain letters, or spam, or unauthorized commercial activity;
• Promote illegal activity or contain malicious code.

6. Acceptable Use

You agree to use the Service only for lawful purposes. You must not: (a) interfere with or disrupt the Service, other users, or connected systems; (b) use bots, scrapers, or automated means to access the Service without written permission; (c) attempt to gain unauthorized access to any part of the Service, other accounts, or other Organizations' communities; (d) probe, scan, or test the vulnerability of the Service; (e) introduce viruses or other harmful material; (f) attack the Service via denial-of-service or similar means; or (g) copy, reverse engineer, or create derivative works of the Service except as permitted by law.

7. Giving, Donations, and Payments

7.1 How giving works. Giving features let you make one-time or recurring donations and payments to your Organization. Payments are processed by third-party payment processors (currently Stripe, Inc.). Your Organization — not ZALA — is the recipient of your donation and the merchant of record. ZALA does not hold your funds and does not control how your Organization uses them.

7.2 Payment authorization. When you make a payment, you authorize ZALA and its payment processor to charge your selected payment method and, if you save a payment method, to store your payment credentials with the processor for future transactions you initiate. Card details are collected and stored by the payment processor, not by ZALA.

7.3 Recurring giving. If you set up recurring giving, you authorize ZALA and its payment processor to automatically charge your selected payment method at the amount and frequency you selected, without further action by you, until you cancel. You can cancel recurring giving at any time through the Service's giving settings; to be safe, cancel at least ten (10) business days before the next scheduled charge to ensure it does not process.

7.4 Fees. Your Organization's plan determines platform and processing fees. If a "cover the fees" option is offered and you select it, an additional amount will be added to your payment so your Organization receives more of your intended gift; the amount is shown before you confirm.

7.5 Refunds and disputes. Refund requests for donations should be directed to your Organization, which is responsible for its own refund decisions and policies, subject to applicable law and card-network rules. Tax receipts and giving statements are issued by your Organization, and their accuracy (including deductibility) is your Organization's responsibility. ZALA does not provide tax advice.

7.6 Fund use. All funds given through the Service should be used as described by your Organization. We do not independently verify or guarantee how funds are used once disbursed. By donating, you acknowledge that you do so based on your own judgment and trust in your Organization. If you believe funds are being misused, you may report it to hello@zala.net; we may suspend or terminate giving features in cases of suspected misuse.

7.7 Prohibited transactions; processor policies. You may not use payment features for any activity prohibited by law or by our payment processors, and you agree to comply with Stripe's Acceptable Use Policy and Restricted Businesses list.

7.8 Anti-money laundering and sanctions. You must not use the Service to launder money, finance terrorism, or transact with individuals, entities, or regions subject to sanctions administered by the U.S. Office of Foreign Assets Control (OFAC) or other applicable authorities. We and our processors may screen transactions, request verification information, block or reverse transactions, suspend or terminate access, and report suspicious activity to authorities, in each case without any obligation to notify you where the law restricts notice. You agree to cooperate with related investigations.

8. Livestreams, Media, and AI Features

8.1 Media. The Service may include livestreams, sermon videos, audio, and other media provided by your Organization or third parties. Availability and quality depend on your Organization's plan, your connection, and third-party services (including streams relayed to or embedded from platforms such as YouTube or Vimeo, which are subject to those platforms' terms).

8.2 AI-assisted features. Some features may use artificial intelligence, such as automated transcription, captions, translation of posts or sermons, content summaries, or highlight clips. AI-generated output can contain errors — captions, translations, and summaries may be inaccurate or incomplete, and synthesized voices you hear may be AI-generated rather than human recordings. Do not rely on AI output where accuracy matters without verifying against the original. Your Organization controls whether these features are enabled for its community.

9. Notifications and Communications

With your consent where required, the Service may send you push notifications, emails, and SMS (text) messages, such as new posts, event reminders, giving receipts, and journey messages configured by your Organization. You can manage push notifications in your device or app settings, unsubscribe from marketing emails via the link in the email, and opt out of SMS by replying STOP. Message and data rates may apply to SMS. Transactional messages (such as sign-in passcodes and payment receipts) are part of the Service.

