Legal

Cookie Policy

Last reviewed: September 16, 2026 · v1.3

Plain-language summary. We store a small, fixed set of first-party items to keep you signed in, keep your place in a form you are filling in, and remember this cookie choice. Stripe and Cloudflare set their own on the screens that use them. Two categories are yours to decide — Analytics and Functional — and both are off until you turn them on with Accept all or Customise; Reject non-essential leaves both off, and a Global Privacy Control signal counts as no. Turning one off later deletes what it wrote. The same choices are open to every visitor, in every state and country, and section 3 lists every item by name. This summary is for convenience and is not part of the binding policy.

Section 01: Who we are

This Cookie Policy is published by Penusila Digital Solutions LLC, the company behind DAF Connect. It covers the website at daf-connect.com, the reviewer dashboard, the nonprofit portal, the live demo, and the intake form our customers embed on their own pages. Where a customer embeds that form, the customer's own cookie notice applies to their page; this policy describes what the form itself stores.

DAF Connect · Penusila Digital Solutions LLC

Questions about this policy, and every request described in it, reach us at information@daf-connect.com. Our mailing address is available on request at the same address. How we handle personal information more broadly is in the Privacy Policy; its section 8 is the short version of this page.

Section 02: What cookies and similar technologies are

A cookie is a small text file a website asks your browser to keep and send back on later visits. A first-party cookie belongs to the site you are on; a third-party cookie belongs to another company whose code the page loads.

localStorage and sessionStorage are places a page can keep data in your browser without sending it with every request. localStorage stays until it is removed; sessionStorage is cleared when the tab closes. Most of what this site stores lives here, not in cookies.

A pixel is a tiny image loaded from another company's server so that company can record the visit. We do not use tracking pixels.

An SDK or script is code from another company that runs on our page and may set its own cookies. Three run here, each only where a feature needs it: Stripe.js for bank-account linking and payments, Cloudflare Turnstile for the human check on public forms, and Google Analytics 4 — the last only after you accept it.

Section 03: What we set and why

Everything the site can store in your browser is listed below, grouped the way the cookie banner and the preferences panel group it. Two groups wait for your consent and say so in the “Loads” column: Analytics and Functional. The other two are written when the feature that needs them is used — signing in, typing into a form, linking a bank account — and hold nothing that leaves your browser except where the table says so. Section 4 explains what each switch does and why two of the groups do not have one. The list comes from the code that sets each item and is reviewed with the policy.

Strictly necessary

Needed for the site to do what you asked it to: signing in, the security checks around it, what you have typed into a form you are filling in, the demo you are exploring, and the record of this cookie choice. Always on.

Swipe or scroll sideways to see every column.

