The Banyen Data Covenant

Where your data goes.
And where it can't.

Giving records are the most sensitive thing a church holds. So here's exactly what happens to yours — in plain words, no tech-speak.
The upload, step by step

What happens when you click "upload."

STEP 1

It travels locked.

Your file is scrambled the moment it leaves your computer — the same protection your bank uses when you log in. Nobody can read it along the way.

STEP 2

It goes into a room only you can open.

Every church gets its own locked room. Your login is the key. Each week's upload just adds to what's already there — anything you've uploaded before is spotted and skipped.

STEP 3

Banyen only ever sees the totals.

Overnight, your numbers get added up — things like "6 in 10 families give." Those totals are all we can see. Never a name. Never a family. Never a single gift.

The part nobody else will tell you

Two rooms. Banyen only has a key to one.

Your church's room

Names, gifts, notes, letters.

  • Every family, every gift, every note you write
  • Only the people you invite can come in
  • Volunteers can help without ever seeing dollar amounts
  • Take it all with you any time — or delete it, gone in 30 days
🔑 Key holder: your church. Nobody else.
Banyen's room

Totals and percentages. Nothing else fits.

  • How many families give, average giving, how churches your size compare
  • No names. No addresses. No gifts. Think of a ledger printed without a name column — there's nowhere to even write one
  • This is how "churches your size average…" comparisons get built — from totals, never from families
⛔ Our own tools can't look up a family. Not "we won't" — we can't.
When you want hands-on help

You can lend us a key. It melts in 72 hours.

STEP 1

You flip a switch.

In your settings there's a button: "Let Banyen help — 72 hours." Nothing happens unless you press it. There is no other way in.

STEP 2

We fix the problem with you.

For those 72 hours, our support person can see your room the way you see it — untangle a messy upload, fix a mismatched family, sort out a column. Then the key dissolves on its own.

STEP 3

You can read everything we did.

Every single thing done with that key is written in a log inside your account, in plain English, for you to read any time. No mystery, no trust-us.

Six commitments

The covenant, in writing.

Never sold. Never shared.

Your subscription is our entire business model. There is no advertiser, no data broker, no "partner" — your data has exactly one customer: your church.

How it's kept: flat published pricing means we never need another revenue stream.

Banyen staff can't see your families.

Our own screens show totals, not families. When you want hands-on help, you lend us a 72-hour key — it expires by itself, and everything we do with it is logged where you can read it.

How it's kept: our tools are only wired to the totals room. Helping you requires the 72-hour key — and only you can hand it over.

We never contact your givers.

Every letter, every thank-you, every check-in comes from your church, in your name, on your letterhead. We don't even collect giver emails or phone numbers.

How it's kept: there is no giver-contact feature, and there never will be.

Your data never trains AI.

Where Banyen uses AI (like polishing a letter you wrote), it works on that one letter, only when you ask, and keeps nothing. Your giving history never teaches any AI anything.

How it's kept: the letter gets polished and immediately forgotten — nothing is stored, nothing is learned from.

Leave whenever you want — with everything.

One click exports your complete history: gifts, families, notes, letters. Cancel, and your data is permanently deleted within 30 days. No hostage-taking, ever.

How it's kept: export and delete are buttons in your settings, not favors you have to ask for.

Privacy convictions are honored — even inside your church.

Pastors who believe they shouldn't see giving amounts can use every feature with dollars hidden. That's enforced by the system, not by looking away.

How it's kept: for those roles, the dollar amounts never even leave the vault — the screen can't show what it was never sent.
🌱
And the demo? It asks for nothing at all.

The live demo runs on realistic generated congregations — no signup, no email, and not a single row of real data. Explore every screen of the product before you trust anyone, including us, with anything. Your own data only ever enters the picture when you become a Banyen church.

An honest note on where we are: Banyen is onboarding its founding churches. Every commitment above is written into our founding-church agreement, and the technical design behind them is documented and available to any church that asks — send it to the engineer on your board; we'd genuinely love that. Questions, or want the technical writeup? jon@banyen.io

Kick the tires without handing us the keys.

The full product runs in your browser with realistic demo data — no signup, no upload, nothing stored.

Try the live demo →