Effective date: October 24, 2026

St. Paul's Lutheran Church (“we,” “us,” or “our”) operates St. Paul's Website at https://stpaulsmilaca.org. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website, administrative services, account features, and connected streaming integrations.

Information We Collect

Depending on how you use the website, we may collect:

Account and contact information

• Name
• Email address
• Telephone number, if provided
• Login and account information
• Organization, church, or tenant information
• Information submitted through forms, membership features, support requests, or administrative tools

Streaming integration information

If an authorized tenant administrator connects a streaming provider, we may receive and store information necessary to operate that connection, including:

• Provider account, channel, page, or workspace identifiers
• Provider profile or account metadata returned during authorization
• OAuth access tokens and refresh tokens
• Provider application client information supplied by the tenant administrator
• Streaming destination and broadcast configuration information

Streaming credentials and tokens are encrypted when stored. We do not receive or store the user’s Facebook, Google, YouTube, Twitch, Vimeo, LinkedIn, or Restream password.

When a streaming provider is connected, we only request the permissions displayed during the provider authorization process. We use provider information only to establish and operate the connection requested by the authorized tenant administrator.

Payment and subscription information

If you purchase a subscription or other paid service, payment information is processed by our payment service provider, [Stripe or other provider]. We do not store complete payment card numbers on our own servers. We may receive limited billing information such as transaction status, subscription status, billing email address, and the last four digits of a payment card where provided by the payment processor.

Technical and usage information

We may automatically receive:

• IP address
• Browser and device type
• Operating system
• Pages or features visited
• Date and time of access
• Diagnostic, security, and error information
• Cookies and similar session technologies

We use this information to operate the website, maintain security, troubleshoot problems, and improve the service.

How We Use Information

We may use information to:

• Create and maintain user accounts
• Provide website, membership, administrative, and tenant services
• Authenticate users and protect accounts
• Process subscriptions and payments
• Respond to support requests
• Connect and manage authorized streaming-provider integrations
• Refresh or disconnect authorized OAuth connections
• Send service-related messages
• Detect fraud, abuse, and security threats
• Comply with legal obligations
• Maintain, improve, and secure the website

We do not use connected streaming-provider data to sell advertising or build unrelated advertising profiles.

How Streaming Integrations Work

A tenant administrator must initiate and approve each streaming-provider connection. The connection is tenant-specific and is not shared with other churches, organizations, or tenants.

For example, when a tenant administrator connects Facebook Live:

1. The administrator confirms that the tenant has created and configured its own Facebook/Meta developer application.
2. The administrator enters the tenant application credentials through the website’s secure setup flow.
3. Facebook/Meta asks the administrator to authorize the connection.
4. We receive the authorization response and store the resulting connection information for that tenant.
5. The tenant administrator may disconnect the integration from the Streaming settings page.

We do not use one organization’s provider account to authorize another organization’s streaming connection.

How We Share Information

We may share information with:

• Service providers that host, secure, maintain, or operate the website
• Payment processors when needed to process subscriptions
• Streaming providers when the tenant administrator explicitly authorizes an integration
• Professional advisers, auditors, or insurers where reasonably necessary
• Government authorities or other parties when required by law, legal process, or to protect rights and safety
• A successor organization if the website or related assets are transferred

We do not sell personal information.

Facebook and Meta Information

When a user authorizes a Facebook or Meta integration, we use the information returned by Meta only for the tenant-authorized streaming purposes described in this policy.

We do not request a user’s Meta password. Meta authentication occurs on Meta’s website. The user may revoke the application’s access through their Meta account settings or by disconnecting the integration through the tenant’s Streaming settings page.

Meta’s use of information is governed by Meta’s own policies and terms.

Cookies and Sessions

We use cookies and similar technologies to:

• Keep users signed in
• Maintain secure sessions
• Protect against unauthorized requests
• Remember necessary preferences
• Support website functionality

You may configure your browser to restrict cookies, but some website features may not work correctly.

Data Security

We use reasonable administrative, technical, and organizational safeguards to protect information. Sensitive provider credentials and OAuth tokens are encrypted when stored.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Data Retention

We retain information for as long as reasonably necessary to provide the service, maintain business and security records, comply with legal obligations, resolve disputes, and enforce agreements.

When a tenant disconnects a streaming provider, we remove the stored connection credentials and tokens associated with that integration, subject to legally required records and ordinary backup-retention periods.

Data Deletion Requests

You may request deletion of personal information associated with your account by contacting:

Email: [privacy email address]

Please include:

• Your name
• The email address associated with your account
• The organization or tenant associated with the account
• A description of the information you want deleted

We may need to verify your identity before completing a deletion request. We will respond within the period required by applicable law.

For a streaming integration, an authorized tenant administrator may also disconnect the provider from the Streaming settings page. Disconnecting removes the stored OAuth credentials and tokens for that tenant’s connection.

If you remove this website’s access from Facebook, Meta, Google, YouTube, or another provider, you may also contact us using the address above so we can identify and delete any remaining associated information.

Children’s Privacy

The website is not directed to children under [13/16, as applicable], and we do not knowingly collect personal information from children in that age group.

External Websites and Providers

The website may contain links to external websites and provider services. We are not responsible for the privacy practices, security, or content of external services. Review their privacy policies before providing information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will publish the updated version on this page and revise the effective date.

Contact Us

Questions about this Privacy Policy or a privacy request may be sent to:

St. Paul's Lutheran Church
13734 127th Ave, Milaca MN 56353
Email: privacy@stpaulsmilaca.org
Website: https://www.stpaulsmilaca.org