How ESSA handles information
Privacy
On this page+
01Who We Are
The ESSA Foundation is a registered 501(c)(3) nonprofit organization (EIN: 41-4251617) headquartered in the United States. We provide fiscal sponsorship, legal infrastructure, curriculum support, and industry connections to STEM-focused student clubs, community initiatives, and academic programs worldwide.
For purposes of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, The ESSA Foundation is the data controller of personal data processed through this website.
| Organization | ESSA Foundation |
|---|---|
| Legal status | 501(c)(3) nonprofit corporation |
| EIN | 41-4251617 |
| Privacy contact | [email protected] |
| Website | essaf.org |
02Information We Collect
2.1 Information You Provide Directly
When you submit a fiscal sponsorship application through our website, we collect the following information:
- Identity and contact information: Your full name, email address, and role within your organization.
- Organization information: Organization name, type, school or institution, city and country, and website URL.
- Mission and program details: Mission statement, primary activities, populations served, STEM focus areas, and geographic scope.
- Team and legal status: Number of active members or volunteers, current legal structure, and whether a governance document exists.
- Financial information: Estimated annual budget needed, current operating budget, and primary funding sources.
- Impact information: Number of people served per year and how your organization measures impact.
- Supplementary information: Any additional context, notes, or information you voluntarily include in the open-ended field.
2.2 Information Collected Automatically
Cloudflare processes standard request information when it delivers and protects this website. ESSA limits the information retained by the application itself:
- Security and rate limiting: The application converts the request IP address and user-agent into one-way hashes for short-lived abuse controls and security audit records. Raw IP addresses are not stored in application or registration records.
- Human verification: Cloudflare Turnstile processes technical request and browser signals to distinguish people from automated abuse on protected forms.
- Aggregate website analytics: Cloudflare Web Analytics provides aggregate counts such as page views, popular pages, device type, and general country. ESSA does not create an application-level visitor fingerprint.
- Standard request logs: Cloudflare and our hosting infrastructure may temporarily process request path, timestamp, response status, and similar operational information needed to deliver and secure the site.
03How We Collect It
We collect information through the following mechanisms:
- Application form: Information you enter and submit through the fiscal sponsorship application form at essaf.org/organizations.
- Cloudflare security and analytics: Cloudflare delivers the site, validates Turnstile challenges, mitigates abuse, and produces aggregate Web Analytics reports.
- Server-side validation: When you submit a form, our server validates the form, checks its origin and Turnstile token, and applies a short-lived rate limit using a one-way IP-derived hash.
We do not use marketing cookies or advertising pixels. The secure staff portal uses strictly necessary, HTTP-only authentication cookies and a CSRF cookie to protect authorized staff access. Content-editing forms may keep a temporary recovery draft in the authorized staff member's browser local storage.
04How We Use Your Information
| Process your application | Review and evaluate your fiscal sponsorship application, contact you about its status, and onboard accepted organizations. |
|---|---|
| Fraud prevention and security | Detect automated submissions, duplicate applications, spam, and abuse using Turnstile and short-lived one-way request hashes. |
| Rate limiting | Enforce submission limits using one-way IP-derived hashes that expire after their security window. |
| Internal record-keeping | Maintain a record of applications received for operational and compliance purposes. |
| Communicating with you | Respond to questions or requests you send to our contact email addresses. |
| Legal obligations | Comply with applicable law, respond to lawful government requests, and enforce our terms. |
We do not sell your personal information. We do not use your information for behavioral advertising. We do not use your information to train machine learning models.
05Legal Basis for Processing (EEA and UK)
If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, we are required to identify a lawful basis for each processing activity under GDPR Articles 6 and 9.
| Processing your application form data | Article 6(1)(b): processing is necessary to take steps at your request prior to entering into a contract (the fiscal sponsorship agreement), and Article 6(1)(f): our legitimate interest in evaluating applications and running our sponsorship program. |
|---|---|
| Processing request information for fraud prevention and rate limiting | Article 6(1)(f): our legitimate interest in protecting the security and integrity of our application system. ESSA minimizes this processing by retaining one-way hashes instead of raw IP addresses in application security records. |
| Sending application data to our team via email | Article 6(1)(b): necessary to process the application; Article 6(1)(f): legitimate interest in reviewing applications submitted to us. |
| Retaining records of submitted applications | Article 6(1)(c): compliance with legal obligations applicable to nonprofits; Article 6(1)(f): legitimate interest in maintaining operational records. |
06How We Share Your Information
We do not sell, rent, or trade your personal information. We share it only in the following circumstances:
6.1 Service Providers (Data Processors)
We engage the following third-party service providers who process personal data on our behalf under contractual data processing agreements:
| Resend (Resend Inc.) | We use Resend to deliver transactional emails, including application intake and confirmation messages. Resend receives the email address and message content needed for delivery. We do not send browser fingerprints or raw IP addresses to Resend. |
|---|---|
| Cloudflare, Inc. | Cloudflare delivers and protects the website, runs the application Worker, validates Turnstile challenges, supplies aggregate Web Analytics, and stores uploaded objects in R2. Cloudflare processes request information needed to provide those services. |
| Supabase, Inc. | Supabase provides the PostgreSQL database and administrative authentication. Sensitive application, health, safety, pickup, and emergency-contact values are encrypted by the application before database storage, and database access is restricted with server authorization and Row Level Security. |
6.2 Legal Disclosure
We may disclose your information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
6.3 Organizational Transfers
If The ESSA Foundation merges with, is acquired by, or transfers its assets to another organization, your information may be transferred as part of that transaction. We will notify affected individuals as required by law.
6.4 No Other Sharing
We do not share your information with any other third parties, including advertisers, data brokers, analytics platforms, or social media networks.
