This Privacy Policy explains how Cuanto Labs LLC, a Florida limited liability company that operates ShulMaker (“ShulMaker,” “we,” “our,” or “us”), collects, uses and shares personal information. It covers shulmaker.com, the ShulMaker platform, including the admin dashboard, the ShulMaker iOS app, the AI assistant, the WhatsApp assistant and the MCP connector (together, the “Service”).

1. Two Roles: Our Data and Your Congregation’s Data

• Where we decide (controller). We are responsible for the information we collect for our own purposes: visitors to shulmaker.com, people who request a demo or contact us, and the administrators, editors and billing contacts of the congregations that subscribe (“Customers”). This policy describes how we handle that information.
• Where the congregation decides (processor). Each congregation’s website and admin hold information about its members, donors, guests and visitors, such as newsletter subscribers, form submissions and appointment requests (“Congregant Data”). The congregation decides what to collect and why, and its own privacy notice, published at /policies on its site, applies. We process Congregant Data only on the congregation’s behalf and under its instructions, as described in our Terms of Service. If you are a member or visitor of a congregation, please contact the congregation first about your information, and we will help it respond.

2. Information We Collect

Information you give us

• Account and signup. Name, email address, password (stored only as a secure hash), the organization’s name, the subdomain you choose and your role.
• Demo requests and messages. Name, email address, phone number, organization, and anything you write when you request a demo or contact support.
• Billing. Plan, billing contact, billing address and subscription history. Card payments are entered directly with Stripe, and we never receive your full card number.
• Content. Pages, posts, calendars, forms, subscriber lists, appointments, photos and files you add to your site. Photos chosen in the iOS app are uploaded only to your congregation’s own media library.
• Assistant conversations. Messages, files and photos you send to the in-admin AI assistant or the WhatsApp assistant, the assistant’s replies, and, for WhatsApp, the sender’s phone number and display name and the group the message came from.

Information collected automatically

• Logs and security data. IP address, browser or device type, request details and timestamps, used to run and secure the Service and to enforce rate limits.
• Audit log. A record of administrative changes (who changed what, and when), so each congregation can see the history of its site.
• Product analytics. Usage of shulmaker.com and of the iOS admin app, described in Section 3.

We do not collect information about your contacts, precise location, health or finances, and we do not buy personal information from data brokers.

3. Cookies and Analytics

• Essential cookies. We use cookies to keep you signed in and to protect sign-in and form flows. The Service does not work without them.
• OnyxMetric. shulmaker.com uses OnyxMetric, a privacy-focused analytics service operated by Cuanto Labs, to count visits and understand how people find and use the site. The iOS admin app reports how its features are used to the same service, sent from our servers. OnyxMetric is the only analytics tool we use for our own purposes. It is not used for advertising and is not shared with ad networks.
• Congregation site statistics. Congregation websites include built-in visitor statistics so each congregation can see its own traffic. They use a first-party session cookie that lasts 30 days and store IP addresses only in hashed form. A congregation may also add its own Google Analytics account to its site, in which case its notice explains that use.
• No advertising. We do not use advertising cookies or cross-site tracking, we do not sell or share personal information for targeted advertising, and the iOS app contains no advertising or third-party analytics SDKs.

4. How We Use Information

• To provide the Service: host congregation websites, run the admin and the app, send transactional email such as password resets, form notifications and appointment confirmations, and calculate Shabbat and holiday times from the location the congregation configures, using our own servers.
• To run the assistants: generate answers and proposed changes, keep recent WhatsApp conversation context, and enforce daily usage limits.
• To bill: manage trials, subscriptions, invoices and failed payments.
• To support and improve: answer questions, fix problems, and understand which features are used, mostly through aggregated statistics.
• To communicate: send service and billing notices, and, if you opt in or have a business relationship with us, occasional product news, which you can unsubscribe from at any time.
• To keep the Service safe and meet legal obligations: prevent abuse and fraud, enforce our Terms, and keep records the law requires.

