Privacy notice

Who we are. The NFID Foundation, a Michigan nonprofit organization, is the controller for personal data collected on this site. Contact: contact@nfid.foundation.

What we collect and why.

• Requesting the paper. Your email address, and if you give them, your name, organization, and role. We use the email address to verify the request and deliver the download link. We keep a record that the paper was downloaded, with the date and the address, so the Foundation can report on the paper’s reach. We also store a salted hash of your IP address and your browser type for 24 months, to prevent abuse. Legal basis: your request, and the Foundation’s legitimate interest in understanding the reach of its publications and protecting the service.
• Foundation updates. If you tick the updates box, we use your address to send Foundation publications and working group news, a few times a year, until you unsubscribe. Confirming the download link also confirms this request. Every such email carries an unsubscribe link, and you can also write to us. Legal basis: consent.
• The join form and email. The details you enter in the join form, or send to contact@nfid.foundation, used to respond to you and, if you ask to join, to process that request.
• Analytics. We use Vercel Web Analytics, which sets no cookies and does not identify individuals. We see aggregate page views, referrers, and countries.
• Bot protection. The download and join forms use Cloudflare Turnstile, which processes your IP address and browser signals to distinguish people from automated traffic.
• Technical logs. Our hosting provider records requests, including IP addresses, for security and reliability, retained for 1 day.

Cookies. We set one cookie, nfid_paper, only after you verify your email address. It lasts 30 days and lets you download the paper again without a new email. It is not used for tracking. After you submit the download form without JavaScript, a 10-minute cookie carries your address to the confirmation page. There are no advertising or analytics cookies, so no consent banner is shown.

Who processes it for us. Hosting: Vercel. Email delivery: Resend. Bot protection: Cloudflare. Database: Neon. Rate limiting: Upstash. Each acts under a data-processing agreement.

What we share. Aggregate statistics about the paper’s reach (counts by week, by stated role, and by country) are shared with the Foundation’s working group. Individual addresses, names, and organization names are not shared with members or any third party for their own purposes. We do not sell personal data.

Retention. Paper requests: personal details are deleted 24 months after the request and only an anonymous count remains, unless you have subscribed to updates, in which case your address is kept until you unsubscribe. Join submissions and email: 24 months, or the duration of your membership.

Your rights. Access, correction, deletion, restriction, portability, and objection, where applicable. Email contact@nfid.foundation. Deletion also revokes any outstanding download link. EU and UK residents may complain to their supervisory authority. California residents: we do not sell or share personal information as those terms are defined under the CCPA.

Changes. We’ll post changes here with a new effective date.