10. Intellectual Property

The Service — including its software, design, text, graphics, logos, and arrangement — is owned by ZALA (GDiz LLC), its licensors, or the relevant Organization and content providers, and is protected by intellectual-property laws. Except as expressly permitted, you may not reproduce, distribute, modify, publicly display, republish, or create derivative works from the Service or its content, or use it for commercial purposes. The ZALA name and logos are trademarks of GDiz LLC; Organization names and logos belong to the respective Organizations. No rights are granted except as expressly stated.

Copyright complaints. If you believe content on the Service infringes your copyright, send a notice compliant with the Digital Millennium Copyright Act (DMCA) to our designated agent: GDiz LLC, Attn: DMCA Agent, 440 N Barranca Ave #4348, Covina, CA 91723, United States; email: hello@zala.net. We may remove allegedly infringing content and may terminate repeat infringers.

11. Monitoring, Enforcement, and Termination

We reserve the right to: remove or refuse any User Contribution; take any action we reasonably believe necessary regarding content that violates these Terms, infringes rights, threatens safety, or creates liability; disclose your identity or information to third parties or authorities where required by law or where we believe disclosure is necessary to protect rights or safety; refer matters to law enforcement; and suspend or terminate your access for any reason, including violation of these Terms or at your Organization's request. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and cooperate with law enforcement as required by law. We cannot review all material before it is posted and are not liable for user or third-party content.

12. Reliance on Information

Content on the Service is provided for general purposes only. ZALA does not warrant the accuracy, completeness, or usefulness of content provided by Organizations, users, or third parties, and is not responsible for it. Any reliance you place on such content is at your own risk. Nothing on the Service constitutes professional advice (legal, tax, financial, medical, or counseling); content of a pastoral or counseling nature is provided by your Organization, not ZALA.

13. Third-Party Links and Services

The Service may contain links to, or integrations with, third-party websites and services (for example, video platforms, calendars, or an Organization's own website and tools). These are provided for convenience only; ZALA does not control them and is not responsible for their content, policies, or practices. Your use of third-party services is at your own risk and subject to their terms.

14. Geographic Availability

The Service is operated from the United States and is currently intended primarily for users in the United States. If you access the Service from elsewhere, you do so at your own initiative and are responsible for compliance with local laws. Certain features (for example, giving, SMS, or calling features) may be unavailable or restricted in some jurisdictions.

15. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. ZALA DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE, OR THAT CONTENT IS ACCURATE OR RELIABLE. SOME JURISDICTIONS DO NOT ALLOW CERTAIN WARRANTY EXCLUSIONS, SO SOME OF THE ABOVE MAY NOT APPLY TO YOU.

16. Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY LAW, ZALA, ITS AFFILIATES, AND THEIR OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF DATA, GOODWILL, OR DONATIONS, ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE. TO THE FULLEST EXTENT PERMITTED BY LAW, ZALA'S TOTAL AGGREGATE LIABILITY TO YOU FOR ALL CLAIMS RELATING TO THE SERVICE WILL NOT EXCEED THE GREATER OF (A) ONE HUNDRED U.S. DOLLARS (US$100) OR (B) THE AMOUNTS YOU PAID TO ZALA (EXCLUDING DONATIONS PASSED TO YOUR ORGANIZATION) IN THE TWELVE (12) MONTHS BEFORE THE CLAIM AROSE. NOTHING IN THESE TERMS LIMITS LIABILITY THAT CANNOT BE LIMITED UNDER APPLICABLE LAW.

17. Indemnification

You agree to defend, indemnify, and hold harmless ZALA, its affiliates, and their officers, directors, employees, and agents from claims, liabilities, damages, and costs (including reasonable attorneys' fees) arising from your violation of these Terms, your User Contributions, or your use of the Service beyond what is authorized.

