Privacy Policy

Original Effective Date: May 11, 2026 · Revision Effective Date: November 6, 2026

Santo Mission Inc. (operating as Santo Catholic Mission)

Santo Mission Inc., operating as Santo Catholic Mission (“we”, “us”, “our”, or the “Company”), respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, share, and safeguard personal information when you access or use santomission.com, the Santo Catholic App (also “Santo App”), or any related product or service (collectively, the “Services”).

This Privacy Policy is governed by the Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector (Law 25). Where applicable to users in their respective jurisdictions, we also seek to comply with the European General Data Protection Regulation (GDPR), the United Kingdom Data Protection Act, and the privacy laws of certain United States states (including California, Colorado, Connecticut, Virginia, and others).

This Policy explains our information-handling practices. Where applicable law requires consent for a particular use of personal information or an optional communication, we will seek the required consent separately. Accepting this Privacy Policy does not, by itself, constitute express permission to receive promotional emails.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, password, and (optionally) profile photo and language preferences.
• Communication and notification preferences (email, SMS, push).
• Voluntary Offering and Membership information processed by our payment processors and the relevant Marketplace (we do not store full payment-card numbers on our systems).
• Private content you submit, including prayer intentions, journal entries, reflections, and AI Inputs (collectively, “Private Content”). Private Content is treated with additional care as described in Section 4 and Section 9.
• Information you submit through contact forms, surveys, or community features.
• Information provided by a parent or guardian for the consent of a minor (see Section 7).

1.2 Information Collected Automatically

• Device and technical information: device model, operating system, app version, browser type, language settings.
• Network information: IP address (which may be used to infer approximate, non-precise location for service-delivery purposes).
• Usage information: features used, sessions started, content viewed, prayer minutes, in-app navigation, dates and times of access.
• Push notification tokens (where you have enabled notifications on your device).
• Cookies and similar technologies on the website (see Section 6).

1.3 Information from Third Parties

• Third-party sign-in providers (such as Apple or Google), if you choose to sign in using a third-party account. We receive the limited profile information that provider makes available to us, in accordance with your settings.
• Payment processors and Marketplaces (Apple App Store, Google Play Store, Stripe, and other authorised processors) confirm transaction details and limited account information necessary to operate Memberships and process Voluntary Offerings.
• Public sources or referrals, where lawful and relevant to the Services.

2. How We Use Your Information

We use the personal information we collect to:

• Provide, operate, and maintain the Services, including delivering devotional content, prayers, multimedia, AI Features, and community features;
• Create and manage your Account and process Voluntary Offerings and Memberships;
• Send necessary account, security, payment, and legal communications, and optional devotional and promotional emails only where we have the required permission or another lawful basis;
• Personalize and improve the Services, including suggesting content relevant to your interests and language preferences;
• Operate AI Features, as further described in Section 4;
• Conduct aggregated and anonymized analytics to understand usage patterns and improve quality;
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms;
• Comply with legal, regulatory, audit, tax, and accounting obligations; and
• Establish, exercise, or defend legal claims.

3. Legal Bases for Processing

Where required by applicable law (including GDPR and Quebec Law 25), we rely on the following legal bases for processing your personal information:

• Performance of a contract: to provide the Services you have requested (such as your Membership or Account).
• Consent: for optional email communications where required, marketing, optional features, processing of Private Content, and information about minors where consent is required.
• Legitimate interests: to operate, secure, personalize, and improve the Services, provided such interests are not overridden by your rights.
• Legal obligation: to comply with applicable laws, regulations, and lawful requests.

4. AI Features and AI-Generated Content

The Services include AI Features that generate content automatically. When you use an AI Feature, the text or input you submit (“AI Input”) is processed by our AI systems and (where applicable) by third-party AI service providers under contract with us, to generate the requested AI Output. AI Inputs may include questions, intentions, or other text you submit, and may also include excerpts of devotional or scriptural content.

We treat AI Inputs as Private Content. We do not sell AI Inputs or AI Outputs, and we do not use AI Inputs or AI Outputs for behavioural advertising. Where AI Inputs or Outputs are used to improve the quality, safety, or doctrinal alignment of the AI Features, we do so on an aggregated and anonymized basis to the extent reasonably practicable.

Please remember that AI Output may be inaccurate, incomplete, or inconsistent with Catholic teaching, and is not magisterial or authoritative. Please consult your parish priest, spiritual director, or competent ecclesiastical authority for matters of doctrine or spiritual direction, and qualified professionals for medical, psychological, or legal advice.

5. How We Share Information

We share personal information only in the limited circumstances set out below:

5.1 Service Providers

We share information with third-party service providers under contract to provide hosting, infrastructure, customer support, email delivery, analytics, and similar services on our behalf. Service providers are required by contract to use personal information only as necessary to provide their services and to maintain reasonable security measures.

Our email-delivery providers include Amazon Simple Email Service (Amazon SES). We share email addresses and limited delivery metadata with these providers for authorized message delivery, authentication, bounce and complaint processing, unsubscribe management, and security. Providers may process information in countries outside your own, subject to Section 8.

