Privacy Policy

1. Who we are

Root & Restore Nutrition Education ("Root & Restore," "we," "us," "our") is a registered 501(c)(3) public charity in the United States (EIN 42-⁠3047515) that publishes evidence-based holistic nutrition guides for dozens of chronic health conditions.

• Website: www.rootnrestore.org
• Contact: hello@rootnrestore.org
• Founder: Youssef Kubis, Certified Nutrition Educator & Natural Chef

2. What we collect

Information you provide voluntarily

• Newsletter signup: your email address (and optional first name). Stored by our email-service provider, MailerLite. Signup uses double opt-in, so you confirm by email before we send anything.
• Emailed symptom-checker results or guide PDFs: if you ask us to email your matched guides or a guide PDF, we collect your email address, which form you used (checker or guide download), whether you checked the optional newsletter box, and, for checker emails, the names of your matched guides, which are stored with your address at MailerLite to build the email. We deliberately do not receive your symptom selections: those are matched to guides entirely in your browser, and only the resulting guide links are used to build your email.
• Donations: when you donate, our payment processor Stripe collects your name, email, billing address and payment information. We never see or store full payment details; Stripe handles them.
• Direct contact: if you email hello@rootnrestore.org, we keep your email and message for reply and follow-up.
• Guide assistant questions: if you type a question into the guide assistant, your conversation is sent through our server to Anthropic, which generates the answer. We do not store it, and it stays in your browser only until you close the tab.

Information collected automatically

• Google Analytics 4 and Google Ads (only if you accept our cookie banner): we run a privacy-configured Google Analytics 4 property, loaded through Google Consent Mode so it stays dormant until you accept, and share its outcome events with Google Ads; no separate Google Ads tag runs on this site. They run on our general pages (consent-gated). On individual condition guides they load only for visits arriving from a Google ad (identified by Google's click ID in the link) and only after consent; visitors who arrive any other way are never tracked by Google on those pages. The Symptom Checker loads no Google analytics or advertising scripts. They record page views, approximate region, device type and four outcome events only (newsletter signup, checker email confirmation, donation thank-you and a completed read of a condition guide, meaning its References section was reached after at least 45 seconds on a visit that arrived from a Google ad). Google Analytics anonymizes your IP address. They do not record which symptoms you select. We use them because the free Google Ad Grants program, which funds advertising of the library, requires conversion tracking. Decline the banner and they never load.
• Meta (Facebook) advertising pixel, on our donation pages only: if you accept the cookie banner, a Meta pixel loads on our Donate, Appeal and Thank-You pages to measure our fundraising campaigns. It never loads on the Symptom Checker or on any condition guide page, and it does not load until you accept.
• Server logs: our host, Netlify, records standard web-server logs (IP address, browser type, pages requested, timestamp). Used to monitor uptime and diagnose technical issues. Typically retained for 30 days by Netlify.
• Service-worker cache (on your device): our installable app (a progressive web app) caches pages on your own device so you can browse offline. This data lives on YOUR device and is never transmitted to us.

What we do NOT do

• Run any analytics or advertising tag on the Symptom Checker, or track organic (non-ad) visitors on condition guide pages
• Record, store or transmit which symptoms you select
• Build individual behavioral profiles, or use retargeting to follow you around the web
• Sell, rent or trade your personal data, ever

3. How we use what we collect

• Newsletter emails → send the monthly newsletter you signed up for, and nothing else.
• Donations → process payment, send receipt and issue annual tax-receipt statements as required for our 501(c)(3) public charity status.
• Emailed results and guide PDFs → send the one email you asked for (your matched guides or the guide PDF), and add you to the newsletter only if you ticked its box.
• Contact emails → reply to you, answer questions, follow up on requests.
• Server logs → keep the site running, troubleshoot issues, prevent abuse.
• Analytics and ad measurement → count visits and the four outcome events, only after you accept the cookie banner, as Section 2 describes.

4. Who we share with (essential service providers)

We do not share data with anyone EXCEPT for these essential service providers, each of whom processes data on our behalf under their own privacy commitments.

We have no contract or financial relationship with any of these providers that involves selling, renting or trading your data.

5. How long we keep your data

• Newsletter subscribers: until you unsubscribe (one-click link in every email we send).
• Donation records: retained per IRS / 501(c)(3) compliance requirements (typically 7 years for financial records).
• Direct contact emails: retained until the matter is resolved, then archived for approximately 2 years.
• Server logs: 30 days, then automatically deleted by Netlify.

6. Your rights

You may, at any time, request that we:

• Send you a copy of all personal data we hold about you
• Correct anything inaccurate
• Delete your data (the right to be forgotten)
• Stop processing your data
• Receive your data in a portable format

To exercise any of these rights, email hello@rootnrestore.org. We will respond within 30 days.

If you are in the European Economic Area (EEA) or the United Kingdom, you have these rights under GDPR; if you are in California, under the CCPA. You may also lodge a complaint with your local data-protection authority.

7. Children's privacy

This site is intended for adults and is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have inadvertently collected data from a child under 13, email us and we will delete it immediately.

8. Cookies & tracking

• By default we set no analytics or advertising cookies. Nothing loads until you choose "Accept" on our cookie banner. Choose "Decline" (or ignore it) and no analytics or advertising cookies are ever set.
• If you accept: Google Analytics 4 sets analytics cookies on our general pages, and on condition guides only for visits from a Google ad; on our Donate, Appeal and Thank-You pages only, a Meta advertising pixel may set cookies to measure fundraising campaigns. None of them run on the Symptom Checker.
• Opt out any time: declining the banner keeps every tag dormant. You can also install Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout), and clearing this site's stored data re-shows the consent banner.
• We also use small functional storage (cookies / localStorage) on your own device for your cookie-consent choice, your language preference and whether you have installed the app. These never leave your device.
• Stripe and MailerLite may set their own cookies when you interact with their forms; their own privacy policies apply (see Section 4).

9. International users

Our servers and service providers are based primarily in the United States. If you access the site from outside the US, your data may be transferred to and processed in the US. By using the site, you consent to this transfer. We comply with applicable cross-border data-transfer frameworks where they apply.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page will change to reflect any update. For significant changes, we will note them on the homepage or via the newsletter so subscribers see them.

11. Contact us

Questions, requests or complaints about your data and privacy: