BibloriDraft · not legally reviewed
Privacy notice
Last updated 7 August 2026
This describes how Biblori handles data today. It has not been reviewed by counsel and is not yet a contract. Sacramental records carry obligations most software never touches, and this page will be replaced by a reviewed notice before we rely on it.
What we hold
Your identity as a user — name, the email address you sign in with, and which parish or diocese you belong to. Everything your parish enters: sacramental register entries, the people they name, marriage cases, notations, and the content of your public website. Messages between a parish and a couple. Operational records like audit entries and, if you subscribe, billing metadata.
Records about other people
Most of what a parish stores here is not about the person using it. A baptismal entry names an infant, their parents, and their godparents. A marriage record names two people and their witnesses. These entries reveal religious affiliation, which most privacy law treats as a special category needing greater care, and many concern children.
The parish is the custodian of its register and decides what goes in it; Biblori processes that data on the parish's instructions. Requests from a named individual about their own entry should go to their parish, which holds the canonical record — though we will help the parish answer.
The parish is the custodian of its register and decides what goes in it; Biblori processes that data on the parish's instructions. Requests from a named individual about their own entry should go to their parish, which holds the canonical record — though we will help the parish answer.
Who processes it for us
- Supabase — database, authentication and file storage, in a United States region.
- Vercel — application hosting and delivery.
- Stripe — subscriptions and payments. Card and bank details go to Stripe directly; Biblori never receives or stores them.
- Resend — transactional email such as invitations and reminders.
- OpenRouter, and the model provider it routes to — see the register scanner below.
The register scanner
When you photograph a page of a sacramental register, that image is sent to a third-party AI provider so the fields can be read back for you to check. The image is of the register itself, so it contains whatever the page contains — names, dates, parents, godparents.
We do not use those images to train anything ourselves. What the model provider may do with them is governed by their own terms, which is why the scanner is optional and why a parish that would rather not send register images anywhere can type entries in by hand and lose no other functionality.
We keep the photograph once you save the record. It is stored privately, and it stays attached to that record as its source — so a name that later looks wrong can be checked against the page it was read from, and so the entry survives if the parish's own book does not. This is a change: until August 2026 we discarded these images immediately after reading them.
Because a photograph of a register page also shows the entries above and below it — other families' names, parents and godparents — it is held to a stricter rule than the record it belongs to. Only parish staff who can write records can view it, not everyone who can read the register. If you photograph a page and never save a record from it, the image is deleted within a day.
We do not use those images to train anything ourselves. What the model provider may do with them is governed by their own terms, which is why the scanner is optional and why a parish that would rather not send register images anywhere can type entries in by hand and lose no other functionality.
We keep the photograph once you save the record. It is stored privately, and it stays attached to that record as its source — so a name that later looks wrong can be checked against the page it was read from, and so the entry survives if the parish's own book does not. This is a change: until August 2026 we discarded these images immediately after reading them.
Because a photograph of a register page also shows the entries above and below it — other families' names, parents and godparents — it is held to a stricter rule than the record it belongs to. Only parish staff who can write records can view it, not everyone who can read the register. If you photograph a page and never save a record from it, the image is deleted within a day.
What we do not do
No advertising, no analytics brokers, no selling or sharing of personal data, no profiling of parishioners. We do not read your email or calendar; signing in with Google gives us your identity and nothing else.
Who can see your records
Members of your parish. Diocesan administrators can see the parishes in their diocese. Biblori staff have technical access and use it to answer a support request or investigate an incident — administrative actions are recorded in an audit log your diocese can read.
Retention, and what we will not do with it
Sacramental registers are canonical records with retention obligations that outlive any software contract, so we do not delete them on a schedule of our own choosing. A parish can export its register at any time.
We will not withhold a parish's records — or the certificates issued from them — over an unpaid invoice, a lapsed subscription, or a billing dispute. That is a design commitment, not a courtesy: the software cannot revoke access to a register.
We will not withhold a parish's records — or the certificates issued from them — over an unpaid invoice, a lapsed subscription, or a billing dispute. That is a design commitment, not a courtesy: the software cannot revoke access to a register.
Deletion
You can ask us to delete your user account at any time. Deleting the parish's records is the parish's decision and may be constrained by canonical retention — we will work with you and your diocese rather than decide unilaterally.
Contact
Questions, or a request about your own data, to privacy@biblori.com.