5.2 Payment Processors and Marketplaces

Voluntary Offerings and Memberships are processed by third-party payment processors (such as Stripe) and, for In-App Memberships, by the Apple App Store or Google Play Store. These processors handle payment-card information directly and are bound by their own privacy policies and applicable card-industry standards.

5.3 Other Users (Community Features)

If you choose to use community or sharing features within the Services, the information you choose to share — such as your display name, profile photo, or shared prayer intentions — will be visible to the audience you select. You control what you share and with whom.

5.4 Legal and Regulatory

We may disclose personal information where we believe in good faith that disclosure is required to comply with applicable law, regulation, court order, or lawful government request, or to protect the rights, property, or safety of the Company, our users, or others.

5.5 Business Transactions

In connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our business or assets, we may share or transfer personal information to the relevant counterparty, subject to appropriate confidentiality and privacy commitments.

5.6 With Your Direction or Consent

We may share personal information with third parties at your direction or with your express consent.

5.7 We Do Not Sell Personal Information

We do not sell or rent your personal information. We do not share Private Content (journal entries, prayer intentions, AI Inputs) with advertising partners.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies to operate, secure, and analyse the Services. The Santo Catholic App generally does not use third-party tracking cookies for advertising. We use:

• Essential cookies — required for the website to function (for example, authentication and session management).
• Analytics cookies — to help us understand how visitors use the website on an aggregated basis (for example, Google Analytics or a similar provider).
• Preference cookies — to remember your settings and preferences.

You can control or disable non-essential cookies through your browser settings or, where available, through the cookie preference centre on the website. Disabling essential cookies may prevent the website from functioning correctly.

7. Children’s Privacy

We are committed to safeguarding children and respecting the responsibility of parents and legal guardians to direct the spiritual formation of their children. We do not knowingly collect personal information from minors below the age of digital consent in their jurisdiction without verifiable parental consent. The age of digital consent generally includes:

• Under 13 in the United States (Children’s Online Privacy Protection Act);
• Under 14 in the Province of Quebec, Canada;
• Under 16 in the European Union and United Kingdom (with lower thresholds in certain member states);
• Under 18 in India and in other jurisdictions that have set 18 as the threshold; and
• Under the local age of majority elsewhere.

If you are a parent or legal guardian and you believe that we may have collected personal information from a minor without proper consent, please contact us at hello@santomission.com and we will take prompt action to delete it. Parents and legal guardians may also request access to, correction of, or deletion of their child’s personal information by contacting us at the same address.

8. International Data Transfers

We are based in Canada. Our servers, service providers, and contractual partners may be located in Canada, the United States, the European Union, India, or other countries. When personal information is transferred outside the jurisdiction in which it was collected, we use appropriate safeguards, including contractual commitments with recipients to protect personal information in a manner consistent with applicable privacy laws.

If you are located in a jurisdiction outside Canada and use the Services, you acknowledge and consent that your personal information will be transferred to, processed in, and stored in Canada and other countries where our service providers operate.

9. Data Security and Retention

9.1 Security

We implement reasonable physical, technical, and organisational measures designed to protect personal information against unauthorised access, loss, alteration, and disclosure. These measures include encryption in transit (TLS) and, where appropriate, at rest, access controls, authentication, logging, and periodic security reviews. We treat Private Content with additional safeguards. No method of transmission or storage is completely secure; you are responsible for maintaining the confidentiality of your account credentials.

9.2 Retention

We retain personal information for as long as your Account is active, as needed to provide the Services, or as necessary to comply with our legal, financial, audit, accounting, security, and dispute-resolution obligations. Following Account deletion, we may retain limited information for a reasonable period to satisfy legal, regulatory, or fraud-prevention requirements, or in anonymized or aggregated form that does not identify you. Voluntary Offering and Membership records may be retained for periods required under applicable financial, tax, and accounting laws.

We may retain a minimal record of unsubscribe requests, communication preferences, consent evidence, hard bounces, or spam complaints as reasonably necessary to prevent unwanted communications and meet legal obligations, even after other account information is deleted.

9.3 Aggregated and Anonymized Information

We may create aggregated, de-identified, or anonymized information from personal information and use such information for any lawful purpose, including to improve the Services and our mission, provided such information cannot reasonably be used to identify you.

10. Your Privacy Rights

Depending on the jurisdiction in which you reside and subject to applicable law and reasonable verification, you may have the following rights:

• Access — request confirmation of, or a copy of, the personal information we hold about you;
• Correction — request that inaccurate or incomplete information be corrected;
• Deletion — request that we delete your personal information, subject to limited legal exceptions;
• Withdrawal of consent — withdraw any consent you have given for processing based on consent;
• Portability — request a copy of certain personal information in a structured, machine-readable format, where technically feasible;
• Objection or restriction — object to or request restriction of certain processing activities;
• Lodge a complaint — file a complaint with the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or another competent supervisory authority in your jurisdiction; and
• Information regarding automated decision-making — request information about, and to object to, any solely automated decisions producing legal or similarly significant effects (we generally do not make such decisions through the Services).

