Privacy Policy

1. Introduction

The ZTTK SON-Shine Foundation (“Foundation,” “we,” “our,” or “us”) is a 501(c)(3) nonprofit organization dedicated to funding research and supporting families affected by ZTTK syndrome, caused by mutations in the SON gene. This Privacy Policy describes how we collect, use, and share information when you visit our website at zttk.org or otherwise interact with us online.

We wrote this policy in plain language on purpose. Many visitors arrive here while navigating a new or difficult diagnosis, and legal boilerplate is the last thing anyone needs in that moment. If anything below is unclear, contact us — see Section 12.

2. Information We Collect

Information you provide directly

• Contact form submissions — your name, email address, subject, and message when you write to us through our contact form.
• Donations — when you donate, your name, email, mailing address, and payment details are collected and processed by Givebutter, our donation platform (see Section 4). We receive a donation confirmation and, for donors who don't opt out, contact information for a receipt — we do not receive or store your full card number.
• Newsletter sign-up (coming soon) — we plan to offer an email newsletter after launch. When that feature goes live, subscribing will collect your email address, used only to send the newsletter, with an unsubscribe link in every email. This policy will be updated to name the mailing-list provider once one is selected.
• Photos and stories — if you are a member of our community and choose to share a photo or story for use on this site, see Section 7 for how we handle that separately from the general data practices in this policy.

Information collected automatically

• Usage analytics — pages visited, time on site, referring page, device/browser type, and approximate location at the country/region level, collected by Plausible Analytics (see Section 4 and Section 5 — Plausible is cookie-free).
• Error reports — technical error and performance data collected via Sentry so we can find and fix problems.
• Server and security logs — standard web request logs (IP address, timestamp, requested page, response code) generated by our hosting provider, Vercel, used only to keep the site running and deter abuse.

3. How We Use Your Information

We use the information we collect to:

• Respond to your contact form inquiries and support requests.
• Process and acknowledge donations and send donation receipts as required by law.
• Send the newsletter and event updates to subscribers (opt-in only).
• Operate, secure, and improve the website, including diagnosing technical issues.
• Understand how visitors use the site, in aggregate, through privacy-respecting analytics.
• Share community photos and stories on the site, exactly as consented to — see Section 7.
• Comply with legal and IRS recordkeeping obligations that apply to 501(c)(3) organizations.

We do not sell your personal information, and we do not use it for third-party advertising.

5. Cookies & Tracking

This website does not use advertising or cross-site tracking cookies. Plausible Analytics, our analytics provider, is cookie-free by design. Our hosting provider, Vercel, may use a small number of strictly technical cookies needed to serve the site securely (for example, routing or abuse prevention) — these do not identify you personally or track you across other sites. If you are Foundation staff and log in to the Sanity Studio (our content editor), Sanity sets a session cookie required for that login.

We do not currently run any advertising campaigns that would add tracking pixels or ad cookies to this site. If that changes in the future, we will update this policy and this section before any such tracking goes live.

6. Children's Privacy

This website is directed at parents, caregivers, clinicians, researchers, and adult supporters — not at children. Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information directly from children under 13 through this site (for example, through the contact form or a future newsletter sign-up). If you believe a child has submitted personal information to us, contact us (Section 12) and we will delete it.

This is separate from the fact that ZTTK syndrome primarily affects children, and that this site publishes photos and stories of children with their parent or guardian's consent, described next in Section 7. Publishing a photo a parent has chosen to share is not the same thing as collecting data from a child, and we treat the two very differently.

7. Photos of Community Members, Including Children

Photos of families in our community — including children living with ZTTK syndrome — appear throughout this site: family stories, the awareness campaign, event recaps, and similar pages. We publish a photo only after the parent or legal guardian of any child pictured has given us documented consent to use it on this website and in related Foundation materials.

You can ask us to remove a photo at any time. Consent can be withdrawn whenever a family chooses — no reason required. To request removal, or to ask a question about a photo of your family, contact us at zttkinfo@zttk.org. We will remove the photo from the live site promptly and confirm with you once it's done.

Note that removal from the live site cannot reach copies already saved, shared, or cached elsewhere (browser caches, search engine caches, social media reshares, or downloads made before removal) — we remove what is within our control as quickly as we can.

8. Your Privacy Rights

Regardless of where you live, you can ask us at any time to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information, subject to records we're legally required to keep (for example, IRS donation records).
• Opt out of the newsletter at any time via the unsubscribe link in any email we send.

To exercise any of these, contact us at Section 12. We will respond within 30 days.

California and other US state privacy laws

Several US states (including California's CCPA/CPRA) give consumers specific statutory rights against “businesses.” The ZTTK SON-Shine Foundation is a 501(c)(3) nonprofit corporation, not a business, and these laws generally do not apply to us. We honor the access, correction, deletion, and opt-out rights above for every visitor anyway, as a matter of practice rather than legal obligation — and to be direct about the part that matters most to most people: we do not sell personal information, to anyone, ever.

International visitors

We are a US-based nonprofit, hosted in the US, and we do not direct our fundraising or services specifically at the European Economic Area, the UK, or other jurisdictions with comprehensive data-protection laws like the GDPR. Because ZTTK syndrome is a global rare-disease community, visitors and donors do reach us from around the world — and we extend the same rights described in this section to every visitor, regardless of location, as good practice rather than a claim of formal compliance with any specific foreign framework.

9. Data Retention

We keep personal information only as long as it serves the purpose it was collected for, or as required by law:

• Contact form messages — kept in our inbox for as long as useful for follow-up, generally no more than 2 years.
• Donation and receipt records — retained by Givebutter, and accessible to us, for the period required for nonprofit IRS recordkeeping (generally at least 7 years).
• Newsletter subscriptions — kept until you unsubscribe.
• Analytics — Plausible retains only aggregate, non-personal statistics per its standard schedule; there is no individual visitor record to delete.
• Error logs — retained by Sentry for up to 90 days.
• Photos and stories — retained until the family withdraws consent (Section 7) or the page is retired.

10. Security

We take reasonable technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction. The site is served entirely over HTTPS. API keys and other secrets are stored in server-side environment variables and are never exposed to your browser.

No method of transmission over the internet or electronic storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy as the site and our services change — for example, when we add the newsletter or a CRM integration. We will update the “Last updated” date at the top of this page whenever we do. For a material change — one that meaningfully changes what we collect or how we use it — we will also post a visible notice on this page and, where practical, on our homepage, for a reasonable period before or after it takes effect.

12. Contact Us

Questions, concerns, or requests about this Privacy Policy or our data practices — including a photo-removal request (Section 7) — can go to: