Northern Light Lodge No. 40Northern Light Lodge No. 40

Privacy policy

This website runs on Member Lantern. The policy below covers it.

Effective date: October 20, 2026

Member Lantern is a website and member-management service for small organizations such as Masonic lodges, civic clubs, churches, and veterans posts. It is a service of Velocity Technologies, Inc., of Toledo, Ohio ("we", "us"). This policy explains what information we collect, why, and what we do with it. It applies to memberlantern.com, the admin at memberlantern.com, and every Organization website we host, whether it runs on a memberlantern.com address or on the Organization's own domain.

If you have a question about this policy or about your information, email [email protected].

The short version

  • We host websites and records for Organizations. Most of the personal information on this platform belongs to those Organizations and their members, and the Organization decides what goes in and who sees it.
  • We do not sell personal information. We do not run ads, and we do not put advertising trackers on any site we host or in the admin.
  • Analytics runs only if you say yes. Our own site, and any Organization site whose owners turn it on, asks before counting your visit. The admin never uses analytics.
  • We use a few service providers to run the platform (hosting, email delivery, Cloudflare, and Stripe for card payments). They get only what they need to do their job.
  • If an Organization connects a Google account, we use it only for the calendar and email features the Organization turns on, and we follow Google's rules for that data, including the Limited Use requirements.
  • You can ask us to see, correct, export, or delete your information. Members of an Organization should start with that Organization; we help either way.

Two roles: ours and the Organization's

It helps to know which hat we are wearing.

When an Organization uses Member Lantern to run its website and keep its records, the Organization is in charge of that data. It decides which forms to put on its site, which events to take sign-ups for, which photos to publish, and who gets admin access. We hold and process that information on the Organization's behalf and on its instructions. In privacy law terms, the Organization is the controller and we are the processor. If you are a member or guest of an Organization and you want to know why it collected something, or you want it changed or removed, the Organization is the right first stop. Its contact details are on its website.

For some information, we are the one in charge. That covers the accounts of the people who sign in to the admin, the information people send us through memberlantern.com itself (the start-a-trial form, the contact form), visitor logs on memberlantern.com, and the records we keep to run, bill, secure, and support the service. For that information we are the controller.

Where this policy says "you", it means whoever is reading it: an admin, a member, a guest who signed up for a dinner, or a visitor.

What we collect and why

Admin accounts

If you are given an admin account for an Organization, we store your name, email address, a password hash (never the password itself), your role, which Organization you belong to, and your admin preferences (display size, which guides you have seen, your POS theme, and similar settings). We use this to sign you in, send you password resets and account notices, and show the admin the way you set it up. Admin accounts are created by the Organization or by us at the Organization's request.

Information collected through an Organization's website

Each Organization chooses which of these features to use. When they are on, we store the following for the Organization:

  • Contact and other form submissions: whatever the form asks for (usually a name, an email address, and a message), the time it was sent, and the sending device's IP address and browser identification. The IP and browser string are kept with the submission so the Organization and we can tell real messages from automated spam.
  • Event sign-ups: the name of the person signing up, and their email address and phone number if they give them, how many people are in their party (adults and children as a count), each attendee's name and meal choice if the event asks, an optional age bracket so the Organization knows how many seats and meals to plan for, notes, a confirmation code, and the amount owed and paid for events with a price. Payment is recorded by the Organization's officers; see "Money" below.
  • Member photo submissions: a photo uploaded through an Organization's QR-code link, and the date. The link is protected by a PIN the Organization sets. We do not ask for the uploader's name or email. Uploaded photos are held as private until an officer approves them for the website.
  • Rosters and officers: names, titles, and photos of the Organization's officers, as entered by the Organization for its own website.
  • Documents: files the Organization uploads and marks as public, members-only, or admins-only.
  • Building, maintenance, and vendor records: contact details for the Organization's vendors and contractors, and maintenance logs.
  • Point of sale (POS) records: sales, refunds, cash counts, and which admin user rang them up. No payment card numbers; see "Money".

Email the platform sends

When the platform sends an email for an Organization (a contact-form receipt, a sign-up confirmation, a maintenance reminder, a password reset, a test message), a copy of the message and its delivery status is kept in an outbox log. The Organization's admins can see the log for their Organization. We keep it so we can show what was sent, retry failed sends, and troubleshoot delivery.