To exercise any of these rights, please contact our Privacy Officer at hello@santomission.com with the subject line “Privacy Request”. We may require reasonable information to verify your identity before responding to your request. We will respond within the time periods required by applicable law. We will not discriminate against you for exercising your rights.

11. Email Communications, Sending Permission and Subscription Preferences

11.1 Types of Email We Send

Santo Mission may use your email address for the following categories of communications:

• Account and service messages: Account registration and verification, password resets, security notices, payment receipts, membership administration, and material service or legal notices necessary for our relationship with you.
• Devotional and spiritual messages: Daily Bible verses, prayers, Catholic reflections, liturgical celebrations, spiritual resources, and related faith-based content.
• Mission updates and promotional messages: News about Santo Mission, app features, events, campaigns, membership plans, discounts, paid subscriptions, and other promotional opportunities.

An email containing devotional content may also be promotional if it advertises or encourages a commercial transaction. We evaluate communications according to their content and applicable law.

11.2 Permission to Send Email

Providing an email address, creating an account, signing in through Apple or Google, or accepting our Terms and Conditions or this Privacy Policy does not, by itself, constitute express consent to receive optional promotional emails.

We send account and service messages when necessary to provide requested services, manage transactions, protect accounts, or meet legal obligations. These messages are distinct from optional devotional or marketing communications.

For optional devotional and promotional emails, we will obtain consent where required by applicable law or send them only where another valid legal basis or exemption applies. When express consent is required, we will seek a clear affirmative choice that is separate from acceptance of general Terms and this Privacy Policy. Declining optional communications will not prevent registration or use of the core Services.

Our current app registration requires acceptance of the Terms and Privacy Policy but does not provide a separate optional email-subscription checkbox. We do not treat that acceptance alone as proof of express promotional-email consent. We are reviewing existing recipient records and improving how communication preferences and evidence of consent are captured. Any new optional-email preferences will apply as they are made available.

11.3 Consent and Preference Records

Where appropriate, we may record your email address, communication category, permission status, consent source, applicable notice version, date and time of consent, and date and time of withdrawal. We use these records to respect user preferences, determine recipient eligibility, and demonstrate compliance with applicable laws.

11.4 Unsubscribe and Withdrawal

You may stop receiving optional devotional and promotional emails by using the unsubscribe link provided in those messages or by emailing hello@santomission.com. Where available, you may also update preferences through the Services. We honor unsubscribe requests without unreasonable delay and within applicable statutory deadlines. We do not require payment or account login to process an email unsubscribe request.

Stopping optional communications does not prevent necessary account, security, transaction, legal, or other service-related notices. We do not include unrelated promotional content in an otherwise necessary service message in order to avoid an unsubscribe preference.

11.5 Email Delivery, Suppression and Service Providers

We use third-party delivery services, including Amazon Simple Email Service (Amazon SES), to send authorized email. These providers process email addresses and limited technical information needed for delivery, authentication, bounce handling, complaints, and unsubscribe processing.

We use unsubscribe records and suppression controls to reduce unwanted sending. Addresses associated with permanent delivery failures, complaints, or withdrawal of applicable permission may be excluded from further optional emails. A limited suppression record may be retained so we do not inadvertently contact someone who has opted out.

For users who choose Sign in with Apple and Hide My Email, messages may be sent to the private relay address provided by Apple, subject to Apple’s relay controls and your applicable communication preferences.

11.6 SMS, Push Notifications and Applicable Laws

If we offer SMS or push communications, they are subject to applicable consent requirements and available device or service preferences. You may generally disable push notifications in your device settings and opt out of eligible SMS marketing by following the message instructions.

We seek to comply with Canada’s Anti-Spam Legislation (CASL) and other applicable electronic-communications and privacy requirements. Where messages qualify as commercial electronic messages, we apply the applicable consent, sender-identification, and unsubscribe rules.

11.7 Questions About Email Permission

To ask about your email permissions, withdraw consent, or report unwanted communications, contact hello@santomission.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will identify the revision date and provide any notice required by applicable law. Material changes affecting consent-dependent processing will not be used to assume new consent merely because you continue using the Services.

13. Contact and Privacy Officer

We have designated a Privacy Officer responsible for our compliance with applicable privacy laws, including Quebec’s Law 25. You may contact our Privacy Officer with any questions, requests, or concerns regarding this Privacy Policy or the handling of your personal information.

Santo Mission Inc. (operating as Santo Catholic Mission)

Attention: Privacy Officer

Suite 2020, Tower 1, 10060 Jasper Avenue
Edmonton, Alberta, Canada T5J 3R8
Email: hello@santomission.com (subject: Privacy Request)
Website: https://santomission.com

Thank you for trusting us with your personal information.