Privacy Policy

Last updated: October 14, 2026

1. Who we are and what this policy covers

This Privacy Policy explains how the operators of Sustainable Fox Valley (sustainfv.org) (“Sustainable Fox Valley,” “we,” “us,” or “our”) collect, use, disclose, and protect personal information when you visit sustainfv.org, read our articles, contact us, sign up for our newsletter, create an account, or buy a product or service through our online shop.

Sustainable Fox Valley is an independent community-education project based in the Fox Cities, Wisconsin, that carries forward the mission of the original grassroots Sustainable Fox Valley initiative. For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the “controller” of the personal data described in this policy. For the purposes of US state privacy laws, we are the business or controller that decides how your information is used.

This policy applies to information collected through this website and through email correspondence with us. It does not apply to third-party websites we link to, such as government agencies, utilities, or other organizations listed on our Resources page. Those sites have their own privacy practices, and we encourage you to read them.

This policy should be read together with our Cookie Policy, which describes cookies in more detail, and our Terms & Conditions, which govern your use of the site and any purchases.

2. Information we collect

We collect personal information in three ways: information you give us directly, information collected automatically when you use the site, and limited information we receive from service providers that help us run the site.

2.1 Information you provide

• Contact form messages. When you use our contact form, we collect your name, email address, the subject and content of your message, and anything else you choose to include, such as your town or the organization you represent.
• Newsletter sign-ups. When you subscribe to our newsletter, we collect your email address and, if you provide it, your first name. We also record the date and time you subscribed and, where applicable, the fact that you confirmed your subscription.
• Orders and checkout. When you buy a kit or book a service in our shop, we collect your name, billing address, shipping address (for physical kits), email address, phone number if you choose to provide it, the items you ordered, order notes, and scheduling preferences for services such as the Home Energy & Waste Assessment, a Natural Step workshop, or a municipal planning consultation.
• Customer accounts. If you create an account, we collect your username, email address, and a password (stored only in hashed form, never in plain text). Your account also stores your order history and saved addresses.
• Service delivery information. When we deliver a service, you may share information about your home, business, or organization, for example utility usage figures, photos of your home, building details, recycling and waste practices, or planning documents. We use this only to deliver the service you requested.
• Volunteering and correspondence. If you offer to volunteer or email us directly, we keep the details you share and our replies.

2.2 Payment information

Payments are processed by third-party payment processors that we connect to WooCommerce, such as Stripe or PayPal, depending on the payment methods offered at checkout. Your full card number, security code, and bank login details are entered into and handled by the payment processor, not stored on our website. We receive limited information back from the processor, such as the payment status, the last four digits and type of the card, the billing name and postal code, and a transaction reference, so we can confirm and reconcile your order and issue refunds.

2.3 Information collected automatically

• Server and security logs. Like nearly every website, our web server and our security tools record technical information about each request: IP address, browser type and version, device type, operating system, the page you requested, the referring page, and the date and time of the request.
• Security monitoring (Wordfence). We use the Wordfence security plugin to protect the site against hacking, spam, and automated attacks. Wordfence logs IP addresses, user agents, requested URLs, login attempts (including the username tried), and blocked or suspicious requests. See section 5 for more detail.
• Cookies and similar technologies. We use strictly necessary cookies to make the site work (for example, to keep items in your cart and to keep you logged in), and, only with your consent, optional cookies for functionality, analytics, performance, or advertising. Our consent banner is provided by CookieYes. Our Cookie Policy lists the cookies we use.
• Analytics (only with consent). If we use a website analytics tool, it loads only after you accept analytics cookies. Analytics tools typically collect pages viewed, time on page, approximate location derived from an IP address (usually to the city or region level), referring websites, and device and browser information. We use this information in aggregate to understand which guides are useful and to improve the site.

2.4 Information we do not intend to collect

We do not ask for, and ask you not to send us, sensitive information such as Social Security numbers, financial account numbers, health information, precise geolocation, information about racial or ethnic origin, religious beliefs, sexual orientation, or immigration status. If you include sensitive information in a message, we will use it only to respond to you and will delete it when it is no longer needed.

