Privacy Policy

Loreto Sites is a website platform for parishes, schools, ministries, and related organizations. “Loreto,” “we,” “us,” and “our” mean Loreto Media LLC, 501 S Midvale Blvd, Madison, WI 53711.

Loreto acts as a business or controller for account, billing, support, security, product-use, and Loreto marketing information. “Personal information” means information that identifies, relates to, describes, or can reasonably be linked to a person. Aggregate or deidentified information that cannot reasonably identify a person is not personal information. A Customer decides how its Customer Site collects and uses visitor information. For Customer Site content and form submissions, Loreto acts as the Customer’s service provider or processor under the Data Processing Addendum. The Customer’s privacy policy controls its own use of that information.

Account and organization information. We collect names, email addresses, authentication records, organization names, roles, permissions, invitations, account status, verification events, and support history.

Customer Content. We store pages, text, logos, images, video and audio links, bulletins, schedules, events, locations, staff and school details, search and social settings, domains, redirects, form settings, publication versions, and review notes that a Customer or its users submit.

Customer Site visitor information. A Customer Site may collect names, email addresses, phone numbers, free-text answers, selections, and other fields that the Customer configures in a form. Loreto stores the response, sends it to the recipients selected by the Customer, and may send a copy to the person who submitted it when the Customer enables that option.

Payments and support. Stripe provides payment and subscription processing. We receive Stripe customer and subscription identifiers, plan, billing interval, payment status, invoice and tax information, and related support records. We do not store full payment-card numbers.

Technical and usage information. We collect IP address, browser and device details, security and App Check signals, log events, pages and actions in the product, timestamps, referral information, diagnostic details, and information about errors or abuse.

Imported and public information. When a Customer asks us to scan or import a website, we may collect public pages, documents, images, links, source URLs, screenshots, and related archive records. The Customer must have authority to request that work.

Communications. We collect information in demo requests, support messages, import notices, billing messages, form notices, and email delivery records.

We receive information from the person who provides it, a Customer and its users, a browser or device, public websites that a Customer asks us to scan, and service providers such as Firebase, Stripe, SendGrid, Vercel, Cloudflare, and security tools.

We use information to create and secure accounts; provide, host, publish, support, and improve the Services; process imports and requested automated features; store Customer Content; deliver form and service email; operate domains and deployments; manage billing; provide analytics; troubleshoot; prevent fraud and abuse; protect people and systems; communicate about the Service; and meet legal obligations. We may send account, billing, security, support, and service messages, and we provide an unsubscribe method for email communications that are not needed to operate the Services.

We use Customer Content only for the Customer’s requested Services, security, support, and aggregate service statistics. We do not use Customer Content for public marketing without permission, sell personal information, share it for cross-context behavioral advertising, or use it to train a general-purpose model.

We disclose information to providers that perform services for Loreto, including:

• Firebase and Google Cloud for authentication, database, storage, security, hosting support, logs, and diagnostics;
• Vercel and Cloudflare when used for hosting, deployments, domains, edge delivery, certificates, or security;
• Stripe for subscriptions, billing, invoices, tax details, and payment fraud controls;
• SendGrid for service, form, support, and import email;
• Firecrawl for website scanning, document extraction, or import recovery when that feature uses it;
• OpenAI, xAI/Grok, or Google Gemini when a configured automated feature sends requested content for classification, drafting, review, support, or extraction; and
• Vercel Analytics and Vercel Speed Insights for product and public-site analytics.

We may disclose information to professional advisers, a successor in a merger, reorganization, financing, sale, bankruptcy, or similar business transfer, law enforcement or courts when required, or another party when needed to protect the rights, safety, property, and security of Loreto, Customers, visitors, or others. A successor may continue handling information under this Policy or another notice that law permits. Our current named subprocessors appear on the Subprocessors page.

Some requested features use automated systems to read public source material, extract information, review content, prepare drafts, classify pages, summarize documents, answer support questions, or suggest changes. Inputs may include Customer Content, public website material, uploaded documents, images, and a support conversation.

We send the content needed for the requested feature to the provider listed for that feature on the Subprocessors page. Loreto does not use Customer Content to train a general-purpose model. A draft, suggestion, classification, or summary can be wrong or incomplete, and Customer must review it before publishing or relying on it.

