Privacy Policy
Draft — pending legal review.
The short version: we collect only what we need to post you a kit, we never touch your DNA, we don't sell anything to anyone, and we delete your details once your kit is on its way.
1. Who is responsible for your data
The data controller is Benny Friedman, a sole trader based in Gabon, trading as «crypto-jews.org.» Contact: crypto-jews-org@protonmail.com.
2. What we collect
From the kit request form: your name, email address, postal address and country, plus anything you choose to write in the optional family-story field. From the contact form: your name, email and message. That is the entire list.
We also receive aggregate analytics (see our Cookie Policy), but only if you accept the cookie banner.
3. What we do NOT collect
This is the most important section on the page. Crypto-jews.org never receives, sees, stores or retains your DNA sample or your genetic data. Your swab goes directly to the testing partner and is processed solely by them. We are not a genetics company and we hold no genetic database.
The testing partner returns to us only a limited result indicator — whether markers associated with Sephardic or Jewish ancestry were detected — and never your full genetic report, your raw data, or any health finding. To be unambiguous: that indicator is an ancestry signal. It is not a determination of Jewish status, and it is not a determination of Law of Return or citizenship eligibility, which no laboratory can make.
4. Why we may use it, and on what basis
- To send you a kit — we need your name and address to post it. Basis: your consent, and performance of what you asked us to do.
- To reply to you — if you write to us. Basis: your consent.
- Analytics — aggregate site measurement. Basis: your consent, which you can refuse.
Genetic data is special-category data. It is processed by the testing partner on the basis of your explicit consent, given separately on our DNA & Biometric Consent page — not bundled into this policy or into the request form.
5. Research use — a separate choice
The testing partner may wish to use genetic data internally for research into Jewish ancestry patterns. That is a separate, optional, explicit consent. It is never a condition of receiving a kit, you may decline it and still get tested, and you may withdraw it later. If you did not knowingly opt in, it does not apply to you.
6. Who your data reaches
- The testing partner — receives your sample and genetic data directly, under their own privacy policy.
- Formspree — processes our form submissions; hosted on AWS in the United States. Formspree states that it is GDPR-compliant, acts as a data processor under Standard Contractual Clauses, and supports CCPA rights.
- Netlify — hosts the site.
We do not sell your data, and we do not share it with advertisers, brokers or any government.
7. International transfers
We are based in Gabon; our form processor is in the United States; you may be anywhere. Your data therefore crosses borders. Where EU or UK law applies, transfers rely on Standard Contractual Clauses with our processor. If you would rather not have your details processed this way, do not use the form — email us instead.
8. How long we keep it
We keep your intake details only as long as needed to fulfil your kit request, and then delete them. Genetic data retention is governed by the testing partner's own policy, not ours — because we never hold it.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your data, to withdraw consent at any time, and to complain to your data protection authority. Under the GDPR and UK GDPR you have all of these. Under the CCPA you may know, delete and opt out; we do not sell personal information.
To exercise them: for the details we hold, email crypto-jews-org@protonmail.com and we will action it. For your genetic data, you must contact the testing partner directly — only they hold it, and only they can delete it. We will tell you who they are and how to reach them.
10. Children
This service is for adults. You must be 18 or older. We do not knowingly collect data from minors, and will delete it if we discover we have.
11. Security
The site is served over HTTPS with HSTS. We keep the data we hold to the minimum and delete it promptly, which is the strongest protection we can offer: data we do not keep cannot be lost.
12. Changes
Updates are published here with a new date at the top. If a change is significant, we will say so plainly.