Information you give us directly

If you fill in the form on memberlantern.com to start a trial or to contact us, we keep what you send: your name and email, the Organization's name and location, and the answers to a few questions about the Organization (type, rough size, dark months, when officers take office). We ask those questions to set up your site, to pause your trial when your Organization is dark, and to send the right help at the right time. We never ask about anyone's age, religion, politics, or health; "Masonic lodge" or "church group" describes the Organization, not the person.

Logs and security records

  • Server and Cloudflare access logs: IP address, pages requested, time, and browser. Standard web logs, used for security, rate limiting, and troubleshooting, and kept for a short time.
  • Audit trails: when an admin overrides an event's capacity, voids a sale, connects or disconnects a Google account, or when our staff signs in to help an Organization, we write a record of who did what and when. These records protect the Organization and us and are not deleted while the account is open.
  • Support sessions: our staff can open an Organization's admin to help with a problem. Every such session is logged with who did it, which Organization, when it started and ended, and it expires on its own after a few minutes of inactivity. We do this only to support you, to investigate a problem, or to keep the service safe.
  • Feedback tool (staging only): on our test site, admins can flag a problem on the page they are looking at. That report includes the page address, a snippet of the page, the browser identification, and the admin's account. This tool is off on the live service.

Cookies and browser storage

These cookies are needed for the service to work, so they are always on:

  • a sign-in cookie for the admin, so you stay signed in;
  • a short-lived cookie (about ten minutes) that protects the Google connection step from tampering;
  • a cookie that marks a support session while our staff is helping an Organization;
  • a cookie that remembers your answer to the cookie question, for up to a year, so we do not ask on every page.

The admin also keeps a few small display settings in your browser's local storage, such as which filter you last used on a list or whether a help panel is open. They stay on your device and are not sent to anyone. Public Organization websites do not use browser storage for anything else.

Your admin preferences are stored in your account, not in cookies. We do not use advertising cookies. The typefaces on our sites are served from our own servers, so loading a page does not contact a font service. If we ever add usage tracking to our own lifecycle email, we will update this policy first.

Analytics, only with your permission

Some sites ask whether they may count your visit. Nothing in this section runs until you choose Allow, and you can change your answer at any time with the Cookie settings link at the bottom of the page. If your browser sends a Global Privacy Control signal, we treat it as No and do not ask.

  • On memberlantern.com, if you allow it, we use Google Analytics to count visits and see which pages people find useful, and Microsoft Clarity to see how people move through our pages so we can fix confusing ones. Clarity hides anything typed into forms. Neither runs in the admin.
  • An Organization can turn on Google Analytics for its own website using its own Google account. It runs only if you allow it, and the visit counts go to the Organization's Google account, not ours. The Organization decides how it uses them.
  • Google Analytics sets its own cookies (named _ga and similar) and receives your IP address, the pages you view, and information about your browser and device. We ask Google not to use this data for advertising and to shorten IP addresses. Clarity sets cookies named _clck and _clsk and receives similar information. Google's privacy policy is at policies.google.com/privacy and Microsoft's is at privacy.microsoft.com.

Spam and bot checks

Public forms use a hidden field and a timing check to catch automated spam, and limit how many messages one address can send in a short time. An Organization can also turn on Cloudflare Turnstile for its forms, and Turnstile protects the admin sign-in page. Turnstile is a check that you are a person, not a program. To run it, Cloudflare receives your IP address and information about your browser and device. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

Videos, maps, calendars, and links to other sites

An Organization can embed content from a short list of services we allow: YouTube and Vimeo videos, Google Maps, and Google Calendar, plus video files we host. We block embedded code from any other site, so an Organization cannot add other trackers to its pages this way.

YouTube videos load in YouTube's privacy-enhanced mode, which does not store YouTube cookies until you play the video. When a page shows an embedded video, map, or calendar, that service receives your IP address and information about your browser, and may set its own cookies under its own privacy policy. We do not control what those services collect.

Organization websites and this site link to other websites, such as an Organization's social media pages or a supplier's site. Once you follow a link off our sites, that site's own privacy policy applies.