3. How we use your information

We use personal information for the following purposes:

• To respond to you. Answering questions, requests, and feedback sent through the contact form or by email.
• To process and fulfill orders. Taking payment, shipping physical kits, scheduling and delivering services, sending order confirmations and receipts, handling returns, refunds and cancellations, and providing customer support.
• To manage your account. Letting you log in, view past orders, and update your details.
• To send the newsletter. Sending occasional updates on articles, events, and community projects, only if you subscribed. Every newsletter includes an unsubscribe link.
• To send service messages. Sending transactional emails, such as order updates, scheduling reminders, and important notices about changes to our terms or policies. These are not marketing messages.
• To keep the site secure. Detecting and blocking spam, brute-force login attempts, malicious traffic, fraud, and abuse.
• To improve the site. Understanding, in aggregate, which pages and resources are useful, fixing errors, and improving accessibility and performance.
• To meet legal obligations. Keeping records required for tax and accounting, responding to lawful requests from authorities, and handling privacy requests.
• To protect rights. Enforcing our Terms & Conditions, responding to copyright notices under our DMCA Policy, and establishing or defending legal claims.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects, and we do not build profiles about you for advertising.

4. Legal bases for processing (EU and UK visitors)

Our site is aimed at people in northeast Wisconsin, but anyone can visit it. If you are in the European Economic Area, the United Kingdom, or Switzerland, the GDPR (or the UK GDPR and Swiss data protection law) requires us to explain the legal basis for each use of your personal data:

Where we rely on legitimate interests, we have considered your rights and expectations and concluded that our interests are not overridden by them. You can object to processing based on legitimate interests at any time (see section 10).

5. The tools and plugins that process your information

This website runs on WordPress. Several plugins and services process personal information on our behalf. Here is what each one does:

• WordPress. The core software stores account information for registered users and sets cookies needed for login. WordPress does not use cookies to track ordinary visitors who are not logged in.
• WooCommerce. Our shop plugin stores order, customer, and account information in our website database. It uses cookies and a session record to remember your cart. Order records are accessible only to site administrators who need them to fulfill orders.
• Payment processors. Card and digital wallet payments are handled by the payment processor shown at checkout. The processor collects payment details directly and uses them under its own privacy policy, including for fraud prevention.
• Contact Form 7. Our contact form plugin sends your submission to our email inbox. By default, Contact Form 7 does not store submissions in the website database and does not set any cookies. If we enable a spam-protection service with the form, the service may receive your IP address and form content solely to judge whether the submission is spam.
• Wordfence. Our firewall and security scanner logs visitor IP addresses and request details to identify attacks. To block known threats, Wordfence may check IP addresses against threat intelligence provided by its developer, Defiant, Inc., and may send limited information about attack attempts to Defiant to improve protection. Wordfence also sets a cookie for logged-in administrators so the firewall can recognize them.
• Yoast SEO. Our SEO plugin generates page titles, descriptions, structured data, and XML sitemaps. It does not collect personal information from site visitors or set visitor cookies.
• CookieYes. Our consent management tool shows the cookie banner, records your consent choices in a cookie on your device, and blocks optional cookies until you consent. CookieYes may keep a consent log (for example, an anonymized identifier, the date and time, and the categories you accepted) so we can demonstrate that consent was obtained.
• Analytics (optional). If enabled, runs only after you accept analytics cookies, with IP anonymization turned on and advertising features turned off where available.
• Email and newsletter services. Our email provider stores messages you send us. A newsletter service, if used, stores subscriber addresses and may record opens and clicks.
• Hosting and backups. Our web host stores the website, its database, server logs, and periodic backups.

