A clear view of your data.

Information the beta stores

• Waitlist: email address, optional name and church or organization, contact-consent version, and signup time. These are used for future availability follow-up, not to create an account. Waitlist entries are private to the platform operator and are included in private operational recovery copies. Automatic email delivery is not connected. Request removal at hello@wisenerventures.com.
• Accounts: name, email address, church or organization name, organization type, selected denomination, assigned role, password hash, session records, and account/access history.
• Church records: accounting entries, offering counts, giving details, donor and household contacts, budgets, bank CSV files, supporting documents, notes, reviews, and correction history that authorized people enter.
• Account protection: verification and recovery status, protected token records, and related security events. Password recovery and MFA backup codes are stored as hashes rather than readable codes. Optional authenticator enrollment stores a secret encrypted with a separate runtime key, the last accepted code counter, and security status. Pending setup and sign-in challenges expire.
• Acceptance and requests: accepted policy versions and time, optional denomination setup requests and contact details saved for later follow-up, and information you send for support. Denomination requests are not emailed while email delivery is disconnected. Abuse protection uses a hashed IP-based identifier and attempt counters; hosting providers may separately process request and security logs.

Giving can reveal religious affiliation and private circumstances. Add only information your church is authorized to use and needs for these workflows. Do not upload Social Security numbers, full payment-card or bank account numbers, bank login credentials, payroll tax records, medical information, confidential pastoral-care records, or images containing those details. Redact check images and statements before attaching them.

How information is used

Records provide church accounting and giving tools, identify users, enforce access, preserve review history, generate reports and exports, protect accounts, and support fault or security investigations. Signup and invitation acceptance record the applicable policy versions and beta acknowledgment.

The beta does not include selling church records, targeted advertising, or advertising trackers. It does not connect to a bank, move money, run payroll, or automatically send email.

Who can access records

Public new-church signup is paused; joining the waitlist grants no workspace access. Existing church workspaces remain separate. Invited people join that church with assigned roles and approved exceptions. Your church’s authorized account managers control invitations and access. Master Administrator access allows all available activities within that church.

Notes, documents, donor profiles, and insights are visible to the roles that can open those features. Avoid general notes for confidential conversations. Exports and printed reports can be copied outside the app; the person downloading them is responsible for storing and sharing them appropriately.

Hosting providers process data to run the service. Authorized service maintainers may need operational access to investigate faults or security incidents. Information may also need to be disclosed when legally required. Account permissions do not remove this operational access.

Hosting, cookies, and connections

StewardLift runs on Sites hosting and Cloudflare infrastructure. Account and workspace records are stored in Cloudflare D1; supporting files and original imports are stored in Cloudflare R2. The service remains hosted when your computer is off. This beta does not provide a choice of storage region or a published data residency guarantee.

A protected session cookie keeps you signed in for up to eight hours. A separate protected cookie binds an MFA sign-in challenge to your browser for up to five minutes. Passwords are salted and hashed, and repeated login and signup attempts are limited. Hosting services may use additional security cookies and request information. These controls reduce risk; they do not guarantee security or availability.

If you use ZIP lookup, only the ZIP is sent to Zippopotam.us to suggest city and state. Donor names and street addresses are not sent for that lookup. External guidance links open other organizations’ websites, which have their own policies.

Verification, MFA, and password recovery

You can enable two-step sign-in using an authenticator app. Setup QR codes are generated within the service; no external QR service receives your secret. MFA backup codes work once with your password. Turning MFA off or replacing its codes requires your current password and an existing factor, and signs out every session. Security changes are recorded in your account history and in-app notices; no automatic email notification is sent. Password reset preserves MFA. If your authenticator and all MFA backup codes are lost, there is no automatic or administrator bypass; contact support, and access cannot be guaranteed.

Automatic email delivery is not connected. An account manager manually sends the email-bound verification link to the saved mailbox; the recipient then confirms it. Generating a link or an administrator’s identity check alone does not verify an email address. A recovery code proves possession of that code; it does not prove ownership of an email address. Keep it private and store it away from your password.

An authorized church account manager can issue a private verification link. A Master Administrator can issue a private password-recovery link after checking the person through a trusted, separate method. Never post invitation, recovery, or verification links in public. Changing your password invalidates saved recovery codes and outstanding links; save the replacement code when one is offered.

Retention, exports, and corrections

Workspace records and attached files remain stored while the beta hosts the workspace; there is currently no automatic deletion schedule. Corrections preserve original financial and review history. Disabling a user ends access but does not delete their recorded actions or church records.

Authorized users can download reports and complete workspace exports, including documents. Export downloads do not delete hosted records. Private operational recovery copies contain workspace data, account password hashes, encrypted authenticator enrollment, hashed MFA backup codes and replay state, access history, supporting documents, and original imports. Completed copies are retained without automatic deletion during this beta; deletion requests may require separate handling of recovery copies. Active sessions and temporary invitation, verification, and reset links are not restored. The separate MFA encryption key is required to recover enrolled accounts. Custodian recovery tooling can seal it to a pinned public key; the encrypted private kit and separate recovery code belong offline with chosen custodians. No live key export occurs before custodian configuration. Encrypted recovery capsules are separate from ordinary church exports; a trusted receipt and an off-provider copy are needed for disaster recovery. This system does not bypass a person’s MFA or expose an automatic live restore. Only authorized service operators can access these copies. Self-service workspace deletion and in-app live restoration are not available. Maintain independent copies and verify that exports are complete.

For donor or household corrections, first contact your church’s account manager. For service-level access, deletion, retention, or privacy requests, contact Wisener Ventures LLC at the address above. Requests require identity and authority checks; audit history and records your church must retain may need different handling. A specific retention period, deletion deadline, or restoration service is not promised by this beta.

Your choices and policy changes

Use real records only with church authorization, retain your separate official books, and reconcile both systems during beta testing. You can stop adding records, export information you may access, and ask your church’s account manager to disable your account.

Privacy rights and church recordkeeping duties depend on the circumstances and applicable law. This policy does not remove those rights or duties. Revisions carry an effective date and version; acceptance history identifies the version presented when an account is created or an invitation is accepted.