Google services

An Organization's admin can connect a Google account to Member Lantern. This is optional and the admin chooses which features to turn on. The permissions we ask for are listed below, with exactly what we do with each.

  • Your Google account email address (sign-in). We store the email address and account identifier so the admin can see which account is connected and so we can tell if a different account is connected later.
  • See the list of your calendars, and view events on your calendars (read-only). The admin picks one calendar. We read the events on that calendar to show them on the Organization's website. We never read any other calendar.
  • View and edit events on your calendars (only if the admin turns on two-way calendar sync). We read the events on the calendar the admin chose and store a copy (title, description, location, times, and the event's Google id) in that Organization's site. With two-way sync on, we also create, change, and delete events on that one calendar to match events the Organization manages on its site. We never add guests and never send calendar invitations. Events marked Private in Google are not copied unless the admin chooses to copy them as hidden. Two-way sync is only requested when the admin asks for it.
  • Send email on your behalf (only if the admin chooses Google as the Organization's email provider). We send the email the Organization's own website generates (contact-form receipts, sign-up confirmations, password resets, reminders) from the connected Google account. Send only. We never read, search, change, or delete mail in the account.

What we do with Google data, and what we do not:

  • We use Google user data only to provide the features above to the Organization that connected the account. We do not use it for advertising, we do not sell it, and we do not use it to build or train artificial intelligence or machine-learning models.
  • We do not share Google user data with anyone except the service providers that run our hosting and only as needed to provide the feature, or when the law requires it, or as part of a merger or sale of the business, with notice.
  • No person at Member Lantern reads your Google data, except when you ask for help with a specific problem, when needed for security or to investigate abuse, or when the law requires it.
  • Google sign-in tokens are stored encrypted. They are never shown in the admin or returned by any API.
  • The admin can disconnect at any time from Admin > Integrations. Disconnecting revokes our access at Google and deletes the stored token. Events already copied to the Organization's site stay there until an admin removes them. You can also remove our access from your Google account at myaccount.google.com/permissions.

Member Lantern's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. (https://developers.google.com/terms/api-services-user-data-policy)

Money

Paying for Member Lantern. Organizations pay for their subscription by check, or by card when they choose to. For billing we keep the Organization's billing contact (name, email, mailing address), its plan, invoices, and payment history. Card payments are handled by Stripe, Inc. Your card number goes straight to Stripe and never touches our servers; we receive only the card brand, the last four digits, the expiration date, and whether the payment went through. Stripe uses this information under its own privacy policy, at stripe.com/privacy, which includes checks for fraud.

Money an Organization collects. The POS and event features record sales and balances that the Organization's officers handle themselves, in cash, by check, or on the Organization's own card reader. No payment card numbers are stored in these records. When you sign up for a priced event on an Organization's website, the site tells you how much is owed and how to pay the Organization; nothing is charged through us.

Who we share information with

We share information only in these cases:

  • With the Organization. Everything collected through an Organization's website belongs to that Organization and is visible to its admins.
  • With service providers that help us run the platform:
  • hosting on servers we operate in the United States, and, if we move media files to a cloud object-storage provider, that provider;
  • Cloudflare, which sits in front of our servers (DNS, proxy, protection against attacks) and provides Turnstile, the "are you human" check on the admin sign-in page and on any Organization form that turns it on. When Turnstile runs, Cloudflare receives the check result, the visitor's IP address, and information about the browser;
  • YouTube, Vimeo, and Google Maps and Calendar, only when a page shows content an Organization embedded (see "Videos, maps, calendars, and links to other sites");
  • Google (Analytics) and Microsoft (Clarity), only if you allow analytics (see "Analytics, only with your permission");
  • Stripe, which processes card payments for subscriptions;
  • email delivery services. Platform mail goes through our own mail server. An Organization can choose to send its site's email through its own SMTP account, through Resend, or through Google; those providers then handle that Organization's mail. Credentials an Organization gives us for its email provider are stored encrypted.
  • With Google, as described above, only when an Organization connects a Google account.
  • When the law requires it, to respond to a valid legal request, or to protect the rights, property, or safety of an Organization, its members, the public, or us.
  • As part of a sale or merger of the business, in which case we will tell you and the new owner will be bound by this policy.

We never sell personal information and we do not share it with advertisers.

