Privacy

Who we are

ChurchPortalKit.AI ("ChurchPortalKit", "we", "us") provides multi-tenant captive-portal software for churches. The captive portal is operated by each church ("your church", "the customer") on its own guest Wi-Fi network. ChurchPortalKit is the data processor; the church is the data controller for guest information collected via its branded portal.

Two audiences, two relationships

• Church admins who sign up for ChurchPortalKit. We hold your name + email (via Clerk for authentication), your billing info (via Stripe — we never see card numbers), and your portal configuration. We use it to run the service you're paying for.
• Guests connecting to a church's Wi-Fi. Their relationship is with the church, not with us. We process their data on the church's behalf and never repurpose it.

What guests submit (and why)

When a guest connects to a church's Wi-Fi and goes through a check-in portal, the church's configured form may ask for:

• First and last name
• Email address

We also automatically capture:

• The device's MAC address (passed by the router; required to authorize internet access)
• The access-point MAC, SSID name, and connection timestamp
• The IP address and User-Agent of the device making the request
• Whether the visitor matched an existing record in the church's Planning Center account

For SSIDs configured as "simple connect" (no form), only the network metadata (MAC, AP, SSID, timestamp) is recorded.

What we do with it

• Authorize the device on the church's router so it gets internet access. This is the entire reason the data is collected.
• Sync to Planning Center (if the church has connected PCO and enabled sync for the SSID). We look up the email; create a Person if new; add a note tagging the visit source.
• Display analytics to the church admin: total visits, first-time vs returning, weekly digests by email.

We do not: sell data, share it with advertisers, profile guests across churches, or use it to train models.

Retention

The church sets a retention window (default 365 days) under Branding settings. After that, visit records are soft-deleted and dropped from backups within 30 days. Tokens for PCO and encrypted UniFi credentials persist as long as the tenant is active.

Where data lives

• Application database (Postgres on Neon/Supabase, US region) — tenant config, visits, encrypted credentials
• Clerk (auth) — admin user accounts
• Stripe (payments) — billing only; no portal data
• Resend (transactional email) — outbound emails only
• Inngest (background jobs) — event payloads transit for retries
• Fly.io (hosting, primary region: SJC) — application runtime

Sensitive credentials (PCO refresh tokens, UniFi admin passwords) are AES-256-GCM encrypted at rest with a key held only by ChurchPortalKit. Rotating that key would invalidate every stored credential and require re-authorization — we keep it stable.

Guest rights

A guest who wants to know what a church holds about them, or wants their data deleted, should email the church directly. The church admin can:

• Export the relevant visit rows (CSV) from /dashboard/visits with email filter
• Remove individual rows on request (v0.1: through support; v0.2: in-dashboard)
• Set or shorten the tenant's retention window

California residents have rights under the CCPA. Most individual churches don't meet the CCPA's revenue/scale thresholds, but the rights apply to ChurchPortalKit as a service vendor. Email privacy@churchportalkit.com to exercise yours.

Cookies

Marketing pages and the admin dashboard use a small number of first-party cookies for authentication and CSRF protection. We don't use third-party advertising or analytics cookies. The guest portal at /p/[slug] uses no cookies and no client-side JavaScript.

Contact

privacy@churchportalkit.com