Strictly necessary cookies and storage
NameSet byPurposeStorageLastsLoads
base44_access_token, tokenfirst partyAuthentication. Keeps you signed in to the reviewer dashboard, the admin console and the nonprofit portal. Written by our platform SDK on sign-in; "token" is the older name the SDK still writes alongside the first.localStorageUntil you sign out, or until the session the token belongs to expiresAlways on
base44_app_base_url, base44_from_urlfirst partyAuthentication. Where the sign-in flow should return you, and which trusted host issues it. Written only when a link you followed carried these values; anything from an untrusted host is discarded.localStorageUntil you clear site dataAlways on
mfa_session_token, mfa_session_expires_atfirst partySecurity. Proof that this browser passed two-factor authentication, presented when you open something that needs a fresh second factor. Mirrored into sessionStorage for older readers.localStorageUntil you sign out; the server stops accepting it after 12 hoursAlways on
mfa_device_tokenfirst partySecurity. Set only if you tick "trust this device" after two-factor authentication, so you are not asked for a code on every sign-in from this browser. Revocable from Settings.localStorage30 daysAlways on
daf-connect-cookie-consentfirst partyYour cookie choice, stored as {version, categories, at} — one true/false per category — so we do not ask again. Written when you press "Accept all", "Reject non-essential" or "Save my choices"; never written on the strength of a Global Privacy Control signal alone.localStorageUntil you clear site data, or until the policy changes enough for the banner to ask againAlways on
base44_analytics_session_idfirst partyA random id our hosting platform uses to group its same-origin page-load log for one browser: the path opened, the referring page, and how long the tab stayed open. It goes to our own servers only; no third party receives it and it is not gated by the banner.localStorageUntil you clear site dataAlways on
dafconnect_active_enterprise_idfirst partyWhich workspace you are looking at, when your signed-in account belongs to more than one enterprise. Without it every page would have to ask again, so it is not behind a switch; it lives in the tab you are using and goes when you close it.sessionStorageUntil you close the tabAlways on
dafconnect_draft_<embed key>, dafconnect_draft_submission_<id>, dafconnect_demo_draftfirst partyWhat you have typed into the multi-step onboarding form, so a reload resumes where you left off instead of losing it. This is your own input into the form you opened, not a preference about us, so it is not behind a switch — and it is deleted the moment the form is submitted. EIN, bank details, signer ID files and the human-check token are removed before it is saved at all.localStorageUntil the form is submitted, or until you clear site dataAlways on
npReg_draftfirst partyThe fields you have typed into the nonprofit account registration form, so signing in with Google, Microsoft or Apple part-way through does not lose them. Your own input into the form you opened; deleted when the account is created or the sign-in is abandoned.sessionStorageUntil you close the tabAlways on
dafconnect_demo_token, dafconnect_demo_token_exp, dafconnect_demo_enterprise_idfirst partyYour demo session: a token that opens the sample reviewer workspace and the demo enterprise it points at. It is what makes the demo you asked for work, so it is not behind a switch. Not tied to an account.sessionStorageAbout one hour, or until you close the tabAlways on
dafconnect_demo_*, demo_rolefirst partyThe sample data you change while exploring the demo — submissions, nonprofits, audit entries, messages, verification links, reviewer assignments — plus the role you are playing. It is the demo's own state: throw it away and the demo forgets what you just did, so it is not behind a switch. It never leaves your browser and goes when you close the tab.sessionStorageUntil you close the tabAlways on

Functional

How you like a screen arranged after the job is done — list or board, which queue tab, a collapsed sidebar, a dismissed primer. Off unless you turn it on, and everything here is deleted the moment you turn it off.

Swipe or scroll sideways to see every column.

Functional cookies and storage
NameSet byPurposeStorageLastsLoads
daf_pref_*first partyReviewer view preferences — list or board, which queue tab is open, whether drafts are shown, which entity-graph entries you cleared — so they survive a reload. Written only while Functional is on.localStorageUntil you clear site data, or until you turn Functional offOnly with Functional on
dafc_reviewer_primer_dismissedfirst partyRemembers that you closed the one-time reviewer introduction. Written only while Functional is on; with it off the card simply appears again on your next visit.localStorageUntil you clear site data, or until you turn Functional offOnly with Functional on
demo_sidebar_collapsedfirst partyWhether you collapsed the navigation sidebar in the demo workspace. Written only while Functional is on; with it off the sidebar opens at its default width each time.sessionStorageUntil you close the tab, or until you turn Functional offOnly with Functional on

Payments and security

Set by the vendor whose script a feature loads: Stripe when you link a bank account, Cloudflare when a public form checks you are human. Loaded with the feature, not with the page.

Swipe or scroll sideways to see every column.

Payments and security cookies and storage
NameSet byPurposeStorageLastsLoads
__stripe_mid, __stripe_sid (names may vary)Stripethird partyFraud prevention for bank-account linking and payments. Stripe sets identifiers such as __stripe_mid (about 1 year) and __stripe_sid (about 30 minutes) only on pages that load Stripe.js: the bank-account step of the onboarding form, the nonprofit portal's banking settings, one-time verification links, and their demo counterparts.cookieAbout 1 year (__stripe_mid); about 30 minutes (__stripe_sid)When you use the feature
Cloudflare Turnstile challenge token (name may vary)Cloudflarethird partyThe human-verification challenge on our public forms (contact, account creation, nonprofit registration, the onboarding form's review step). Cloudflare may store a short-lived challenge token on its own domain, challenges.cloudflare.com. We keep nothing for it beyond the single-use token the form sends once.cookieShort-lived; set by Cloudflare for the duration of the challengeWhen you use the feature

Analytics

Google Analytics 4. Nothing here loads until you turn Analytics on in the cookie banner or the preferences panel.

