Privacy Policy

1 Who we are

[n]dowed is the Optimized Charitable Lead Annuity Trust (OCLAT) planning practice of attorney Jonathon Morrison. In this policy, “[n]dowed”, “we”, “us” and “our” mean that practice, and “you” means anyone who visits ndowed.com or submits our consultation form.

We are the party responsible for the information described here. Under European and UK law we would be called the controller; under California law, a business.

[n]dowed
1950 University Ave, Suite 500
Palo Alto, CA 94303
intake@ndowed.com · 424-335-7945

2 What we collect

Information you choose to give us

Nearly everything we hold about you arrives one way: you filled in the consultation questionnaire at ndowed.com/pages/consultation.html and pressed submit. That form asks about:

• Who you are — first and last name, email address, phone number, street address, city, state, ZIP code, your age, preferred contact method.
• Your household — marital status, spouse’s name and age, length of marriage, whether a prenuptial agreement exists, number of children and their age range, and whether the children are from the current marriage.
• Your finances — estimated net worth, estimated cash, securities and other liquid assets, the makeup of your estate, typical-year ordinary income, this year’s long-term capital gains, major sources of taxable income, annual charitable giving, state of tax residence, and how you hold property with a spouse.
• Your advisors — whether you work with an estate planning attorney, CPA, or financial advisor, and, if you choose to give it, the name and email of the advisor who should receive our analysis.
• Health and citizenship — whether you or your spouse have major health issues, and whether you and your spouse are US citizens or green-card holders.
• Anything else you write — the free-text comments box, and how you heard about the OCLAT.
• Your consent — the checkbox confirming we may use the above to prepare and discuss your analysis.

Only your first name, last name, email address and the consent checkbox are required. Every other field on that form is optional. The financial, health, family and citizenship questions exist because the OCLAT calculation genuinely depends on them — a term length is chosen partly against life expectancy, and the deduction depends on your income and residency. If you would rather not answer one, leave it blank and we will ask you about it only if it turns out to matter.

Information collected automatically

This site is a set of static pages hosted by Netlify. When your browser requests a page, Netlify’s servers record ordinary web-server information — your IP address, the page requested, the time, your browser type and, sometimes, the referring page. We use this only to keep the site running and secure. Netlify retains these logs under its own schedule and we do not build profiles from them.

There is no analytics or advertising software on this site. No Google Analytics, no Meta pixel, no LinkedIn Insight tag, no advertising cookies, no session-replay or heat-mapping tool, no A/B testing platform. We have not installed any, and this policy will be updated before we ever do.

Cookies and browser storage

We set no tracking cookies. Two small values are stored in your own browser’s local storage so the site behaves sensibly on a return visit:

• ndw_tour — remembers that you have already seen the guided tour, so it does not reopen every time.
• ndw_ada — remembers your accessibility preferences (larger text, higher contrast, reduced motion) from the accessibility button in the corner of the page.

Neither value is a cookie, neither is transmitted to us or to anyone else, and both sit only on the device you are reading this on. Clearing your browser’s site data removes them.

Third parties your browser contacts

We would rather tell you this than have you find it in a network inspector:

• Google Fonts. Our typefaces load from fonts.googleapis.com and fonts.gstatic.com. Google therefore sees the IP address of anyone who loads a page here. Google states that it does not use Google Fonts requests to build advertising profiles.
• Press images. Several pages display article thumbnails and publication logos served directly from the publishers’ own websites — Fortune, Forbes, Barron’s, Bloomberg Tax, Wikimedia and others. Loading those images lets those hosts see your IP address, exactly as visiting their sites would. We do not receive anything back from them.
• Netlify. Our host, which serves every page and stores consultation submissions.
• Resend. The email service that delivers your submitted form to us as an intake notification.

We embed no social media widgets, no chat bots, no advertising tags, and no video players that track you.

3 Categories, in the statutory form

California’s privacy law asks businesses to describe what they hold using its own list of categories. Here is ours, complete, including the ones that are empty.

4 Why we use it

We use what you give us for these purposes and no others:

• To prepare your OCLAT analysis. The figures, term length and step-up rate are calculated from your own numbers.
• To talk to you about it. Answering your questions, scheduling a call, and following up on a request you started.
• To send the analysis to the advisor you named, if you asked us to and gave us their details.
• To keep the site working and secure, including blocking spam submissions through the form’s hidden anti-bot field.
• To meet our professional and legal obligations, such as conflict checks, recordkeeping and responding to lawful requests.

We do not use your information to train machine-learning models, to build marketing audiences, or to enrich it with data bought from third parties.

5 Sensitive information

Two of our optional questions touch on categories the law treats as sensitive: health, and citizenship or immigration status.

We ask about health because a lead annuity trust is sized partly against life expectancy, and about citizenship because the charitable deduction and the trust’s structure depend on tax residency. We use those answers only to prepare and discuss your analysis. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and we do not use it for any purpose beyond those a business is permitted to carry out under California Civil Code §1798.121 without offering a right to limit. You may leave both blank.

6 Who we share it with

A short and closed list:

• Attorney Jonathon Morrison and his law firm, Frazer Ryan Goldberg & Arnold, LLP, so that your analysis can be prepared and, if you engage the firm, so that the trust can be drafted. Communications with the firm about legal advice may also be protected by attorney–client privilege, which is a stronger protection than this policy.
• The advisor you name, and only that advisor, if you gave us their contact details and asked that they receive your analysis.
• Service providers who host and deliver the site — principally Netlify (hosting and form storage) and Resend (intake email delivery). They act on our instructions, are bound by their own contractual confidentiality obligations, and may not use your information for their own purposes.
• Authorities, when the law requires it — a subpoena, court order or other legally valid demand, or where disclosure is necessary to protect rights or safety. We do not volunteer your information.
• A successor, if the practice is ever merged, acquired or reorganized. This policy, or one at least as protective, would follow your information.

