The site should collect the minimum information necessary to operate securely and effectively. If analytics or third-party services are later introduced, the Foundation should disclose them plainly and keep data collection proportionate to institutional need.