Swipe or scroll sideways to see every column.

Analytics cookies and storage
NameSet byPurposeStorageLastsLoads
_gaGoogle Analytics 4third partyTells one browser from another so page views can be counted as visits. Loads only once you turn Analytics on; a refusal, no choice, or a Global Privacy Control signal means no request to Google Analytics at all, and turning Analytics off later expires this cookie on the spot.cookieAbout 2 years, or until you turn Analytics offOnly with Analytics on
_ga_49QDQYNH24Google Analytics 4third partyKeeps session state for our property, G-49QDQYNH24. Loads only once you turn Analytics on, and is expired when you turn it off. The page address reported to Google Analytics has one-time tokens, invitation codes and return URLs replaced with the word "redacted" first.cookieAbout 2 years, or until you turn Analytics offOnly with Analytics on

Requests that set nothing on your device

These are not cookies and store nothing, but each request tells the host your IP address and browser type, so we list them.

  • OpenStreetMapSigned-in reviewer screens

    Map tiles behind the approximate-location map on a submission's applicant-context card and in the blocked-attempt forensics view. Image requests only.

  • Aikido SecurityThe footer of every public page

    The security-audit badge in the footer is an image served from app.aikido.dev.

We do not use advertising cookies, cross-site tracking, or behavioral profiling, and we do not sell or share personal information for advertising.

Section 04: How consent works on this site

On your first visit a banner appears at the bottom of the page. It does not block the page and it carries three buttons of the same size, weight and shape: Accept all, Reject non-essential and Customise. Refusing everything optional, or choosing category by category, is one press — exactly as much work as accepting. Until you press one of them, nothing is requested from Google Analytics and nothing in the Functional group is written. The banner has no close button and Escape does not dismiss it: there is nothing to dismiss, because all three answers are in front of you. It is not shown inside the intake form when a customer embeds it on their own site.

Customise opens the preferences panel — the same panel Cookie settings in the footer opens, and the button further down this page. It lists every category below, with the real number of items in each and their names one tap away, a switch for the two you decide, and three actions of its own: Save my choices (exactly what the switches show), Accept all and Reject non-essential. It opens from your stored record, or, when you have none, with the required groups on and everything else off — we never open it with an optional box already ticked, because a pre-ticked box is not consent. Closing it without saving changes nothing.

Your choice is saved in localStorage under the key daf-connect-cookie-consent as { version: 2, categories: { necessary: true, payments: true, functional: true | false, analytics: true | false }, at: <time> }. The version is 2 today. The two required groups are stored as true because that is what the site does; recording them any other way would be a record of a choice we do not honour. If we change what a category does, the version goes up and the banner asks again with the new wording. A record written under version 1 — which stored a single status of “accepted” or “rejected” — is translated rather than thrown away: an acceptance becomes every category, a rejection becomes the required ones, and the record is rewritten at version 2, so nobody is asked again for an answer whose meaning has not changed. Anything we cannot read counts as no decision. A choice made in one tab applies to your other open tabs without a reload.

The categories, and what each switch does

These are the rows of the preferences panel, in the order it shows them — the two you decide first, the always-on pair after — and every row of the panel links straight to the matching card here. Section 3 lists the individual keys in each.

  • FunctionalYour choice — off until you turn it on

    Remembers how you like our screens arranged — list or board, which queue tab, a collapsed demo sidebar, a reviewer introduction you closed.

    Off means they open at their defaults every time, and turning it off deletes what is already stored under those keys, right away.

    3 items · listed in section 3

  • AnalyticsYour choice — off until you turn it on

    Google Analytics 4 counts page views so we can see which pages are worth keeping, with one-time tokens and invitation codes stripped out of the address first.

    Off means no request to Google Analytics at all, and any _ga cookies already set are expired on the spot. You lose nothing on the site; we lose the page counts.