18. Governing Law; Disputes; Time Limit on Claims

These Terms are governed by the laws of the State of Delaware and the U.S. Federal Arbitration Act, without regard to conflict-of-laws principles.

PLEASE READ THIS SECTION CAREFULLY — IT AFFECTS YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE A LAWSUIT IN COURT.

18.1 Informal resolution first. Before filing a claim, you and ZALA agree to try to resolve the dispute informally: contact us at hello@zala.net with a description of the dispute, and both parties will attempt in good faith to resolve it within sixty (60) days. Most concerns can be resolved this way.

18.2 Binding arbitration. If the dispute is not resolved informally, you and ZALA agree that any dispute, claim, or controversy arising out of or relating to these Terms or the Service will be resolved by binding individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules then in effect, rather than in court. The AAA rules are available at www.adr.org. Payment of filing, administration, and arbitrator fees will be governed by the AAA rules. The arbitration will be conducted in English; hearings, if any, will take place in your county of residence or remotely by videoconference, as provided by the AAA rules. Judgment on the arbitration award may be entered in any court of competent jurisdiction. The arbitrator has exclusive authority to resolve disputes about the interpretation, applicability, or enforceability of this arbitration agreement.

18.3 Exceptions. Either party may (a) bring an individual claim in small-claims court if it qualifies, and (b) seek injunctive or other equitable relief in a court of competent jurisdiction to protect intellectual property. Nothing in this Section prevents you from reporting issues to government agencies or bringing claims that cannot be arbitrated as a matter of law.

18.4 Class action waiver. YOU AND ZALA AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate claims of more than one person. If this class action waiver is found unenforceable as to a particular claim, that claim (and only that claim) will proceed in the state or federal courts located in Wilmington, Delaware, and the remainder of this Section remains in effect.

18.5 Opt-out. You may opt out of this arbitration agreement by emailing hello@zala.net with the subject line "Arbitration Opt-Out," your name, and the email/phone associated with your account, within thirty (30) days of first accepting these Terms. Opting out does not affect any other provision of these Terms.

18.6 Consumer rights. If you use the Service as a consumer in a jurisdiction whose laws give you non-waivable rights (including the right to bring claims in your local courts), nothing in these Terms limits those rights. To the maximum extent permitted by law, any claim arising out of these Terms or the Service must be filed within one (1) year after the cause of action accrues, or it is permanently barred.

19. Changes to These Terms

We may update these Terms from time to time. When we do, we will post the revised Terms and update the "Effective Date"; for material changes, we will provide reasonable advance notice through the Service or by email where required by law. Continued use of the Service after changes take effect constitutes acceptance.

20. Waiver, Severability, and Entire Agreement

No waiver of any term is a continuing waiver. If any provision of these Terms is held invalid or unenforceable, it will be limited or eliminated to the minimum extent necessary, and the remaining provisions remain in effect. These Terms and the Privacy Policy are the entire agreement between you and ZALA regarding the Service and supersede prior agreements. Any additional terms between you and your Organization are between you and that Organization.

21. Contact

GDiz LLC — 440 N Barranca Ave #4348, Covina, CA 91723, United States Email: hello@zala.net · Web: zala.net

ZALA Privacy Policy

Effective Date: July 8, 2026

This Privacy Policy (the "Policy") explains how GDiz LLC ("ZALA," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the ZALA platform — including the websites at zala.net and related domains, the shared ZALA mobile applications, co-branded and white-label applications powered by ZALA, giving features, and related software and services (collectively, the "Service").

This Policy should be read together with the ZALA Terms of Use (for individual users) and the ZALA Terms of Service (for subscribing organizations), available at zala.net/legal. If you do not agree with this Policy, do not use the Service.