07International Data Transfers
The ESSA Foundation is based in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country.
For individuals in the EEA, UK, or Switzerland, we rely on the following transfer mechanisms for transfers to the United States:
- Standard Contractual Clauses (SCCs): Our agreements with Resend and Cloudflare incorporate the European Commission’s Standard Contractual Clauses (2021/914/EU) for controller-to-processor transfers, providing appropriate safeguards for your data.
- Data Processing Agreements: Each sub-processor has executed a GDPR Article 28-compliant data processing agreement with us.
You may request a copy of the relevant transfer safeguards by contacting us at [email protected].
08Data Retention
| Organization application data | Initially scheduled for deletion 24 months after submission. If an application is approved, a documented relationship or legal retention requirement may require a different retention date. |
|---|---|
| Raw IP address | Not stored in organization application or program registration records. Cloudflare may retain network logs under its own service-retention terms. |
| One-way rate-limit and security hashes | Rate-limit entries expire after their configured security window. Security audit records are retained only as long as operationally necessary. |
| Program registration records | Retained for two years after the program end date unless a longer period is required for a legal obligation, an active dispute, or a documented retention hold. Sensitive fields are redacted through the program retention workflow. |
| Rate-limiting records (IP-to-timestamp) | Automatically expire after 10 minutes. Not retained beyond that window. |
| Email correspondence | Retained for 3 years, then deleted or anonymized. |
09Security
We implement technical and organizational measures to protect your personal information against unauthorized access, loss, alteration, and destruction. These include:
- All data is transmitted over encrypted HTTPS connections using TLS 1.2 or higher.
- HTTP security headers are applied on all responses, including Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
- Application submissions are protected by server-side input validation, HTML output escaping, and rate limiting.
- Access to application data is restricted to ESSA Foundation staff directly involved in processing applications.
- Our website is served through Cloudflare, which provides DDoS protection, WAF filtering, and bot management.
No method of transmission over the internet or method of electronic storage is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee its absolute security.
10Your Rights: EEA, UK, and Switzerland
If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR and UK GDPR:
| Right of access (Art. 15) | You may request a copy of the personal data we hold about you and information about how we process it. |
|---|---|
| Right to rectification (Art. 16) | You may ask us to correct inaccurate personal data or complete incomplete data. |
| Right to erasure (Art. 17) | You may ask us to delete your personal data where it is no longer necessary for the purposes it was collected, or where you have withdrawn consent (where consent is the basis). Note that we may be required to retain certain records under legal obligations. |
| Right to restriction (Art. 18) | You may ask us to restrict processing of your data in certain circumstances, for example while a rectification request is being resolved. |
| Right to data portability (Art. 20) | Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format. |
| Right to object (Art. 21) | You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests. |
| Right to withdraw consent | Where we rely on consent as a legal basis, you may withdraw it at any time without affecting the lawfulness of prior processing. |
| Right to lodge a complaint | You have the right to lodge a complaint with your local supervisory authority. In the EU, this is your national data protection authority; in the UK, this is the Information Commissioner's Office (ico.org.uk). |
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before processing your request.
11Your Rights: California Residents
If you are a California resident, the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), grants you the following rights with respect to your “personal information” as defined under that law.
Categories of Personal Information Collected
In the preceding 12 months, we have collected the following CCPA categories of personal information:
| Identifiers | Name, email address, IP address |
|---|---|
| Personal information (Cal. Civ. Code) | Name, contact information, financial information (budget estimates) |
| Internet or network activity | Aggregate Cloudflare analytics and short-lived security records |
| Geolocation data | Aggregate country-level information supplied by Cloudflare Web Analytics |
| Professional or employment information | Organizational role, organization name, school or institution |
Your CCPA/CPRA Rights
- Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purposes, and the categories of third parties we share it with.
- Right to delete: You may request deletion of personal information we have collected about you, subject to certain exceptions (e.g., legal obligations).
- Right to correct: You may request correction of inaccurate personal information.
- Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out mechanism is required.
- Right to limit use of sensitive personal information: We do not use sensitive personal information for purposes other than those disclosed here.
- Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.
To submit a CCPA request, contact us at [email protected] with the subject line “California Privacy Request.” We will respond within 45 days. We may extend this period by an additional 45 days when reasonably necessary and will notify you of the extension.
12Children’s Privacy
Our general website and fiscal sponsorship application process are not directed to children under the age of 13. Some ESSA programs do serve younger students; their registrations are submitted by a parent or legal guardian, who provides the required consent and can use the registration-management link to update or cancel the submission.
If you believe we may have collected information from a child under 13, please contact us at [email protected].
Some of the organizations that apply for fiscal sponsorship are student clubs operated by individuals between the ages of 13 and 17. Where a minor submits an application, they represent that they have obtained appropriate consent from a parent or guardian. If you are between 13 and 17 and submitting an application on behalf of your organization, please review this policy with a parent or guardian before doing so.
13Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the “Last updated” date at the top of this page.
For material changes, we will provide a more prominent notice, such as a notice on our homepage or, where we have your email address, by emailing you directly. We encourage you to review this page periodically.
Your continued use of our website or submission of an application after we post changes to this policy constitutes your acknowledgment of those changes.
14Contact Us
If you have questions about this Privacy Policy, wish to exercise your rights, or want to report a privacy concern, please contact us:
| [email protected] | |
| Subject line | Privacy Request |
| Response time | We aim to respond within 5 business days for general inquiries and within 30 days for formal data subject requests. |
| Postal address | ESSA Foundation, 100 N Howard St STE R, Spokane, WA 99201 |
If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your member state. In the UK, the relevant authority is the Information Commissioner’s Office at ico.org.uk.