    2 items · listed in section 3

  • Strictly necessaryAlways on — no switch

    Signs you in, keeps your place in a form you are filling in or a demo you are exploring, remembers this cookie choice, and runs the security checks around all of it.

    It has no switch because the site cannot work without it: you could not sign in, a half-finished application would be lost, and we would have to ask about cookies on every page.

    11 items · listed in section 3

  • Payments and securityAlways on — no switch

    Stripe checks for fraud when you link a bank account, and Cloudflare checks you are human on our public forms — both loaded by the screen that needs them, never by the page you are reading now.

    It has no switch because fraud prevention for a payment you asked us to make is not optional; if you never open those screens, nothing here is set at all.

    2 items · listed in section 3

Why two groups have no switch. Strictly necessary is what the site needs to do the thing you asked it to: sign you in, keep what you have typed into a form you are filling in, keep the demo you opened working, and remember this cookie choice. Payments and security is Stripe's fraud checking and Cloudflare's human check, which load only on the screen that needs them — fraud prevention for a payment you asked us to make is not something we would honour a refusal of, so we do not offer a switch we would then ignore. That is the whole list: there is no third optional category anywhere, and if there were it would be in the panel, because the panel is built from the same inventory this page is.

Accept all turns on both optional categories. Analytics loads Google Analytics 4 with Consent Mode set to deny advertising storage, ad user data and ad personalization; only analytics storage is granted. It sets the two cookies listed in section 3 and records one page view per page you open. Before the address of a page is reported, one-time tokens, invitation codes, sign-in handles and return URLs in it are replaced with the word “redacted” first.

Reject non-essential, or making no choice, means no request to Google Analytics is made at all and nothing in the Functional group is written — those keys do not appear in your browser storage. Our webfonts are served from our own site, so no page loads anything from Google unless you allow Analytics. Turning Analytics off after allowing it stops measurement in this browser immediately, sets no new analytics cookies, and expires the _ga cookies Google already set, on the spot. Turning Functional off deletes that group's keys from your browser in the same moment — in this tab, and in any other tab you have open.

Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as a refusal of everything optional: the banner does not appear, nothing is loaded from Google Analytics, no functional key is written, and nothing is written to storage — the signal is honored for as long as your browser sends it. You can still open the preferences panel and turn a category on explicitly; that choice is saved and it wins.

Do Not Track. There is no agreed standard for the older Do Not Track header, so the site does not change its behavior when it sees one. In practice a visitor sending it is not measured either, because analytics is off until you turn it on. This sentence is the disclosure the California Online Privacy Protection Act asks for.

Changing your mind. Select Cookie settings in the footer of any page, or the button below, to open the preferences panel with your saved choices already filled in, move any switch, and press Save my choices. The change applies at once, with no reload: analytics starts or stops in that instant, and functional keys are written or deleted in that instant. What we do with personal information beyond cookies — and how to ask for a copy of it, or its deletion — is in the Privacy Policy, whose section 8 is the short version of this page.

Your browser's own controls. Every browser lets you see, block and delete cookies and site data, usually under Privacy or Site settings, and a private window discards everything when it closes. Blocking the strictly necessary items breaks signing in, and clearing site data also removes your saved cookie choice, so the banner will ask again.

One first-party log is not gated by the banner: our hosting platform records the path you opened, the referring page and how long the tab stayed open, through a request to our own servers, and keeps the random id listed under strictly necessary in section 3 to group one browser's entries. No third party receives it.

Section 05: Your privacy rights under U.S. state law

20 states have comprehensive consumer privacy laws in force as of the review date, and they differ in detail. We do not sort visitors by state: every choice on this page — accepting or rejecting analytics, asking what we hold about you, asking us to delete or correct it, appealing a refusal — is open to every visitor in every state. The table records what each statute itself grants, so you can see where our practice goes beyond it. Where you applied to a grantmaker through our intake form, that grantmaker is the controller of your application and decides on your request; we help it respond.