6. How we share your information

We share personal information only as described here:

• Service providers. Companies that provide hosting, payment processing, email delivery, shipping, security, consent management, and analytics on our behalf. They may use your information only to provide services to us and must protect it.
• Shipping carriers. When you order a physical kit, we share your name, shipping address, and, if needed for delivery, your phone number with the carrier delivering your package.
• Service delivery. When we deliver a workshop or consultation for your organization, information you share is used by the people delivering that service. We do not share your organization’s materials with anyone else without your permission.
• Legal and safety reasons. When we believe in good faith that disclosure is required by law, subpoena, or court order, or is necessary to protect the rights, property, or safety of our visitors, customers, the public, or ourselves, including to prevent fraud.
• Project transitions. If operation of this project passes to another person or organization, personal information may transfer with it; the recipient must honor this policy, and we would tell you.
• With your consent. In any other situation where you have asked us to share information or agreed that we may.

7. Cookies and consent

When you first visit sustainfv.org, the CookieYes banner asks for your choices. Strictly necessary cookies are always active because the site and shop cannot function without them. Functional, analytics, performance, and advertisement cookies stay off unless you turn them on. You can change your choices at any time using the cookie settings link or button on the site, and your browser also lets you delete or block cookies.

We do not currently use advertising cookies. The advertisement category exists so that any embedded third-party content that would set them stays blocked unless you allow it.

The complete list of cookies, what they do, and how long they last is in our Cookie Policy.

8. Global Privacy Control and Do Not Track

Global Privacy Control (GPC) is a browser setting or extension that tells websites you do not want your personal information sold or shared for targeted advertising. Where we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information and of targeted advertising for that browser, and we keep optional advertising cookies switched off. Several US state laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), and the laws of states such as Colorado, Connecticut, Oregon, Texas, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, and Maryland, recognize universal opt-out signals of this kind. You can learn more at globalprivacycontrol.org.

The older “Do Not Track” browser setting has no agreed industry standard. Because we do not track visitors across third-party websites, our practices are the same whether or not Do Not Track is turned on.

9. How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy, then delete or anonymize it. Typical retention periods are:

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights. We extend the core rights below to all visitors, regardless of where they live, because we think they are fair.

• Access / know. Ask what personal information we hold about you and receive a copy.
• Correction. Ask us to correct inaccurate or incomplete information. You can also update most account details yourself by logging in.
• Deletion. Ask us to delete your personal information. We may need to keep some records, such as order records required for tax purposes, but we will tell you if so.
• Portability. Receive information you provided to us in a commonly used, machine-readable format.
• Opt out. Opt out of the sale of personal information, targeted advertising, and profiling. We do not engage in these activities, but you may still submit a request.
• Withdraw consent. Where we rely on consent (for example, for the newsletter or optional cookies), withdraw it at any time without affecting earlier processing.
• Restriction and objection (EU/UK). Ask us to limit how we use your data, or object to processing based on legitimate interests.
• Non-discrimination. We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised your privacy rights.

10.1 US state privacy laws

A growing number of US states have comprehensive consumer privacy laws. They include California (the CCPA as amended by the CPRA, with updated regulations that took effect January 1, 2026), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, and, from January 1, 2026, Indiana, Kentucky, and Rhode Island. Many of these laws apply only to organizations above certain size or data-volume thresholds, and a small community-education project like ours may not meet them. Wisconsin does not currently have a comprehensive consumer privacy law. Even so, we will honor the requests described in this section from residents of any state.

If we decline to act on a request, residents of states that provide a right to appeal may appeal our decision by replying to our response email with the subject line “Privacy appeal.” We will respond to appeals within the time required by your state’s law (generally 45 to 60 days) and explain our reasoning. If you are not satisfied, you may contact your state attorney general.

10.2 California notice at collection

For California residents, in the past 12 months we have collected the following categories of personal information described in the CCPA: identifiers (such as name, email address, IP address, and account username); customer records (such as billing and shipping address and phone number); commercial information (such as products and services purchased); internet or network activity (such as pages viewed and security log data); approximate geolocation derived from IP addresses; and inferences limited to aggregated site usage. We collect these from you, your device, and our service providers, for the business purposes described in section 3, and disclose them only to the categories of recipients described in section 6. We do not collect or use sensitive personal information to infer characteristics about you. Retention periods are listed in section 9.