We do not sell personal information, and we do not use Customer content or Congregant Data to train AI models.

5. How We Share Information

We share personal information only with the service providers that help us run the Service, under contracts that limit their use of it to providing services to us, and in the limited cases below.

• Congregations. Information in a congregation’s site and admin is visible to that congregation’s authorized users.
• Legal and safety. When required by law or legal process, or when needed to protect the rights, property or safety of our users, the public or us.
• Business transfers. In a merger, acquisition or sale of assets, subject to this policy.
• With your direction. When you connect a third-party app, such as an AI client through the MCP connector, or ask us to share information.

Congregation websites and the content published on them are public by design. Admin accounts, subscriber lists, form submissions, appointment requests and audit logs are not.

6. Donations

ShulMaker does not process donations and never receives donors’ payment details. Donation pages on congregation sites link to or embed the payment provider the congregation chooses, such as Zeffy, and that provider’s privacy policy governs the information you give it.

7. The WhatsApp Assistant

The assistant only processes messages that mention or quote it, in groups a congregation has activated, and direct messages from phone numbers the congregation has approved. It does not read or store other messages in the group, and it does not process direct messages from numbers that are not approved. We keep the last 20 messages of each conversation as context, and a full history of assistant conversations so the congregation’s administrators can review what was asked and changed. The congregation can deactivate the assistant at any time. Messages travel through WhatsApp, and WhatsApp’s own privacy policy applies to its handling of them.

8. Data Retention

• Account and content: for as long as the congregation’s subscription is active. After a congregation leaves, we delete its data within 90 days of its request, and backups expire on their regular schedule.
• Assistant conversations: for as long as the congregation’s account is active, unless an administrator deletes them sooner.
• Billing records: 7 years, as tax and accounting law requires.
• Demo requests and leads that do not become customers: up to 3 years after our last contact.
• Logs and security data: typically up to 90 days, longer if needed to investigate an incident.

9. Security

We use encryption in transit, hashed passwords, role-based access controls, separation of each congregation’s data, rate limiting and audit logs. No system is perfectly secure, so we cannot guarantee absolute security, but we will notify affected customers and individuals of a breach as the law requires.

10. Your Rights and Choices

• Everyone. You can ask us for access to, a copy of, correction of or deletion of the personal information we hold about you as a controller, and you can unsubscribe from marketing email at any time using the link in each message. For information held for a congregation, we will forward your request to the congregation and help it respond.
• Europe and the United Kingdom (GDPR). We rely on performance of our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and legal obligations. You may also object to or restrict processing, withdraw consent, and complain to your local data protection authority. Information is processed in the United States, and where required we use the European Commission’s standard contractual clauses or another lawful transfer mechanism.
• California (CCPA). California residents have the right to know what personal information we collect, use and disclose, and to delete or correct it. We do not sell or share personal information for cross-context behavioral advertising, we do not use sensitive personal information to infer characteristics, and we will not discriminate against you for exercising your rights. In the past 12 months we have collected the categories described in Section 2 (identifiers, commercial information, internet activity and content you provide) for the purposes in Section 4, and disclosed them only to the service providers in Section 5.
• Florida and other states. Residents of Florida and other states with consumer privacy laws have the rights those laws provide, which may include access, correction, deletion, portability and opting out of sales, targeted advertising and profiling. We do not sell personal information or use it for targeted advertising. Where a state law gives you the right to appeal our decision on your request, you can do so by replying to our response.
• How to make a request. Email privacy@cuantolabs.com. We will verify your identity, which may require confirming your email address, and respond within 30 days, or sooner where the law requires. An authorized agent may make a request on your behalf with your written permission.

11. Children

The Service is designed for adults who manage a congregation’s website, and we do not knowingly collect personal information from children under 13 for our own purposes. Congregations are responsible for obtaining a parent’s consent before publishing or collecting information about children on their sites. If you believe we have collected information from a child in violation of this policy, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. We will post the new version here with a new date, and we will email Customers’ administrators before material changes take effect.

13. Contact Us