  • California

    California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA)

    Cal. Civ. Code § 1798.100 et seq.; regulations at Cal. Code Regs. tit. 11, § 7000 et seq.; see also the California Online Privacy Protection Act, Cal. Bus. & Prof. Code § 22575 et seq.

    Effective
    January 1, 2020; CPRA amendments operative January 1, 2023
    Your rights
    • know and access
    • delete
    • correct
    • portability
    • opt out of sale or sharing
    • limit use of sensitive personal information
    • non-discrimination
    Opt-out signal (GPC)
    required — an opt-out preference signal such as Global Privacy Control must be honored
    Response time
    45 days, extendable once by 45 days
    Notes
    CalOPPA also requires this policy to say how we respond to Do Not Track signals.

  • Virginia

    Virginia Consumer Data Protection Act (VCDPA)

    Va. Code Ann. § 59.1-575 et seq.

    Effective
    January 1, 2023
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    45 days, extendable once by 45 days

  • Colorado

    Colorado Privacy Act (CPA)

    Colo. Rev. Stat. § 6-1-1301 et seq.; rules at 4 Colo. Code Regs. 904-3

    Effective
    July 1, 2023
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since July 1, 2024
    Response time
    45 days, extendable once by 45 days

  • Connecticut

    Connecticut Data Privacy Act (CTDPA), as amended by Public Act 25-62 (Senate Bill 1295)

    Conn. Gen. Stat. § 42-515 et seq.

    Effective
    July 1, 2023; the 2025 amendments took effect July 1, 2026
    Your rights
    • access
    • delete
    • correct
    • portability
    • a list of the third parties we disclosed your data to
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since January 1, 2025
    Response time
    45 days, extendable once by 45 days
    Notes
    The 2025 amendments widened who the law covers, broadened what counts as sensitive data, tightened data minimisation, and added the right to a list of third parties.

  • Utah

    Utah Consumer Privacy Act (UCPA)

    Utah Code Ann. § 13-61-101 et seq.

    Effective
    December 31, 2023
    Your rights
    • access
    • delete
    • portability
    • opt out of targeted advertising and sale
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    45 days, extendable once by 45 days
    Notes
    No statutory right to correct, no profiling opt-out and no appeal process.

  • Texas

    Texas Data Privacy and Security Act (TDPSA)

    Tex. Bus. & Com. Code ch. 541

    Effective
    July 1, 2024
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since January 1, 2025
    Response time
    45 days, extendable once by 45 days

  • Oregon

    Oregon Consumer Privacy Act (OCPA)

    Or. Rev. Stat. § 646A.570 et seq.

    Effective
    July 1, 2024 (nonprofit organizations: July 1, 2025)
    Your rights
    • access, including a list of specific third parties that received your data
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since January 1, 2026
    Response time
    45 days, extendable once by 45 days
    Notes
    House Bill 2008 (2025), in force since January 1, 2026, also bars the sale of precise geolocation data and of the personal data of anyone under 16. We do not sell personal data at all.

  • Florida

    Florida Digital Bill of Rights (FDBR)

    Fla. Stat. § 501.701 et seq.

    Effective
    July 1, 2024
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • opt out of the collection of precise geolocation and of voice or facial recognition data
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    45 days, extendable once by 15 days
    Notes
    Most FDBR obligations apply only to controllers with more than $1 billion in global gross annual revenue that meet additional criteria; we extend the same choices to Florida residents voluntarily.

  • Montana

    Montana Consumer Data Privacy Act (MCDPA)

    Mont. Code Ann. § 30-14-2801 et seq.

    Effective
    October 1, 2024; amendments effective October 1, 2025
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since January 1, 2025
    Response time
    45 days, extendable once by 45 days

  • Delaware

    Delaware Personal Data Privacy Act (DPDPA)

    Del. Code Ann. tit. 6, ch. 12D

    Effective
    January 1, 2025
    Your rights
    • access, including the categories of third parties that received your data
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since January 1, 2026
    Response time
    45 days, extendable once by 45 days

  • Iowa

    Iowa Consumer Data Protection Act (ICDPA)

    Iowa Code ch. 715D

    Effective
    January 1, 2025
    Your rights
    • access
    • delete
    • portability
    • opt out of sale
    • opt out of targeted advertising (by notice)
    • appeal a refused request
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    90 days, extendable once by 45 days
    Notes
    No statutory right to correct and no profiling opt-out.

