Privacy & scope
Clarity about what MinistryBeacon is—and where it stops.
MinistryBeacon helps churches and small nonprofits build practical cybersecurity readiness through educational guidance. This page explains the kinds of information the service may receive, what it is used for, and what should stay out of the workspace.
The purpose
Practical readiness for the people doing the work.
MinistryBeacon turns everyday knowledge about people, systems, and processes into a shared readiness picture. The workspace can help a ministry team understand its current readiness score, choose useful next actions, prepare handovers, and keep educational policies and checklists moving.
The goal is a calmer, more informed conversation about cybersecurity readiness—not a demand to hand over the keys to the services your organization uses.
What may be in the workspace
Context that helps your team decide what to do next.
Account and contact details
If you create an account, the app stores account details and authentication records used for sign-in and sessions. Messages you send to a support inbox are handled separately from the app account database.
Organization and readiness information
A workspace may contain organization profile and settings, membership and role information, planning horizons, assessment answers and saved results, readiness scores, and dates associated with that work.
Assessment answers and scoring
When you submit an assessment, your answers are sent to MinistryBeacon to calculate a score. The scoring request returns a result without saving an assessment to your account. A separate authenticated Save action stores answers and the result in your organization workspace when you choose it.
Assessment report PDFs
A protected report endpoint renders a PDF from a saved assessment when an authorized organization member requests it. The app does not store a separate assessment-report PDF record.
Planning and technology context
You may add technology inventory and handover details, corrective actions, training progress, policy answers, generated policy content and stored policy PDFs, operational and offboarding checklist records, and free-text owner or assignee labels so your team can keep its plan current.
Technical and session context
Requests and sessions can include technical context needed to serve the workspace, maintain account access, limit abuse, and investigate service issues. The exact handling can depend on the hosting and account configuration in use.
AI-assisted policy drafting
When you request a generated policy, your answers and related workspace context are sent through the Polsia AI proxy to create the draft. Generated policy content and review decisions are part of the policy workspace workflow. The application does not establish the proxy’s downstream service, retention, training, or other use terms.
Emailed assessment summaries
If you request an assessment summary by email, the address you provide and the generated summary are sent through the Polsia email proxy for delivery. Account verification and password-reset messages also use that transactional email transport. The support inbox is a separate request channel. An emailed summary does not save the assessment as a workspace assessment.
Optional visitor analytics
If the deployment provides POLSIA_ANALYTICS_SLUG, the app mounts a Polsia visitor beacon. The beacon creates a UUID in browser localStorage or reuses the saved UUID, then sends it with the app slug to the configured Polsia beacon endpoint. The code does not establish whether production supplies the slug or the endpoint’s retention and downstream-use terms.
Selected rate-limit controls
The assessment summary email and PDF endpoints and the saved-assessment report PDF endpoint use per-window rate-limit counters stored by the app. A bucket key includes the endpoint scope and window, plus a SHA-256 digest derived from the endpoint scope and the first x-forwarded-for value, falling back to x-real-ip or unknown. Cleanup is attempted during limiter calls for buckets more than 24 configured windows old; this does not establish a guaranteed deletion deadline.
Payment and checkout records
If checkout is offered and enabled for a workspace, an authenticated route can create a hosted Stripe Checkout session through the Polsia payment proxy. The app stores organization-linked checkout-session and payment-event reconciliation metadata. Deployment configuration determines whether checkout is available; this code does not establish whether live payment is enabled or what card data is handled by the app or payment providers.
Security and administrative audit records
The app records selected organization security events and platform-administration actions. These records can document security-related activity and actions such as a protected workspace deletion.
We use this information to provide the assessment and workspace experience, maintain account access, show readiness and planning context, generate the reports or guidance you request, support the service, and process a checkout if one is available and requested.
If you choose to continue into account creation after completing an assessment, the browser session can temporarily carry those completed answers back to the assessment flow. Scoring and that account-creation handoff do not themselves create a saved assessment; use the authenticated Save action to store answers and results in the organization workspace.
The application's configured AI and email paths use Polsia services. The code does not establish downstream provider identity or terms for retention, training, processing location, or onward use. Review the current Polsia subprocessor disclosure for Polsia's own disclosures; it does not identify which provider handles a particular MinistryBeacon flow.
