Privacy Policy

Effective date: July 30, 2026  ·  Last updated: July 30, 2026

The Loving Lunch Project ("Loving Lunch Project," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect through lovinglunchproject.org, why we collect it, who we share it with, and the choices you have. Please read it alongside our Terms & Conditions.

1. Who we are

The Loving Lunch Project is a 501(c)(3) non-profit organization based in Cedar City, Utah, providing free weekend and school-break meals to children in Iron County. We are the merchant of record for donations made through this site and the party responsible for the personal information described in this policy.

2. Information we collect

We only collect information that you choose to give us, plus limited technical information created automatically when you visit the site.

Information you give us

• When you make a donation: your first and last name, email address, and billing street address, city, state and ZIP code, together with the donation amount in USD and whether the gift is one-time or monthly.
• When you use our contact form: your first and last name, email address, phone number (optional), the subject you select, and the content of your message.
• When you sign up to volunteer: your first and last name, email address, phone number, your area of interest, and anything you choose to tell us about yourself.
• When you email or call us: whatever information you include in your message or conversation.

Information collected automatically

• Standard server and security log data such as your IP address, browser type, device type, the pages you visited, and the date and time of your visit.
• Cookies and similar technologies as described in section 8 below.

We do not ask for and do not want sensitive personal information such as government identification numbers, health information, or financial account details other than what is strictly needed to process a donation.

3. Payment card data

Our payment gateway and acquiring bank process your payment information as independent parties, under their own privacy and security programs and under the operating rules of Visa, Mastercard and American Express. Because card data never touches our servers, the scope of our own handling is limited to your name, contact details, billing address and the donation amount.

4. Stored card credentials

If you set up a monthly donation, your card credential is stored so the recurring gift can be processed. That storage is carried out by the payment gateway, not by us.

• We identify the stored card only by its last four digits, which appear on your receipts. We hold no other part of the number.
• The credential is used solely to charge your chosen monthly donation amount, once per month, until you cancel.
• It is never used for any other purpose, never charged a different amount, and never shared with or sold to any third party.
• We give you notice by email, at the address you gave when donating, before any change to that arrangement takes effect.
• When you cancel, the stored credential stops being used immediately and is removed by the gateway.

You give express consent to this arrangement, separately from our general terms, by ticking the authorization box at checkout. The full arrangement is set out in our Terms & Conditions.

5. How we use information

We use the information described above only for the following purposes:

• To process your donation and issue a receipt and year-end tax acknowledgement.
• To manage recurring monthly donations and let you know before a card on file expires.
• To respond to your questions, applications and messages.
• To coordinate volunteer scheduling and communications.
• To send occasional updates about our programs and impact, where you have asked to receive them.
• To keep the website secure, prevent fraudulent or abusive transactions, and troubleshoot technical problems.
• To meet our legal, tax, accounting and card network obligations.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you.

6. How we share information

We share personal information only in these limited circumstances:

• Service providers. Our payment gateway and acquiring bank, our website host, and our email provider, each of which may process information solely to provide services to us.
• Professional advisors. Our accountants and auditors, in connection with financial reporting and our non-profit filings.
• Card networks and issuers. Where Visa, Mastercard, American Express, our acquirer or your own bank requires transaction records, for example to resolve a dispute or verify a recurring authorization.
• Legal requirements. Where we are required to do so by law, subpoena, or other legal process, or where disclosure is necessary to protect the rights, safety or property of the Loving Lunch Project, our beneficiaries, or the public.
• With your consent. For example, if you ask to be recognized publicly as a donor.

We do not share donor information with our school district partners. Information about the children who receive meals is handled by Iron County School District under its own policies and applicable student privacy law, and is not collected through this website.

7. We do not sell your data

We do not sell, rent, trade or exchange donor, volunteer or visitor personal information, and we do not share it for cross-context behavioral advertising. We do not exchange donor lists with other organizations.

8. Cookies and analytics

Our website uses a small number of cookies and similar technologies that are necessary for the site to function, to keep it secure, and to remember your session while you complete a donation. We may also use privacy-respecting analytics to understand, in aggregate, which pages are visited so we can improve the site.

Most browsers let you refuse or delete cookies through their settings. Blocking cookies that are strictly necessary may prevent the donation form from working correctly.

9. How long we keep information

• Donation records are retained for at least seven years, as required for non-profit accounting, tax substantiation and card network dispute handling.
• Recurring donation authorizations are retained for as long as the agreement is in effect, and afterwards for the period above.
• Contact form and volunteer enquiries are retained for as long as needed to respond and, where relevant, for the duration of your involvement with us.
• Server and security logs are retained for a short period, typically no more than twelve months.

When information is no longer needed, we delete it or render it anonymous.

10. Transaction security

Our entire website, including the checkout page, is served over an encrypted HTTPS connection with a valid SSL/TLS certificate — look for the padlock in your browser's address bar. Payment fields are isolated in secure frames hosted by our PCI DSS compliant gateway, so card data never passes through our own servers. We limit access to donor and volunteer information to the small number of people who need it to carry out their role.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law.

11. Your choices and rights

You may, at any time and free of charge:

• Ask what personal information we hold about you and request a copy.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your information, subject to records we are legally required to keep, such as donation receipts.
• Ask us to stop sending you emails. Every email we send includes an unsubscribe link, and you can also simply reply and ask.
• Cancel a recurring monthly donation at any time, as described in our Cancellation Policy.
• Request a copy of the recurring authorization you gave us.

To make a request, email info@lovinglunchproject.org or call (435) 708-1446. We will respond within 30 days. We will never discriminate against you for exercising any of these rights.

12. Children's privacy

Although our programs serve children, this website is directed to adults. We do not knowingly collect personal information from anyone under the age of 13 through this site. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

13. Where your data is held

The Loving Lunch Project operates in the United States, and the information described in this policy is stored and processed in the United States by us and by our service providers. If you are donating from another country, your information will be transferred to and handled in the United States under United States law.

14. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page shows when it was last revised, and the current version will always be posted here. Material changes will be highlighted on this page, and if you have an active monthly donation we will also notify you by email.

15. How to contact us

If you have any question about this policy or about how we handle your information, we would like to hear from you.