  • Nebraska

    Nebraska Data Privacy Act (NDPA)

    Neb. Rev. Stat. § 87-1101 et seq.

    Effective
    January 1, 2025
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since January 1, 2025
    Response time
    45 days, extendable once by 45 days

  • New Hampshire

    New Hampshire Privacy Act (NHPA)

    N.H. Rev. Stat. Ann. ch. 507-H

    Effective
    January 1, 2025
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since January 1, 2025
    Response time
    45 days, extendable once by 45 days

  • New Jersey

    New Jersey Data Privacy Act (NJDPA)

    N.J. Stat. Ann. § 56:8-166.4 et seq.

    Effective
    January 15, 2025
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required since July 15, 2025
    Response time
    45 days, extendable once by 45 days

  • Tennessee

    Tennessee Information Protection Act (TIPA)

    Tenn. Code Ann. § 47-18-3201 et seq.

    Effective
    July 1, 2025
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    45 days, extendable once by 45 days

  • Minnesota

    Minnesota Consumer Data Privacy Act (MCDPA)

    Minn. Stat. ch. 325O

    Effective
    July 31, 2025
    Your rights
    • access, including a list of specific third parties that received your data
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • question the result of profiling and be told what you could change
    • appeal a refused request
    Opt-out signal (GPC)
    required since July 31, 2025
    Response time
    45 days, extendable once by 45 days

  • Maryland

    Maryland Online Data Privacy Act (MODPA)

    Md. Code Ann., Com. Law § 14-4601 et seq.

    Effective
    October 1, 2025 (applies to processing on or after April 1, 2026)
    Your rights
    • access, including a list of the categories of third parties that received your data
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    required
    Response time
    45 days, extendable once by 45 days
    Notes
    Maryland limits collection to what is reasonably necessary and prohibits the sale of sensitive data outright.

  • Indiana

    Indiana Consumer Data Protection Act (ICDPA)

    Ind. Code art. 24-15

    Effective
    January 1, 2026
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    45 days, extendable once by 45 days

  • Kentucky

    Kentucky Consumer Data Protection Act (KCDPA)

    Ky. Rev. Stat. Ann. § 367.3611 et seq.

    Effective
    January 1, 2026
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    45 days, extendable once by 45 days

  • Rhode Island

    Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

    R.I. Gen. Laws ch. 6-48.1

    Effective
    January 1, 2026
    Your rights
    • access
    • delete
    • correct
    • portability
    • opt out of targeted advertising, sale, and profiling
    • appeal a refused request
    Opt-out signal (GPC)
    not required by statute; we honor it anyway
    Response time
    45 days, extendable once by 45 days

Narrower state laws that touch cookies

  • Nevada

    Nevada online privacy law (Senate Bill 220 of 2019, as amended)

    Nev. Rev. Stat. § 603A.300 et seq.

    Operators of commercial websites must post a privacy notice and let Nevada consumers opt out of the sale of covered information. We do not sell covered information; requests are answered within 60 days.

  • Washington

    My Health My Data Act

    Wash. Rev. Code ch. 19.373

    Requires consent before collecting or sharing consumer health data, including inferences drawn from online activity. We do not use cookies or analytics to infer health information.

If your state is not listed

Federal law applies to every visitor, and every state has a consumer-protection statute that prohibits deceptive practices, which this policy is written to satisfy. Whether or not your state has a privacy law of its own, every choice on this page is available to you.

  • Federal Trade Commission Act, Section 5

    15 U.S.C. § 45

    Prohibits unfair or deceptive practices. This policy must accurately describe what we do, and we must keep the promises it makes.

  • Children's Online Privacy Protection Act (COPPA)

    15 U.S.C. § 6501 et seq.; 16 C.F.R. pt. 312

    We do not knowingly collect personal information from children under 13, and our services are not directed to them.

