Privacy

Who we are

ChurchPortalKit ("we", "us") provides multi-tenant captive-portal software for churches. The captive portal is operated by each church ("your church", "the customer") on its own guest Wi-Fi network. ChurchPortalKit is the data processor; the church is the data controller for guest information collected via its branded portal.

Two audiences, two relationships

• Church admins who sign up for ChurchPortalKit. We hold your name + email (via Clerk for authentication), your billing info (via Stripe — we never see card numbers), and your portal configuration. We use it to run the service you're paying for.
• Guests connecting to a church's Wi-Fi. Their relationship is with the church, not with us. We process their data on the church's behalf and never repurpose it.

What guests submit (and why)

When a guest connects to a church's Wi-Fi and goes through a check-in portal, the church's configured form may ask for:

• First and last name
• Email address or mobile number, depending on the church’s form

We also automatically capture:

• The device's MAC address (passed by the router; required to authorize internet access)
• The access-point MAC, SSID name, and connection timestamp
• The IP address and User-Agent of the device making the request
• Whether the visitor matched an existing record in the church's Planning Center account

For SSIDs configured as "simple connect" (no form), only the network metadata (MAC, AP, SSID, timestamp) is recorded.

What we do with it

• Authorize the device on the church's router so it gets internet access. Connection metadata is used to provide network access; submitted contacts also support the church’s guest records.
• Sync to Planning Center (if the church has connected Planning Center and enabled sync for the SSID). We look up the guest's email address, or their phone number if they gave only a phone; create a Person if there is no match; and add a note recording the SSID and check-in time.
• Display analytics to the church's team: total visits and first-time vs returning check-ins in the dashboard and, when email delivery is enabled, in weekly summary emails (counts only) to teammates who opt in.

We do not: sell data, share it with advertisers, profile guests across churches, or use it to train models.

Retention

The church can set its visit-retention period in Settings (default 365 days). Automatic removal from the active database requires the scheduled retention job to be enabled and running; Settings shows whether it is enabled. The job applies the same period to imported member lists, counted from when they were imported. SMS consent/suppression records and account credentials have separate lifecycles. Contact the church or support for an erasure request. Backup expiry is governed by the database operator’s backup policy; no fixed backup deletion time is promised here.

Where data lives and who processes it

We use these service providers (sub-processors):

• Fly.io (application hosting, primary region San Jose, California, US) — runs the portal, dashboard and API
• Neon (managed PostgreSQL database) — church configuration, guest visits, imported member lists and encrypted credentials
• Clerk (sign-in) — church team members' names, email addresses and sign-in sessions
• Stripe (payments) — billing details and, for hardware orders, shipping addresses; no guest data
• Resend (email, when email delivery is enabled) — recipient addresses and message content for emails to church team members, such as trial reminders and weekly summaries
• Inngest (background jobs) — job events carrying internal record identifiers, used to retry work such as Planning Center sync
• Slack (operator notifications) — new church sign-ups (church name, plan, admin email) and hardware orders (buyer email, shipping address); no guest data
• Twilio (text messages) — phone numbers and message content, only if SMS is enabled for a church; SMS is currently unavailable

Planning Center is connected by each church, not by us. When a church connects it, submitted guest names, contact details and visit notes are sent to that church's own Planning Center account and are governed by the church's relationship with Planning Center.

Sensitive credentials (PCO refresh tokens, UniFi admin passwords) are AES-256-GCM encrypted at rest with a key held only by ChurchPortalKit. Rotating that key would invalidate every stored credential and require re-authorization — we keep it stable.

Guest rights

A guest who wants to know what a church holds about them, or wants their data deleted, should email the church directly. The church admin can:

• Review visit records in /dashboard/visits and export them as CSV
• Remove all of a guest's visit records and matching imported member records by exact email address or phone number, or delete individual visits, from /dashboard/visits
• Set or shorten the church's retention period in Settings (it removes records only while scheduled cleanup is on)

Removing records here does not delete the church's separate Planning Center records. When a phone number is removed, an opt-out record is kept so that number is not sent text messages.

California residents have rights under the CCPA. Most individual churches don't meet the CCPA's revenue/scale thresholds, but the rights apply to ChurchPortalKit as a service vendor. Email privacy@churchportalkit.com to exercise yours.

Cookies

Marketing pages and the admin dashboard use a small number of first-party cookies for authentication and CSRF protection. We don't use third-party advertising or analytics cookies. The guest portal at /p/[slug] uses no cookies and no client-side JavaScript.

Contact

privacy@churchportalkit.com