Legal
Privacy Policy
We designed MinistryHarbor for pastoral care, responsible stewardship, and privacy-first church operations.
Effective September 11, 2026
1. Who controls your data
Each church controls the personal information it enters or collects through its workspace. MinistryHarbor processes that information to provide the platform. Questions about a church's use of your information should first be directed to that church. Platform privacy questions may be submitted through MinistryHarbor support.
2. Information we process
Depending on how a church or prospective customer uses the service, information may include workspace and administrator details; walkthrough requests and business contact details; visitor and member contact information; attendance, volunteer, membership, and pastoral-care records; prayer requests; communication consent; employee records; giving participation and contribution history; campaigns, messages, approvals, imports, support tickets, integration credentials, and audit events.
3. Sources and purposes
Information comes from workspace users, walkthrough request forms, public prayer forms, imports chosen by administrators, connected services, communication providers, subscription providers, and normal service logs. We process it to respond to requested product inquiries, operate church workspaces, provide CRM and ministry workflows, generate user-requested AI drafts, coordinate approved communications, maintain integrations, process subscriptions, prevent abuse, provide support, and improve reliability.
4. AI and human approval
Authorized users may provide ministry context to AI services to generate drafts and recommendations. AI output is not automatically published. A church user must review and approve external content before it is sent or posted. Churches should not place unnecessary sensitive details in AI prompts.
5. Communications and consent
Churches are responsible for recording and honoring email, SMS, and WhatsApp consent, opt-outs, suppression requests, and applicable communication laws. WhatsApp campaigns select only contacts with recorded WhatsApp permission and use approved templates when required. MinistryHarbor's workflow does not itself establish a lawful basis to contact someone.
6. Service providers and integrations
Information is disclosed only as needed to configured infrastructure and service providers, which may include hosting, database, AI, billing, email, SMS, WhatsApp, Microsoft 365, and social-media providers. Connected providers process information under their own terms and privacy policies. We may also disclose information when legally required or necessary to protect people, rights, and service security. MinistryHarbor does not sell church, member, visitor, prayer, or donor data or use it for cross-context behavioral advertising.
7. Security and access
We use tenant isolation, role-based access, approval controls, audit logging, encrypted transport, and restricted credential handling as part of a defense-in-depth program. No online service can promise absolute security. Churches must assign least-privilege roles, enable available MFA for sensitive access, protect administrator accounts, and promptly remove access that is no longer needed.
8. Retention, export, and deletion
Workspace administrators can request data export or deletion and configure retention where available. We retain information while needed to provide the workspace and for legitimate security, audit, billing, legal, tax, dispute-resolution, or backup purposes. Retention needs vary by record type; churches remain responsible for legal retention of contribution, employment, safeguarding, and pastoral records.
9. Individual rights
Depending on location, individuals may have rights to access, correct, export, restrict, object to, or delete personal information. Submit requests to the church that collected the information or open a MinistryHarbor support request. We may verify identity and authority before acting.
10. Giving, prayer, and other sensitive records
Giving amounts are intended for authorized finance and administrator roles and are not exposed to campaign writers without permission. Prayer requests and pastoral notes should be limited to what is necessary and available only to people with a ministry need to know. These records are not used to generate coercive fundraising messages.
11. Children
MinistryHarbor is provided to churches and authorized adult administrators, not directly to children. Churches must obtain appropriate parental or guardian permission and apply safeguarding policies before entering children's information. The platform should not be used to collect more information about a child than the ministry purpose requires.
12. Cookies and service logs
MinistryHarbor may use essential cookies or equivalent storage for authentication, security, preferences, and reliable operation. Service logs may include device, browser, network, request, error, and audit information. We do not describe optional advertising cookies as active unless they are actually deployed.
13. International processing
Connected providers and infrastructure may process information in countries other than the church's location. Where applicable, MinistryHarbor and its providers use legally recognized safeguards for international transfers. Churches should review the location and terms of integrations they choose to connect.
14. Security incidents
We investigate suspected unauthorized access and will notify affected workspace administrators when required by applicable law. Churches should report suspected incidents promptly through authenticated Support and preserve relevant account and audit information.
15. Policy changes and questions
We may update this policy as the service or law changes. Material changes will be communicated in the service or through an administrator's registered contact channel before they take effect when required. Authenticated workspace users may submit privacy questions and requests through the in-app Support page.