1. Our Two Roles: Service Provider and Controller

ZALA is a multi-tenant platform used by churches, ministries, and other organizations ("Organizations") to engage their communities. Because of this, we handle personal information in two distinct roles:

1.1 ZALA as a service provider / processor (Member Data). When you use the Service as a member, visitor, donor, volunteer, or attendee of an Organization, the personal information collected within that Organization's community — such as your contact record, profile, posts, prayer requests, group memberships, event registrations, attendance, messages, and giving history ("Member Data") — is controlled by your Organization. ZALA processes Member Data on the Organization's behalf and under its instructions, solely to provide the Service. Your Organization decides who in its community can see what, how it communicates with you, and how it uses your information; its own privacy practices also apply. If you want to access, correct, or delete Member Data, or have questions about how your Organization uses it, contact your Organization first. We will support Organizations in responding to such requests and will refer requests we receive directly to the relevant Organization where appropriate.

1.2 ZALA as a controller (our own data). ZALA is the controller of personal information we collect for our own purposes, including: account and billing information for Organization administrators; information about visitors to zala.net; support communications; marketing data; and technical, security, and product-usage data we use to operate, secure, and improve the Service.

2. Information We Collect

2.1 Information you provide directly.

• Account and profile information: name, email address, phone number, profile photo, and organization affiliation. ZALA uses passwordless sign-in, so we do not collect or store passwords; we process one-time passcodes and/or passkey credentials to authenticate you.
• Content you create: posts, comments, reactions, prayer requests, testimonies, messages, media uploads, event registrations and responses, and group activity.
• Giving and transaction details: donation amounts, designations (funds/campaigns), dates, and receipts. Payment card and bank details are collected and processed directly by our payment processor (currently Stripe, Inc.) — ZALA does not store full card numbers or bank credentials.
• Organization administrator information: business contact details, billing information, tax-exemption documentation, and payment-onboarding information collected by our payment processor (which may include identity-verification and beneficial-ownership information required by law).
• Support and communications: information you provide when you contact support, complete forms, or respond to surveys.

2.2 Information collected automatically. When you use the Service, we and our service providers automatically collect technical and usage information: IP address, device identifiers, device type and operating system, app version, browser type, language, referring/exit pages, dates and times of access, crash logs, and interactions with features. We use cookies, SDKs (software development kits), and similar technologies for authentication, preferences, security, performance measurement, and product analytics (see Section 7).

2.3 Information from Organizations and other sources. Organizations may add or import information about you into the Service (for example, contact records from a previous system, attendance, or group assignments) — this is Member Data controlled by the Organization (Section 1.1). We may also receive information from authentication providers, payment processors (transaction confirmations and fraud signals), app stores, and security and analytics vendors.

2.4 Location information. We may derive general (city-level) location from your IP address for security, regional settings, and analytics. Precise device location is collected only if you affirmatively enable it for a specific feature, and you can disable it in your device settings at any time.

2.5 Sensitive information, including religious information. By its nature, use of the Service may reveal or include information about religious affiliation or beliefs — for example, membership in a church community, prayer requests, small-group participation, baptism interest, or pastoral-care notes. We treat this as sensitive personal information: we process it only to provide the Service requested by you and your Organization, to secure the Service, and to comply with law. We do not use sensitive information for advertising, do not sell it, and do not disclose it except as described in this Policy. Visibility of content like prayer requests is determined by the settings you and your Organization choose — review visibility options before posting.

3. How We Use Information

We use personal information to:

• Provide, operate, administer, and maintain the Service and your accounts;
• Authenticate users (including delivering one-time passcodes), secure accounts, and prevent fraud and abuse;
• Process donations and other transactions you initiate, and deliver receipts;
• Deliver notifications, reminders, and messages configured by you or your Organization;
• Provide features such as feeds, groups, events, livestreams, and — where enabled — AI-assisted features like transcription, captions, and translation;
• Provide customer support and respond to questions, requests, and feedback;
• Understand how the Service is used, and improve, develop, and test the Service and new features;
• Communicate with Organization administrators and, where permitted, prospective customers about products, updates, and offers (with opt-out at any time);
• Enforce our terms, protect the safety of users (including minors), and comply with legal obligations.