10.3 EU and UK residents

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first, so please contact us at [email protected].

10.4 How to make a request

1. Email us. Send your request to [email protected] with the subject line “Privacy request” and tell us which right you want to use.
2. Help us find your information. Include the email address you used with us and, if relevant, an order number. Please do not send identity documents unless we ask.
3. Verification. To protect your information, we will verify your request, usually by confirming control of the email address associated with your account or orders. For sensitive requests we may ask for one or two additional details that match our records.
4. Our response. We will confirm receipt within 10 business days and respond within 30 days for EU/UK requests or 45 days for US requests. If we need more time, as the law allows, we will tell you why.

You may use an authorized agent to make a request on your behalf. We may ask the agent for proof of your signed permission and may ask you to verify your identity directly with us. Requests are free of charge unless they are manifestly unfounded or excessive.

11. Newsletter and email choices

You can unsubscribe from the newsletter at any time using the link at the bottom of every newsletter email, or by emailing [email protected]. Unsubscribing does not stop transactional emails about orders or scheduled services you have booked, because those are necessary to deliver what you purchased. We do not send marketing text messages.

12. Children’s privacy

Our website is designed for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA) and the Federal Trade Commission’s COPPA Rule, as amended in 2025. Our shop and accounts are intended for people 18 and older. If you are a parent or guardian and believe your child has given us personal information, please email [email protected] and we will delete it promptly. Teachers are welcome to use our articles with students; we simply ask that children not submit information through our forms.

13. How we protect your information

We use reasonable administrative, technical, and physical safeguards appropriate to the size of our project and the sensitivity of the information we hold, including:

• HTTPS encryption across the entire site.
• Firewall, malware scanning, and login protection through Wordfence.
• Two-factor authentication and limited access for administrator accounts.
• Prompt updates to WordPress, themes, and plugins.
• Payment processors that keep card numbers off our servers.
• Regular backups.

No website or online service can be guaranteed to be completely secure. If we learn of a security breach affecting your personal information, we will notify you and the appropriate authorities as required by applicable law, including Wisconsin’s data breach notification statute (Wis. Stat. § 134.98) and, where it applies, the GDPR.

14. International visitors and data transfers

We are based in Wisconsin, and our website and service providers operate primarily in the United States. If you visit from outside the US, your information will be processed in the United States, where privacy laws may differ from yours. Where the GDPR applies, we transfer data as necessary to perform our contract with you, or rely on our providers’ safeguards, such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework.

15. Third-party links and embedded content

Our articles link to many outside resources, such as Focus on Energy, the Wisconsin Department of Natural Resources, UW–Madison Extension, county recycling programs, and The Natural Step. When you follow a link, the other site’s privacy policy applies. Embedded content from other sites, such as videos or maps, may collect data about you as if you visited that site; where possible, we hold it behind the cookie banner until you consent. Linking to or embedding content from an organization does not mean we are affiliated with it; see our Disclaimer.

16. Changes to this policy

We may update this Privacy Policy when our practices, tools, or legal requirements change, and will revise the “Last updated” date at the top. For significant changes, such as a new purpose for using personal information, we will give notice on the site and, where it affects you, by email before the change takes effect. Where the law requires your consent, we will ask for it.

17. How to contact us

If you have questions about this policy, want to make a privacy request, or have a concern about how we handle your information, please contact:

• Who: The operators of Sustainable Fox Valley (sustainfv.org)
• Where: Fox Cities, Wisconsin, USA
• Email: [email protected]

We read every message and aim to respond within a few business days. You can also reach us through the contact page.

Related policies: Cookie Policy · Terms & Conditions · Refund, Return & Cancellation Policy · Disclaimer · DMCA Policy · Accessibility Statement