Privacy Policy

lots2do  |  Effective date: March 28, 2026  |  Last updated: March 28, 2026

This Privacy Policy describes how lots2do (“we,” “us,” or “our“), operated by Momma’s Favorite LLC, collects, uses, and protects information when you use the lots2do task management application at lots2do.app (the “Service“).

lots2do is a private task management application. Access is by invitation only. Users are clients, staff members, or family members of Morrel Law PLLC and its principals. If you are using this Service, someone you know gave you access. This policy explains what information we collect and how we handle it.

1. Information We Collect

Information you provide directly

• Account information — your name, email address, and password when you accept an invitation and create an account.
• Task content — titles, notes, due dates, priorities, projects, and any other content you enter into the Service.
• Contact form submissions — if you submit a request through the public request form at lots2do.app/request, we collect your name, phone number, and message.
• Phone and SMS communications — if you call or text 1-855-LOTS2DO (1-855-568-7236), we may retain a record of that communication including your phone number and message content.

Information collected automatically

• IP address — collected when you submit public forms, used solely for spam prevention and rate limiting. Not stored for logged-in users.
• Session cookies — standard WordPress authentication cookies that keep you logged in. These expire when you log out or close your browser.

Third-party services

• Cloudflare Turnstile — protects our public contact form from automated spam. Cloudflare analyzes browser behavior to distinguish humans from bots. Their privacy policy governs their data handling: cloudflare.com/privacypolicy.
• Twilio — processes inbound phone calls and SMS messages sent to 1-855-LOTS2DO. Twilio’s privacy policy applies to communications they handle: twilio.com/legal/privacy.
• GoDaddy — hosts the Service. GoDaddy has access to server logs and infrastructure in the ordinary course of providing hosting services.

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service
• Create and manage your account
• Enable workspace and team features
• Respond to requests, questions, and communications you send us
• Send notifications related to tasks and account activity
• Prevent spam and abuse of the public request form

We do not sell your information. We do not use your task content for advertising. We do not share your data with anyone outside the Service except as described below.

3. Information Sharing

• Within your workspace — the workspace administrator (the person who invited you) can see tasks you submit and receives notifications about your submissions. This is the intended function of the Service.
• Service providers — Cloudflare, Twilio, and GoDaddy receive only the data necessary to provide their respective services, as described above.
• Legal requirements — we may disclose information if required by law, court order, or governmental authority.

4. Data Retention

We retain your account information and task content for as long as your account is active. If you request deletion of your account, we will remove your personal information within 30 days, except where retention is required by law.

Public form submissions are retained for 12 months or until reviewed and resolved, whichever comes first.

5. Your Rights

You have the right to:

• Access — request a copy of the information we hold about you
• Correction — request correction of inaccurate information
• Deletion — request deletion of your account and associated data

To exercise any of these rights, contact us using the information in Section 9. We will respond within 30 days.

6. Cookies

The Service uses only cookies necessary for operation — specifically, WordPress authentication cookies that keep you logged in. We do not use advertising cookies, analytics cookies, or tracking pixels. Cloudflare Turnstile may set its own functional cookies on the public request form page.

7. Security

The Service uses HTTPS encryption for all data in transit. Passwords are stored using industry-standard hashing. Access to the Service is restricted to invited users only. No method of internet transmission is 100% secure; if you believe your account has been compromised, contact us immediately.

8. Children

The Service is not directed to children under 13. We do not knowingly collect information from children under 13. Contact us immediately if you believe we have inadvertently done so.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to account holders by email before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

10. Contact

Questions or requests regarding this Privacy Policy: