Pastoral data and AI: shared only with your parish's explicit yes

A few of Vianney's AI helpers work with pastoral information — a Shepherd Note about a family's hard season, the sick list, the pastor's annulment summaries. Whether that kind of information may be processed by an AI provider is your parish's decision to make, not ours. So it has its own explicit switch, and the switch starts off.

The switch

• It lives at Settings → AI add-on → Pastoral AI processing (third-party) and only a priest or admin can change it.
• It is off by default for every parish. Nothing pastoral is sent to any AI provider until your parish deliberately turns it on.
• Flipping it is recorded in the audit trail, like every settings change.

What is sent while it is on

With the switch (and the relevant feature) on, these — and only these — send pastoral context to Anthropic (Claude), Vianney's AI subprocessor:
- Shepherd Notes triage — the captured note itself, so it can be classified and a warm reply drafted.
- Shepherd Notes reply drafts — the note the reply answers, plus household first names when they help address it well.
- The sidebar assistant — when a question doesn't match one of Vianney's own built-in rules and has to go to Claude, its snapshot then also includes the sick list, and, for the pastor alone, the annulment summary (names and stages only — never Tribunal contents). This rides on every such Claude call while the switch is on, not only when the question names the sick list or annulments directly.
- Birthday cards — a light personal detail from the office notes (staff-visible notes only; anything sensitive is filtered out before anything is sent).

What this switch does NOT govern

Everything else the sidebar assistant can now answer — faith formation enrollment, giving totals, ministry rosters and open slots, Safe Environment clearance counts, cemetery capacity, baptisms in preparation, funerals, Mass intentions and the schedule, birthdays and anniversaries — is not pastoral data under this switch. It is the same class of announceable, operational fact a parish bulletin already publishes (a count, a schedule, a total), and each of those helpers has its own toggle under Settings → AI add-on. Turning pastoral AI processing on or off has no effect on whether the assistant can tell you how many are enrolled in formation or what came in last weekend's collection — and turning it off does not turn those off either. See What the AI can and cannot see for the full map of what travels with which question.

What happens while it is off

Vianney keeps working — locally, with its built-in rules:
- Shepherd Notes are still captured and sorted by the deterministic rules engine, and replies come from the warm built-in templates.
- The assistant still answers sick-list and annulment questions from your own database — those answers are computed in the parish and never left it in the first place.
- Birthday cards still draft warmly; they simply do not use the office notes.

In either mode — always

• Nothing confession-adjacent is ever sent to any AI. The seal is absolute; this switch cannot loosen it.
• Private Insights never enter an AI prompt in any mode — not for the office, not for the pastor, not once. (The old middle *clergy* tier no longer exists; there are two tiers now, private and public.) A public Insight may inform exactly two things: the AI person profile on a person's Engagement tab, and — only while this switch is on — the birthday-greeting drafter.
• Nothing is ever sent to a person automatically — a human always reviews and clicks send. Read the covenant as it is meant: no email, no text, no message goes out on your parish's behalf without someone confirming it. Two things sit outside that line, and it is worth naming them plainly. An in-app notification is not a send — publishing a ministry schedule gives the ministers on it who use the parish app one short nudge, with no name on the lock screen, no email and no text; see Checking and publishing a schedule. And a receipt for a person's own action — the confirmation for an event booking they just made — goes back to that person straight away, because it answers something they did; see Events and RSVPs. Neither one reaches anybody you had not already decided to reach.
• AI usage is metered and billed under the AI add-on, exactly as described in AI in Vianney.

About Anthropic

Anthropic is the company behind Claude, the model Vianney uses. Under Anthropic's standard commercial API terms, data sent through the API is not used to train its models. Vianney's own record of a call keeps metadata only — which model was billed, which AI helper the call belonged to, the token counts, and the cost — never the content of a prompt or reply. That is true of the parish's own usage page and of anything Vianney Software can see about your parish's usage: the numbers, never the words.

The same holds when something goes wrong. If an AI request fails, Vianney records what kind of failure it was and the status code — enough for us to fix it — and nothing of what was sent or what came back. An error message from the provider can quote the request back at us, so we deliberately do not keep it.

Tips

• Treat turning this on as a real parish decision — talk it through and say a deliberate yes, not a reflexive one.
• The non-pastoral helpers (bulletin announcements, readings summaries, form tidy-up, communication drafts, faith formation, giving, ministries, Safe Environment counts, cemetery, and the sacrament register OCR import) are not governed by this switch; they carry no pastoral records and follow their own toggles. See What the AI can and cannot see.