How to exercise your rights

Email information@daf-connect.com with the subject “Privacy rights request”. Tell us which right you are using (access, deletion, correction, a copy of your data, or an opt-out), the state you live in, and the email address or account you used with us, so we can find your records. You do not need an account to ask.

We verify that a request comes from the person it concerns before acting on it, usually by replying to the email address on the account or asking you to confirm details we already hold. We never ask for more than we need to check. We answer within 45 days and tell you if we need the one extension the law allows; the table shows the shorter and longer periods a few states set.

If we refuse a request, we say why. Where your state gives you a right to appeal, reply to our decision with the word “Appeal” and we will have someone who was not involved in the first decision review it within the same period. If the appeal is refused you may contact your state attorney general, and we will tell you how.

California residents may use an authorized agent to submit a request. We will ask the agent for your signed permission and may ask you to confirm your identity with us directly.

Section 06: Visitors outside the United States

The banner works the same way everywhere: nothing non-essential loads or is written until you turn it on, refusing is one press of a button the same size as Accept, choosing category by category is one press of a third, and withdrawing is one switch in Cookie settings. That meets the consent standard these laws set.

  • European Economic Area

    General Data Protection Regulation (GDPR) and the ePrivacy Directive

    Regulation (EU) 2016/679, arts. 6, 7 and 13; Directive 2002/58/EC art. 5(3), as amended by Directive 2009/136/EC

    Non-essential cookies and similar storage require prior consent that is freely given, specific, informed and as easy to withdraw as to give. Strictly necessary storage is exempt.

  • United Kingdom

    UK GDPR and the Privacy and Electronic Communications Regulations (PECR)

    Data Protection Act 2018; PECR 2003 (SI 2003/2426) reg. 6

    Same consent standard as the EEA for non-essential cookies.

  • Canada

    PIPEDA and CASL

    Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5; Canada's Anti-Spam Legislation, S.C. 2010, c. 23

    Consent for non-essential cookies may be implied where the purpose is clear and the information is not sensitive; we ask for express consent anyway.

The lawful basis we rely on. For the strictly necessary items we rely on providing the service you asked for (GDPR Article 6(1)(b)); they are also the “strictly necessary” storage Article 5(3) of the ePrivacy Directive exempts from consent, which is the line section 4 uses to decide what gets a switch. What you have typed into a form you are filling in, and the state of a demo you opened, are your own input into the thing you asked for and are kept only for that task, so they sit in that group; how you like a screen arranged afterwards is not, so it sits behind the Functional switch. For the payments and security items — Stripe's fraud prevention and Cloudflare's human check — we rely on our legitimate interest in keeping accounts and payments safe (Article 6(1)(f)). For the functional and analytics categories we rely on your consent (Article 6(1)(a)), which you may withdraw at any time, separately, without affecting anything else. Google processes analytics data in the United States; the Privacy Policy, section 11 describes the transfer safeguards. You may complain to your local supervisory authority, and we would appreciate the chance to resolve the matter first.

Section 07: Children

DAF Connect is a business service for grantmakers and the nonprofits that apply to them. Our Terms of Service require enterprise users to be at least 18. The service is not directed to children, we do not knowingly collect personal information from anyone under 13 (the Children's Online Privacy Protection Act, 15 U.S.C. § 6501 et seq.) or under 16, and nothing on the site is designed to appeal to them. If you believe a child has given us personal information, email information@daf-connect.com and we will delete it.

Section 08: Changes to this policy

We review this page when the code that sets storage changes and at least once a year, and update the “Last reviewed” date at the top. If we add a category, start loading something new before consent, or change what a category does, the stored consent version goes up. Where that makes an earlier answer mean something different, the banner asks every visitor again; where it does not — as when version 1's single Accept/Reject became the per-category record in section 4 — the earlier answer is translated into the new shape and nobody is asked twice for the same thing. A new category is never granted by translation: it starts off. Material changes are announced to enterprise account owners as the Privacy Policy describes.

Section 09: Contact

Penusila Digital Solutions LLC

Cookie questions, privacy rights requests and appeals all reach us at information@daf-connect.com. Our mailing address is available on request at the same address.