Who we are

UMMA Center is run by UMMA Foundation Inc, a New York nonprofit (EIN 86-3883211), at 6 Arc Place, Staten Island, NY 10306.

This policy covers ummacenter.com and the services we run through it. Questions go to hello@ummacenter.com.

What we collect

We only collect what you, a parent or guardian, or our staff give us, plus a little technical data.

Your account: email address, and a password we store only in scrambled (hashed) form. If you use Google, we get your name and email from Google.
Your household: names, dates of birth, phone numbers, address, and how people are related.
Children: what a parent or guardian tells us so we can care for a child — allergies, medical notes, medicines, doctor and insurance details, emergency contacts, who may pick them up, and any custody limits.
Consents you give or refuse: photos, video, medical care, transport and marketing.
Sign-ups and visits: registrations, RSVPs, check-ins at the front desk, and café purchases.
Payments and donations: amounts and dates. Stripe holds the card; we keep only Stripe’s reference numbers.
Messages: contact forms, applications to volunteer or mentor, and questions you ask us.
Technical data: your IP address (used for a day to stop abuse), and error reports when something on the site breaks.

How we use it

We do not sell your data. We do not use it for advertising profiles.

To run programs, keep children safe, and know who is in the building.
To take payments, send receipts and tax letters for donations.
To email you about your account, bookings and payments.
To send news and updates, if you have not opted out.
To fix problems and stop misuse of the site.

Our staff and volunteers see what they need for their role. Our rule is that a child’s medical and pickup details are seen only by the people caring for that child.

We use these companies to run the site. They may only use your data to provide their service to us:

Supabase — stores our database and runs sign-in.
Vercel — hosts the website.
Stripe — takes card and bank payments. We never see or store your full card number.
Resend — sends our emails.
Google — Analytics on public pages, the language switcher (Google Translate), "Continue with Google" sign-in, and our email inbox.
Anthropic — answers questions in the site assistant, when you use it.

The site assistant

If you use the assistant, your messages in that chat are sent to Anthropic to write a reply. We do not save the chat. Please do not type health or payment details into it.

Cookies

We use a small number of cookies and browser storage:

Sign-in cookies, so you stay signed in. They are needed for your account to work.
Google Analytics cookies, on public pages only. Never on sign-in, account, payment or check-in pages.
A language cookie, only if you pick a language other than English.
Short-lived browser storage that remembers which page brought you to a sign-up, and a café cart on the café till.

Emails

Emails about your account, bookings and payments are always sent.

News, reminders and updates are sent unless you opt out. Every one of those emails has a one-click unsubscribe link, and you can change your choices in your account.

Children

Accounts are for adults. Children do not get their own account. A parent or guardian gives us a child’s details, and can see, change or ask us to remove them.

We collect a child’s health details only to keep that child safe while they are with us.

How long we keep it

We keep your details while you have an account or take part in programs.

Some records we must keep even after you leave: payments, donations and tax receipts, and safety records such as incidents and check-ins. We do not delete these.

Abuse-prevention records of IP addresses are deleted after one day.

Your choices

See or correct your details in your account, or ask us.
Ask for a copy of your data, or ask us to delete it, by emailing hello@ummacenter.com. We reply within 30 days. We will tell you if we must keep something, and why.
Take back a photo or marketing consent at any time by telling us.
Unsubscribe from news and updates at any time.

Keeping it safe

Data is sent over encrypted connections and stored with access controls, so people only see what their role allows. No system is perfect. If a breach affects your data, we will tell you as the law requires.

Changes

If we change this policy, we will update the date at the top. If a change is important, we will tell account holders by email.

Your data, in plain words.