Privacy · The L40 Foundation

Scholarship applications

What the application asks for

The applying organization’s name, contact person and phone number
The athlete’s name and age
A parent or guardian’s name and email address
Household size and annual household income
The support requested, the family’s circumstances and the athlete’s wrestling goals
A typed signature, confirmation that the person applying is an adult, and consent to the application terms
Gender, ethnicity and disability. Each question includes a “Prefer not to say” answer.

The application does not accept file uploads.

Who can see it

Only foundation staff whose email addresses are on an approved list can open applications, after signing in through a one-time link sent to that address. There is no public way to look up an application.

How it’s protected

Applications are sent over an encrypted connection.
The full application is encrypted (AES-256-GCM) before it is stored. Staff notes about an application are encrypted the same way.
Email alerts to staff say only that a new application arrived. They never include applicant details.
An activity log records each application’s ID, what happened to it (submitted, status changes, notes added, deletion), the status before and after, which staff member acted and when. It does not record what the application or a note says.

How long it’s kept

Applications are kept for a set retention period, one year unless the foundation configures otherwise. They are not deleted automatically: once that period has passed, staff review the list and delete applications only after confirming the deletion. Staff can also delete an application sooner on request.

Deleting an application permanently removes the application and its staff notes. The activity log entries for that application are kept: its ID, the actions and status changes (including the final decision), which staff member acted and when. They contain no applicant details.

Donations

Card donations

Card donations are processed by Stripe. You enter your payment details on Stripe’s checkout page, not on this site, and Stripe handles them under its own privacy policy. This site keeps only the checkout reference, the amount, the currency and whether the payment succeeded. It does not store your name, email address, billing address or card details.

Cryptocurrency donations

Cryptocurrency donations are sent directly from your wallet to the foundation’s published address. This site doesn’t connect to your wallet or ask for any information. Blockchain transactions are public and permanent, so anyone can see the sending address, amount and time.

Staff sign-in

When an approved staff member signs in, the site stores their email address with a hashed sign-in token that expires shortly and works once, and a hashed session identifier. The session is kept in a secure cookie that page scripts can’t read, and signing out ends it on the server. Expired or ended sign-in records are removed by routine cleanup about a day after they stop working, not immediately.

Visiting the site

This site doesn’t use analytics, advertising or tracking cookies. Fonts and images are served from this site, not third-party services. Like most websites, the server that hosts it may keep standard technical logs, such as IP address, time and page requested, to keep the site running and secure. To prevent abuse, forms keep short-lived counters stored under keyed one-way codes rather than raw email or network addresses. Routine cleanup removes each counter within about two days of its last use.

Young athletes

Many athletes the foundation supports are children. Applications must be completed by someone 18 or older who is the athlete’s parent or guardian or has their permission to apply.

Your choices

To ask what information the foundation holds about you or an athlete in your care, or to have it corrected or deleted, email contact@thel40foundation.com. Other ways to reach the foundation are on the contact page.

If this notice changes, the date at the top of the page will change too.