How long we keep information

  • Organization records (form submissions, sign-ups, photos, documents, POS records, rosters, outbox log): for as long as the Organization keeps them. The Organization's admins can delete submissions, photos, documents, and most records themselves at any time. We do not delete an Organization's records on a schedule while its account is open.
  • Audit trails and support-session logs: for the life of the Organization's account.
  • Your admin account: until the Organization removes it or the account closes.
  • Trial and contact inquiries sent to us directly: for as long as we need them to answer you and to run the trial, then for a limited time afterward for our records.
  • Billing records (invoices, payments received, billing contacts): for as long as tax and accounting rules require, even after an account closes.
  • Analytics data: Google Analytics keeps it for 14 months and Microsoft Clarity for about a year, then deletes it.
  • Server logs: a short time, for security and troubleshooting.
  • When an Organization's account ends (it cancels, or its trial ends and it does not continue), its public site and admin follow the steps described in the Terms of Service. We keep its data for a grace period so it can be exported, we warn the Organization by email before anything is deleted, and then we delete it. Backups are kept on a short rotation and are deleted on their own schedule.

Your choices and rights

  • See, correct, export, or delete your information. Admins can do most of this in the admin. Members and guests should ask the Organization first; it owns the record. If that does not work, or you want to ask us directly, email [email protected]. We will answer within 30 days. We may ask you to confirm who you are before we act.
  • Email from us. Account email (password resets, sign-in notices, trial status, deletion warnings, receipts) is part of the service and cannot be unsubscribed while you have an account. Tips and offers during and after a trial carry an unsubscribe link, and unsubscribing stops that mail at once. News and offers after a trial ends are sent only if you asked for them.
  • Google. Disconnect in the admin at any time, or remove our access at myaccount.google.com/permissions.
  • Cookies. You can block cookies in your browser; the admin will not work without the sign-in cookie, but Organization websites will.
  • Analytics. Choose Allow or No thanks when asked, and change your answer at any time with the Cookie settings link at the bottom of the page.
  • Do Not Track and Global Privacy Control. We do not track visitors across other websites and do not sell or share personal information for advertising. If your browser sends a Global Privacy Control signal, we treat it as a request not to sell or share your information and we keep analytics off.

State privacy notices

Residents of some states and countries have specific rights under their privacy laws, including California, Colorado, Connecticut, Virginia, and others. We honor requests to know, correct, delete, and export, and we do not treat anyone differently for making a request. You can make a request yourself or through someone you authorize; we may ask for proof of that authorization.

In the past 12 months we have collected these kinds of personal information, from the sources and for the purposes described above: identifiers (name, email address, phone number, IP address), records an Organization keeps about its members and guests, photos, billing information for Organizations (no full card numbers), and internet activity on our own sites (pages requested, browser type, and, if you allow analytics, how you use our pages). We collect them from you, from the Organization you belong to, and from your browser. We use them to run the service, keep it secure, and support Organizations. We disclose them only to the service providers listed in "Who we share information with". We have not sold or shared personal information for cross-context advertising, and we do not knowingly sell or share information about anyone under 16.

Children

Member Lantern is built for organizations run by adults, and it is not directed at children under 13. We do not knowingly collect personal information from a child under 13. An adult signing up a family for an Organization's event may enter how many children are coming and a meal choice for each attendee; that is a planning count entered by the adult, not an account for the child. If you believe a child has given us personal information, email us and we will delete it.

Security

We take reasonable steps to protect information: encrypted connections (HTTPS), hashed passwords, encrypted storage of email credentials and Google tokens, access rules so each Organization's admins see only their own Organization, rate limits and spam checks on public forms, logged support sessions, and regular backups. No service can promise perfect security. If a breach affects your information, we will tell the affected Organizations and, where the law requires, you.

Where information is kept

We are based in the United States and our servers are in the United States. The service is offered to organizations in the United States. If you use it from somewhere else, your information will be transferred to and stored in the United States.

Changes to this policy

When we change this policy, we will post the new version here with a new effective date. If a change matters to you (for example, a new kind of data or a new way we share it), we will tell admins by email or in the admin before it takes effect.

Contact

Velocity Technologies, Inc. Attn: Member Lantern 1119 Adams St, Floor 2 Toledo, OH 43604

Email: [email protected]