Customers must not send passwords, payment-card numbers, health records, student records, government identification numbers, confession records, or other sensitive information to an automated workflow unless the Customer has a lawful need, the required authority and notices, and a written agreement with Loreto that permits it. Contact support@loretosites.com before sending such information to ask whether the proposed workflow is approved. Loreto may require additional written terms or safeguards, or decline the workflow.

Customer Site visitors should read the Customer’s privacy policy before submitting a form. The Customer decides what a form asks, who receives the response, how long it keeps the response, and how it answers a privacy request. Loreto may route a request to the Customer because the Customer controls that information.

Customers must provide a notice at or before collection, link to their privacy policy, identify the Customer as the recipient, collect only needed information, and use the form in a lawful way. Customer Sites may include third-party maps, videos, calendars, donation tools, analytics, or embeds that collect information under their own notices.

We use necessary cookies and local storage for sign-in, security, preferences, fraud prevention, forms, and service operation. Loreto's own site uses Vercel Analytics, Vercel Speed Insights, and a homepage copy experiment without a visitor-facing consent popup. We do not use Google Analytics 4, advertising, or retargeting pixels on Loreto's own site. See the Cookie Policy for the experiment key, duration, and available browser or provider controls.

See the Cookie Policy for provider details. Customers are responsible for notices and choices for third-party tools that they add to a Customer Site.

Loreto Sites is for organizational users and is not directed to children. We do not knowingly create platform accounts for children under 13. A Customer Site may be viewed by families, students, or children, but the Customer controls that audience and the information its forms collect.

School and youth-serving Customers must obtain required parent, guardian, student, school, and organizational permissions; follow COPPA, FERPA, state student privacy laws, and their own notices; limit access; and avoid unnecessary child, student, sacramental, health, financial, or other sensitive information. Loreto will process such Customer Data only under Customer instructions and the Data Processing Addendum.

We keep information for the period needed to provide the Services, keep accounts and sites working, complete a transaction, answer support requests, protect security, resolve disputes, enforce agreements, comply with law, maintain backups, and keep required business records.

Customer may export available site data through the Service or request help at support@loretosites.com. Customer may request deletion through the account tools or by email. Loreto will handle Customer Data under the Data Processing Addendum. Deletion requests do not erase information that must remain for billing, security, fraud prevention, legal, audit, backup, or dispute purposes, and deletion from those systems may follow their normal cycles.

We use safeguards designed to protect information, including role-based access, authentication boundaries, secure transport, input validation, rate limits, monitoring, provider security controls, and access records. No system or transmission method is perfectly secure.

Customers must use strong passwords, limit user access, review roles, protect exported data, and report suspected security issues promptly to support@loretosites.com.

Depending on where you live and whether a privacy law applies, you may have the right to know about, access, correct, delete, or receive a copy of personal information; limit certain uses of sensitive information; object to or restrict processing; appeal a decision; and opt out of sale, sharing, targeted advertising, or certain profiling. We do not sell or share personal information for cross-context behavioral advertising.

Send a request to support@loretosites.com. Include enough information for us to verify your identity and understand the request. You may use an authorized agent when law permits. We will not discriminate against you for exercising a privacy right. You may unsubscribe from nonessential email through its unsubscribe link or by contacting support; necessary service, security, billing, and legal messages may still be sent. A request about a Customer Site may need to go to the Customer, and we will assist the Customer under the Data Processing Addendum.

Loreto Media LLC operates from the United States. Information may be processed in the United States and in other locations where our service providers operate. Customers that send personal information from another country must give the notices and obtain the permissions required for that transfer and use the written data terms that apply to the relationship.

We will notify affected people or Customers of a security breach when applicable law requires us to do so. We may retain information in logs, backups, and records for the periods described in this Policy and the Data Processing Addendum.

We may update this Policy when the Services, law, or data practices change. We will post the new version, update the date above, and give additional notice for a material change when appropriate.

Effective date: August 17, 2026. Privacy version: 2026-08-17.

Questions, requests, and security reports may be sent to support@loretosites.com or Loreto Media LLC, 501 S Midvale Blvd, Madison, WI 53711, or by phone at (608) 285-2027.