We may aggregate or de-identify personal information so it no longer reasonably identifies anyone, and use that information for any lawful purpose. Where required by law, we maintain de-identified data as de-identified and do not attempt to re-identify it.

4. How We Disclose Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only as follows:

4.1 To your Organization. Member Data is, by design, available to your Organization and its authorized staff according to its roles, permissions, and location-access settings — including your contact details, activity, and, if you donate, donor information needed to record and receipt your gift (name, contact information, amount, designation, and date).

4.2 To other users. Content you post is visible to other users according to the visibility settings of the post, group, or feature — organization-wide, group-only, staff-only, or public, as applicable. Information shared in community areas may be read, collected, or reshared by others; post accordingly.

4.3 To service providers. We use vetted third parties to run the Service, under agreements that restrict their use of personal information and require appropriate safeguards. Categories include: cloud hosting and infrastructure; content delivery and media storage/streaming; payment processing; communications delivery (email, SMS, push notifications); product analytics and crash reporting; customer support tooling; AI processing for features such as transcription, captioning, and translation; security, fraud-prevention, and abuse-detection (including child-safety scanning of uploaded media); and professional advisors.

4.4 Payment processing. Payments are processed by Stripe, Inc. (and, in some regions, other processors we may add). Payment data you provide at checkout is collected by the processor under its own privacy policy and terms. Your Organization is the recipient/merchant of record for donations.

4.5 Legal, safety, and compliance. We may disclose information where we believe in good faith it is necessary to: comply with law, legal process, or government requests; enforce our agreements; detect, prevent, or address fraud, security, or technical issues; protect the rights, property, or safety of ZALA, our users, minors, or the public; or meet anti-money-laundering, sanctions, and reporting obligations. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as required by law.

4.6 Business transfers. If ZALA or GDiz LLC is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy's commitments; we will provide notice and, where required by law, choices.

5. Communications: Email, SMS, and Push

We send transactional and account communications (such as sign-in passcodes, receipts, and security notices) as part of the Service. Marketing emails are sent only where permitted and always include an unsubscribe mechanism, honored in accordance with applicable law (including the CAN-SPAM Act). SMS messages are sent only where permitted by law and, where required, only with prior express consent obtained by us or your Organization; reply STOP to opt out of SMS at any time (message and data rates may apply). Push notifications can be managed in your device or in-app settings. Organizations are responsible for the messages they send to their communities through the Service and for obtaining any consents required for those messages.

6. Cookies and Analytics

We and our providers use cookies, SDKs, pixels, and similar technologies to keep you signed in, remember preferences, secure the Service, measure performance, and understand feature usage. We use product analytics (including session-level usage analytics) to understand how the Service is used and improve it; analytics identifiers are pseudonymous where feasible. You can control cookies through browser settings; disabling them may affect functionality. Because we do not sell personal information or engage in cross-context behavioral advertising, there is generally no sale/sharing activity to opt out of; where we receive a legally recognized opt-out preference signal such as Global Privacy Control (GPC), we will process it consistent with applicable law.

7. Security

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect personal information — including encryption in transit, access controls, tenant isolation between Organizations, permission- and location-scoped staff access, and logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect access to your email inbox, phone number, and devices, since passwordless sign-in relies on them. If a breach affecting personal information occurs, we will notify affected Organizations and/or individuals and regulators as required by applicable law.

8. Retention

We retain personal information for as long as reasonably necessary to provide the Service and maintain accounts; to comply with legal, tax, accounting, payment-network, and reporting obligations; to resolve disputes and enforce agreements; and to protect the security and integrity of the Service. Member Data is retained according to the subscribing Organization's instructions and subscription status: following termination of an Organization's subscription, its tenant data is made available for export for thirty (30) days and then deleted or de-identified within a commercially reasonable period, except for residual copies in routine backups (which expire on schedule) and records we must keep by law. De-identified or aggregated data may be retained longer.