That is the complete list. We share your information with no one else without asking you first.

7 Selling, sharing and advertising

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not done either in the preceding twelve months, and we do not do it with the information of anyone we know to be under 16.

“Sell” and “share” carry specific legal meanings that reach beyond exchanging data for money — passing information to an advertising network counts even when no money changes hands. Neither applies to us, because there is no advertising technology on this site at all.

8 How long we keep it

• Consultation submissions are kept while your inquiry is active and, if you go on to engage the law firm, for as long as professional recordkeeping rules require. If you do not engage the firm, we keep the submission for up to two years so we can pick up the conversation where it stopped, and then delete it.
• Intake notification emails live in our mailbox and are deleted on the same schedule.
• Server logs are retained by our host for a limited period under its own schedule, and are not linked to your form submission.
• Browser storage values stay on your device until you clear them.

You can shorten any of this. Ask us to delete your information and we will, subject only to records we are professionally or legally required to retain — and we will tell you if that applies to you.

9 How we protect it

Every page and every form submission travels over an encrypted TLS connection; the site is served over HTTPS only, with HTTP Strict Transport Security enabled. Submissions are stored by our host with access restricted to the people who need it, and the site sets browser security headers to reduce the risk of framing, content-type confusion and referrer leakage.

We ask for the minimum that makes an accurate analysis possible, which is itself a security measure: information we never collect cannot be exposed.

No website or transmission method is perfectly secure, and we will not claim otherwise. If a breach affecting your information ever occurs, we will notify you and the relevant authorities as the law requires.

10 California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights. We honor them for everyone who asks, wherever you live.

• Right to know. What we have collected about you, where it came from, why we collected it, and who we disclosed it to.
• Right to access. A copy of the specific pieces of personal information we hold, in a portable form.
• Right to delete. Deletion of what we hold, subject to the narrow exceptions the statute allows.
• Right to correct. Correction of anything inaccurate.
• Right to opt out of sale or sharing. There is nothing to opt out of — we do neither — but the right is yours and we will confirm it in writing on request.
• Right to limit use of sensitive personal information. We already confine sensitive information to the permitted purposes described in section 5.
• Right against retaliation. We will not deny you service, charge you differently, or give you a lesser analysis because you exercised a privacy right.

Shine the Light. California Civil Code §1798.83 lets residents ask whether a business disclosed personal information to third parties for those parties’ own direct marketing. We do not, and never have.

11 Other US state rights

Comprehensive privacy laws now operate in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island and elsewhere. They differ in detail but converge on the same core: the right to confirm whether we process your data, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects.

We grant all of these to any resident of any state that provides them, and we do none of the three activities the opt-out covers. Several of these laws also require consent before processing sensitive data — which is why our health and citizenship questions are optional and sit behind an explicit consent checkbox.

Appeals. If we decline a request, we will tell you why, and you may appeal by replying to our response or writing to intake@ndowed.com with “Privacy appeal” in the subject line. We will respond to an appeal within 45 days with a written explanation. If we deny the appeal, you may contact your state attorney general.

12 How to exercise a right

Email intake@ndowed.com, or write to the Palo Alto address in section 1, or call 424-335-7945. One sentence is enough — you do not owe us a reason.

• Verification. Before we act, we need to be reasonably sure you are who you say you are. Usually that means replying from the email address you used on the form. For a deletion or access request we may ask you to confirm two details from your submission. We use anything you send for verification only, and discard it afterwards.
• Timing. We acknowledge requests within 10 business days and answer them within 45 calendar days. If a request is genuinely complex we may extend once, by up to 45 further days, and we will tell you before we do.
• Cost. Free. If a request is manifestly unfounded or repetitive we may charge a reasonable fee or decline, and we will explain why.
• Authorized agents. Someone may act for you if they provide written permission signed by you, and we may still contact you directly to confirm it.

13 Do Not Track and Global Privacy Control

Browsers send a Do Not Track header inconsistently and there is still no agreed standard for responding to it, so like most sites we do not act on it — there is nothing here to switch off.

The Global Privacy Control signal is different: it is a legally recognized opt-out in California and several other states. We treat a GPC signal as a valid opt-out request. In practice it changes nothing, because we do not sell or share personal information for advertising in the first place.

14 Children

This site is intended for adults making estate and charitable planning decisions. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. The consultation form asks for the age range of your children, which is information about them provided by you, their parent, and used only to size the trust term correctly — we do not ask for their names, contact details, or anything else identifying.

If you believe a child has given us information directly, write to intake@ndowed.com and we will delete it.

15 Links to other sites

We link out to published articles, the IRS, professional directories, law firm profiles and, on one page, to the major AI assistants. Those destinations have their own privacy policies and we do not control them. This policy covers only ndowed.com.

16 Changes to this policy

When we change this policy we will update the “last updated” date at the top. If a change materially affects how we use information you have already given us — a new category of recipient, a new purpose, or anything approaching a sale — we will not apply it to that information without contacting you first and asking.

17 How to reach us

Privacy questions, requests, corrections, complaints and appeals all go to the same place, and a person reads them.

This privacy policy describes how we handle information. It is not legal or tax advice, and reading it or contacting us does not by itself create an attorney–client relationship. Nothing here limits any right you have under applicable law.