O Ecclesium

Draft pending legal review.

Privacy Policy

Last updated: October 19, 2026

This Privacy Policy explains how O Ecclesium, a simplified joint-stock company (SAS) organized under the laws of France (“O Ecclesium”, “we”, “us”), collects, uses, shares and protects personal information in connection with the O Ecclesium platform: the website o-ecclesium.com, the administration console used by parishes, and the parish websites, newsletters, booking and donation tools we host (together, the “Service”).

1. Who this policy covers

  • Parish users: pastors, staff and volunteers who administer a parish account.
  • Visitors and parishioners: people who visit a parish website hosted by us, subscribe to its newsletter, book a room, register for an activity, join its intranet or make a donation.
  • Prospects: people who visit o-ecclesium.com or request a demo.

For information that a parish collects through its own website (for example its subscriber list or booking requests), the parish decides why and how that information is used; O Ecclesium processes it on the parish’s behalf and under its instructions. Questions about a parish’s practices should be addressed to that parish first; we will assist it in responding.

2. Information we collect

Information you give us

  • Account information: name, e-mail address, password (stored only in hashed form), phone number, language and the parish you belong to.
  • Parish information: parish name, address, contact details, website content, Mass schedules, events, rooms, news and bulletins.
  • Subscriber and parishioner information: names, e-mail addresses and the messages, bookings, registrations and donations submitted through a parish website.
  • Payment information: handled by Stripe. We receive the status of a payment, the last four digits of the card and the billing name, never the full card number.
  • Demo requests and support messages: the details you send us, including your parish name, e-mail address and phone number.

Information collected automatically

  • Technical data: IP address, browser and device type, pages viewed, referring page, date and time of access, and error logs, as needed to run and secure the Service.
  • Usage analytics: we use PostHog (hosted in the European Union) and Vercel Analytics to understand how the administration console and our website are used. Session replays, where enabled, mask form inputs.
  • Anti-abuse checks: Cloudflare Turnstile verifies that sign-ups and public forms are submitted by people and not by automated scripts.
  • Cookies and similar technologies: we use cookies that are strictly necessary (session, security, language preference) and analytics cookies as described above. You can control cookies through your browser settings.

Information from third parties

  • Calendar synchronization: if a parish connects a Google Calendar, we read and write calendar events in the calendars it selects, solely to keep the parish schedule in sync.
  • Payment status: Stripe sends us the outcome of payments and subscription events.

3. How we use information

  • to provide, operate and secure the Service, including hosting parish websites and sending the newsletters, confirmations and receipts a parish asks us to send;
  • to manage accounts, subscriptions, billing and support;
  • to respond to demo requests and other inquiries;
  • to measure and improve the Service, fix errors and understand how features are used;
  • to detect, prevent and address abuse, fraud and security incidents;
  • to comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use it for advertising or share it with advertisers. We do not use the content of parish websites, newsletters or messages to train artificial-intelligence models.

4. Google user data

Where a parish connects a Google account for calendar synchronization, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access only the calendars the parish selects, use them only to synchronize parish events, do not transfer them to anyone else except as necessary to provide that feature or to comply with the law, and never use them for advertising. The parish may revoke our access at any time from the administration console or from its Google account settings.

5. How we share information

We share personal information only with:

  • Service providers that process it on our behalf under contracts that restrict their use of it: Vercel, Inc. (hosting and content delivery), Supabase, Inc. (database, authentication and file storage, in the European Union), Stripe, Inc. (payments), Resend, Inc. (e-mail delivery), PostHog, Inc. (analytics, European Union region), Cloudflare, Inc. (anti-abuse verification) and Google LLC (calendar synchronization, when enabled).
  • The parish whose website or tools you used: your messages, bookings, registrations, subscriptions and donations are visible to the administrators of that parish.
  • Authorities when required by law, by a court order or to protect the rights, safety and property of O Ecclesium, our users or the public.
  • A successor in the event of a merger, acquisition or sale of our business, who will be bound by this policy.

6. Where information is stored and international transfers

O Ecclesium is a French company and the Service’s database and files are hosted in the European Union. Some of our providers (for example Vercel, Stripe and Resend) operate in the United States and elsewhere. Personal information about people in the United States is therefore transferred to and processed in the European Union and may be processed in other countries by our providers. We rely on standard contractual safeguards with each provider, and we apply the protections of this policy wherever the information is processed.

7. How long we keep information

  • Account and parish data: for as long as the account is open, then deleted within 90 days of closure, except where the law requires longer retention.
  • Newsletter subscriptions: until you unsubscribe or the parish deletes you from its list; unsubscribe requests are kept so that we can honor them.
  • Billing records: for the period required by tax and accounting law (generally 10 years in France).
  • Technical logs and analytics: up to 12 months.
  • Backups: daily backups are retained for a limited rolling period and are overwritten in the ordinary course.

8. Security

We protect personal information with technical and organizational measures appropriate to the risk: encryption in transit (HTTPS) and at rest at our hosting providers, hashed passwords, role-based access and row-level security in the database, isolation between parishes, two-factor authentication for our own administrative access, daily backups, and security headers on all pages. No method of transmission or storage is completely secure; if we learn of a breach affecting your information, we will notify you and the relevant authorities as required by applicable law.

9. Your choices and rights

Whatever your state of residence, you may ask us to: access the personal information we hold about you; correct it; delete it; receive a copy in a portable format; restrict or object to certain processing; and withdraw a consent you gave. Residents of California, Virginia, Colorado, Connecticut, Utah and other states with consumer privacy laws have corresponding rights under those laws, including the right not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of in that respect.

  • Parish users can update most account information directly in the administration console.
  • Newsletter recipients can unsubscribe at any time through the link in each message.
  • For any other request, e-mail o-ecclesium@proton.me. We may need to verify your identity before acting. We respond within 45 days, or sooner where the law requires. You may appeal our decision by replying to our response.
  • Where a parish holds your information, we will forward your request to it and help it respond.

Our websites do not currently respond to “Do Not Track” browser signals. We honor Global Privacy Control signals where state law requires it.

10. Children

The Service is operated for parishes and their adult representatives. We do not knowingly collect personal information from children under 13 through o-ecclesium.com or the administration console. Parishes that collect information about minors through their own website (for example religious education registrations submitted by a parent) are responsible for obtaining any consent required by the Children’s Online Privacy Protection Act (COPPA) and other applicable laws. If you believe a child has given us personal information without parental consent, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows the latest revision. We will notify parish users of material changes by e-mail or in the administration console before they take effect.

12. Contact

O Ecclesium — o-ecclesium@proton.me. Our postal address and company details appear in the Legal Notice. The French Politique de Confidentialité applies to parishes in France.