9. Children and Minors

9.1 Children under 13 (COPPA). The Service is a general-audience service and is not directed to children under 13. Children under 13 may not create their own accounts, and we do not knowingly collect personal information directly from children under 13. Organizations and parents/guardians may create or administer child-associated profiles (for example, for children's ministry rosters or check-in); in those cases, the parent/guardian and the Organization are responsible for the profile, and we process the information as a service provider to the Organization. Where we have actual knowledge that we are collecting personal information directly from a child under 13, we will obtain verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA) or delete the information. We do not use children's personal information for advertising and do not disclose it to third parties for marketing.

9.2 Parents and guardians. Parents or guardians may review, correct, or request deletion of their child's information, or revoke consent, by contacting their Organization (for Member Data) or us at hello@zala.net; we will respond promptly and delete information collected without proper consent.

9.3 California minors. California residents under 18 who are registered users may request removal of content they publicly posted by contacting hello@zala.net. Removal may not be complete or comprehensive (for example, where content was reshared by others or must be retained by law).

10. Your Privacy Rights (U.S. State Laws)

Depending on where you live (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws), you may have rights to: know/access the personal information we hold about you and obtain a copy; correct inaccuracies; delete your personal information; data portability; opt out of sale, sharing for targeted advertising, or certain profiling (we do not engage in these activities, but you may still submit a request); limit the use of sensitive personal information to what is necessary to provide the Service; and non-discrimination for exercising your rights.

How to exercise your rights. For Member Data, contact your Organization (Section 1.1); we will assist it in fulfilling your request. For information ZALA controls, email hello@zala.net. We will verify your identity (for example, against your account email and recent activity) before acting, and will respond within the timeframes required by applicable law (generally 45 days, with permitted extensions). You may use an authorized agent, subject to verification, and you may submit requests on behalf of your minor child. If we deny a request and your state provides an appeal right, you may appeal by emailing hello@zala.net with the subject line "Privacy Request Appeal"; we will respond within the legally required period.

California-specific disclosures. In the preceding 12 months, we have collected these categories of personal information (as defined by the CCPA (California Consumer Privacy Act)): identifiers (name, email, phone, IP address, device and online identifiers); customer records (billing and giving history, processed by our payment processor); protected classifications (religion, only as inherent in your voluntary use of a faith-based service); commercial information (donation records and feature engagement); internet/network activity (usage and log data); geolocation (general location from IP; precise only if you enable it); audio/visual information (profile photos and media you post); professional information (role within an Organization, where provided); inferences (to provide and personalize the Service); and sensitive personal information (information revealing religious beliefs, such as prayer requests or group participation, where you choose to share it). Sources and purposes are described in Sections 2–3; disclosures are described in Section 4. We do not sell personal information and do not share it for cross-context behavioral advertising, including personal information of minors under 16. We use sensitive personal information only for purposes permitted under California law. We do not offer financial incentives in exchange for personal information. We do not track users across third-party websites for targeted advertising and therefore do not respond to Do Not Track signals; we honor GPC signals as described in Section 6.

Nevada. We do not sell covered information as defined under Nevada law. Nevada residents may contact hello@zala.net with questions.

11. Users Outside the United States

The Service is operated from the United States, and the initial market for the Service is the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the United States (and in other locations where our infrastructure or service providers operate), where privacy laws may differ from those in your jurisdiction. Where the Service is offered to Organizations in other regions, ZALA will implement transfer and localization measures required by applicable law, and region-specific terms may be provided in the applicable Data Processing Addendum. If you do not consent to processing in the United States, do not use the Service.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the revised Policy and update the "Effective Date". For material changes, we will provide additional notice (through the Service or by email) at least 30 days before the change takes effect where feasible and required by law. Please review this Policy periodically.

13. Contact Us

GDiz LLC 440 N Barranca Ave #4348, Covina, CA 91723, United States Email: hello@zala.net Web: zala.net

If you have questions, concerns, or complaints about this Policy or our privacy practices, contact us at hello@zala.net; we will review and address privacy-related concerns in good faith and in accordance with applicable law.