Retention and deletion
Keep active work available, then handle requests with care.
MinistryBeacon retains MinistryBeacon-controlled account and organization data while the account or workspace is active. For a verified deletion request, the target is to delete applicable MinistryBeacon-controlled active application data within 30 days, subject to identity and authority verification and records that must or reasonably need to be retained. This is a target, not an unconditional guarantee.
MinistryBeacon-controlled security and audit records have a normal 90-day retention target. They may be retained longer when reasonably necessary for an active investigation, fraud or abuse prevention, a dispute, or a legal obligation. Financial and payment-related records are retained as reasonably necessary for accounting, tax, fraud prevention, disputes, chargebacks, and legal or regulatory obligations.
Account deletion and workspace deletion have different effects. When eligible, the existing protected account-deletion operation removes the user account, related account and session rows, the user's organization memberships, and private unassigned assessment data. It does not automatically delete shared organization content. Some standalone authentication-verification records are not directly linked to a user in the app, so account deletion cannot be described as removing every authentication-related record.
An organization workspace is deleted only through the protected Platform Admin operation after exact-workspace confirmation. It removes that organization's application-owned profile and settings, memberships, planning horizons, saved assessments and answers, policies and stored policy PDFs, training progress, inventory and handover records, corrective actions, and operational and offboarding checklist data. Eligible user accounts are removed only when they have no other organization ownership or membership and no active platform-administrator assignment. Security and administrative audit records and financial/payment reconciliation records are kept under the retention purposes above. Deleting one account does not delete a shared workspace or another organization's data.
Rate-limit buckets have separate, short-lived, opportunistic cleanup based on 24 configured windows; that cleanup is not a 90-day schedule or a guaranteed deadline.
Provider-managed backups, infrastructure logs, and downstream systems are outside the app's direct deletion controls. MinistryBeacon cannot promise a fixed backup period, per-customer backup purge, immediate downstream deletion, zero AI retention, no model training, or a specific provider geography. The app's deletion behavior does not prove that deletion has propagated to those systems.
Privacy requests
Email the request with only the details needed to verify it.
Send privacy, access, correction, deletion, or general privacy requests to support@ministrybeacon.org. Requests are handled through email; the app has no self-service privacy-request queue. MinistryBeacon aims to acknowledge a request within 5 business days and complete it within 30 days. These are targets, not guarantees.
We ask only for enough account or organization information to locate and verify the request. We verify account identity and, before changing or deleting shared workspace data, verify that the requester has the required organization-owner or administrator authority. A member account request does not by itself authorize deletion of shared workspace records.
Never email passwords, MFA or recovery codes, keys, tokens, payment card information, or other secrets. For details about the product's educational limits, see the Product Scope page.
Keep secrets out
Readiness context is not a credential vault.
Keep secrets out of your workspace
MinistryBeacon is not a credential vault. Never enter passwords, API keys, private keys, MFA seeds, recovery codes, authentication or session tokens, payment card information, or other secrets. Describe the process or responsibility without sharing a secret value.
Use your approved secure process instead.
MinistryBeacon can help identify that a team needs an access review or a handover; it is not the place to paste the secret that would grant that access.
The right kind of help
Useful guidance, with honest boundaries.
MinistryBeacon provides educational guidance. It is not legal advice, an audit, audit certification, penetration testing, cyber-insurance approval, or a guarantee against incidents. A readiness score is a planning signal based on the information your team provides; it is not a legal or compliance determination.
Your organization remains in charge.
Review recommendations with the people responsible for your organization, its systems, its policies, and its legal or insurance decisions.
Questions about the scope?
Tell us what needs to be clearer.
For privacy, access, correction, deletion, or general privacy requests, email support@ministrybeacon.org. Include only enough non-secret account or organization information to locate and verify the request. MinistryBeacon aims to acknowledge requests within 5 business days and complete them within 30 days; these are targets, not guarantees. Identity and authority to change shared workspace data are verified before action. Never send passwords, MFA or recovery codes, keys, tokens, payment card information, or other secrets.
This page describes the product's current practices and boundaries in plain language. It is not legal advice or a substitute for advice specific to your organization.