Your data stays tied to the creator relationship

Last updated August 19, 2026

Loresta is operated by Michael Ngo, a sole proprietor, who is responsible for the personal data processed through the service.

What we collect

We collect account details, approved creator profile information, storefront settings, gift catalog data, connected social account identifiers, inbound conversation content, supporter names and contact details they choose to provide, purchases, creator-authored supporter notes, operational receipts, security events, and first-party activation events needed to run and improve Loresta.

How we use it

We use data to host creator pages, process creator transactions, maintain supporter context, enforce automation and commerce rules, secure accounts, troubleshoot delivery, process billing, alert creators to conversations that need a human, and show workspace results. We do not sell personal data or use private conversation content for advertising.

Supporter chat and memory

A creator may save relevant notes about a supporter relationship, such as an approved preference or fulfillment detail. Loresta separates supporter records by creator profile. Assistant replies can use only permitted context, creator-approved facts, and live commercial details. Supporters may ask the creator or Loresta to correct or remove information, subject to records we must retain for security, payments, disputes, or law.

Reply previews and voice learning

Public reply previews are processed to return the sample requested and are not saved by Loresta. If a creator opts into voice learning, Loresta temporarily reads replies the creator authored through a connected account, filters sensitive data, and saves a reusable style summary rather than the raw reply history. Creators can turn voice learning off and clear the learned summary.

Payment accounts and payouts

Stripe collects and processes creator identity, business, tax, bank, capability, verification, transaction, refund, payout, and dispute information under its own terms. Loresta embeds Stripe-managed tax settings and registration tools and stores only connected-account readiness, registration counts and countries, requirement codes, transaction references, and status needed to operate checkout and respond to refunds or disputes. Loresta does not store full card or bank credentials, or full tax-identification credentials.

Connected platforms

Social access is granted through OAuth. Tokens are encrypted at rest, limited to supported actions, and removed from active use when an account is disconnected. Provider data remains subject to each connected platform’s policies.

Attribution and experiments

We use a first-party random visitor identifier to understand which landing page, campaign, referring domain, or page experiment led to signup, connection, activation, and purchase. We store approved campaign parameters and the referring domain, not full referring URLs, message content, or arbitrary query parameters.

Retention and control

Raw conversation and AI invocation content follows the workspace retention setting, which is limited to 30–365 days and defaults to 90 days. Operational telemetry is compacted into bounded reports and then removed on its published schedule. Browser continuity and short-lived authentication records expire sooner. Billing, payout, refund, dispute, provider-usage, security-audit, and named-operator records are kept separately for the period needed for financial, security, or legal obligations, with sensitive provider payloads removed where possible. An active investigation hold pauses the relevant cleanup until the hold is released. The dashboard lets workspace owners export records, disconnect accounts, and submit a verified deletion request. Confirmed deletion removes workspace records and stored media, subject to these limited records and any active hold.

Security and access

We use workspace isolation, encrypted credentials, short-lived sign-in links, role checks, CSRF protection, signed webhooks, idempotent payment processing, audit records, and restricted administrative operations. No internet service can promise absolute security.

Contact

Questions or privacy requests can be sent to privacy@loresta.co.