Website Privacy Policy

1. Overview and Scope

This Privacy Policy ("Policy") describes how Phil Advisors LLC ("Phil Advisors," "we," "us," or "our"), a registered investment advisor, and Phil Administration Inc. ("Phil Administration"), the operator of the software and technology platform, collect, use, share, and protect information in connection with your use of the Phil DAF Investment Platform, including the website located at www.withphil.com and any related web-based applications, portals, or digital services (collectively, the "Platform").

Phil Advisors LLC and Phil Administration Inc. are separate legal entities. Phil Advisors LLC provides investment advisory services to donor advised funds ("DAFs"). Phil Administration Inc. provides the underlying software infrastructure, account administration technology, and platform services. Both entities may process personal information as described in this Policy and are jointly responsible for the practices described herein unless otherwise specified.

This Policy applies to all visitors, account applicants, registered users, DAF account holders, authorized representatives, and other individuals ("you" or "users") who interact with the Platform. It does not apply to third-party websites linked from the Platform, which are governed by their own privacy policies.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please discontinue use of the Platform.

2. Information We Collect

We collect information in the following categories:

2.1 Personal Identification Information

We collect information that identifies you as an individual, including:

• Full legal name and any authorized account representative names
• Mailing address, billing address, and correspondence addresses
• Email address(es) and telephone number(s)
• Username and password credentials for Platform access
• Donor advised fund account name and any successor or beneficiary designations

2.2 Identity Verification and KYC/AML Data

In compliance with applicable anti-money laundering ("AML") laws, Know Your Customer ("KYC") regulations, and the requirements of our custodians and regulators, we collect:

• Government-issued photo identification (e.g., driver's license, passport, state ID)
• Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN)
• Date of birth
• Citizenship status and country of residence
• Employer Identification Number (EIN) if applicable to an organizational account
• Beneficial ownership information as required by FinCEN and applicable law

2.3 Financial and Account Data

To facilitate DAF account management and investment advisory services, we collect:

• Bank account numbers, routing numbers, and related financial institution details provided for contribution or grant disbursement purposes
• Contribution history, grant history, and investment transaction records
• Investment portfolio holdings, asset allocation, and performance data
• DAF account balances and statements
• Charitable grant recommendations and recipient information you provide
• Tax documentation including Form 990, gift receipts, and related charitable contribution records
• Information about the source of funds contributed to the DAF

2.4 Usage and Technical Data

We automatically collect certain technical information when you access the Platform, including:

• IP address and approximate geographic location derived therefrom
• Browser type, version, and operating system
• Device identifiers and device type (desktop, mobile, tablet)
• Pages visited, time spent on each page, navigation paths, and clickstream data
• Referring URL and exit pages
• Log files and error reports
• Cookie identifiers and similar tracking technology data (see Section 7)

2.5 Communications and Correspondence

We retain records of communications between you and us, including:

• Emails, chat transcripts, and support ticket records
• Investment advisory communications and instructions
• Grant recommendation requests and related correspondence
• Responses to surveys or feedback forms

3. How We Collect Your Information

We collect information through the following means:

Directly from you: When you create or apply for a DAF account, log into the Platform, submit investment instructions, initiate grant recommendations, complete identity verification, contact our support team, or otherwise interact with us.

Automatically: Through cookies, web beacons, pixel tags, server logs, and similar technologies as you navigate and interact with the Platform. See Section 7 (Cookies and Tracking Technologies) for details.

From third parties: From identity verification service providers, financial data aggregators, our custodians and clearing firms, credit reporting agencies (where applicable), government databases used for sanctions screening, and other third-party service providers who assist us in operating the Platform or complying with legal requirements.

From other authorized users: If another authorized individual (e.g., a co-advisor or estate representative) provides information about you in connection with a DAF account you are associated with.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 Providing and Operating the Platform

• Opening, maintaining, and administering your DAF account
• Providing investment advisory services through Phil Advisors LLC
• Processing contributions, investment transactions, and grant disbursements
• Generating account statements, tax documents, and performance reports
• Authenticating your identity and securing your account

4.2 Legal and Regulatory Compliance

• Verifying your identity pursuant to KYC and AML obligations
• Complying with the Bank Secrecy Act, the USA PATRIOT Act, OFAC sanctions screening requirements, and applicable FinCEN regulations
• Complying with SEC regulations applicable to registered investment advisors, including Regulation S-P (Privacy of Consumer Financial Information)
• Responding to lawful subpoenas, court orders, regulatory examinations, or other legal process
• Maintaining books and records as required by applicable financial services laws

4.3 Communications

• Sending account-related notices, transaction confirmations, and statements
• Responding to your inquiries and support requests
• Delivering educational materials about DAF strategies, tax planning, or platform features (with your consent where required)
• Notifying you of material changes to this Policy or our Terms of Service

4.4 Security, Fraud Prevention, and Risk Management

• Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and other illegal activities
• Monitoring for suspicious transactions as required by AML obligations
• Enforcing our Terms of Service and other applicable agreements

4.5 Platform Improvement and Analytics

• Analyzing usage patterns to improve Platform functionality, user interface, and overall user experience
• Conducting internal research, analytics, and quality assurance
• Testing and developing new features (using de-identified or aggregated data where possible)

5. Legal Basis for Processing (GDPR, EU/EEA Users)

If you are located in the European Union or European Economic Area, we process your personal data under the following legal bases as defined in the General Data Protection Regulation (GDPR):

• Contract performance: Processing necessary to establish and perform the DAF account agreement and investment advisory engagement.
• Legal obligation: Processing necessary to comply with applicable laws, including AML, KYC, tax, and financial regulatory requirements.
• Legitimate interests: Processing for fraud prevention, network security, Platform improvement, and business operations, where such interests are not overridden by your rights.
• Consent: Processing for marketing communications and certain analytics activities, where we have obtained your express consent. You may withdraw consent at any time.

6. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your information in the following circumstances:

6.1 Between Affiliated Entities

Phil Advisors LLC and Phil Administration Inc. share information with each other as necessary to provide integrated investment advisory and platform services. Both entities are subject to this Policy and applicable confidentiality obligations.

6.2 Service Providers and Vendors

We engage third-party service providers who process information on our behalf under written data processing agreements, including:

• Custodians and clearing firms holding DAF account assets
• Identity verification and KYC/AML service providers
• Cloud infrastructure and data hosting providers
• Payment processors and fund transfer agents
• Tax preparation and accounting software providers
• Customer relationship management (CRM) and communication platforms
• Cybersecurity and fraud detection vendors
• Analytics and Platform performance providers

6.3 Regulatory and Legal Disclosures

We may disclose your information to:

• Regulatory bodies including the SEC, FINRA, OFAC, FinCEN, and state securities regulators in the course of examinations, investigations, or as required by law
• Law enforcement agencies or courts in response to valid legal process
• Tax authorities as required by IRS reporting obligations and applicable law

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or similar transaction, your information may be transferred to a successor entity. We will provide notice and, where required by law, obtain consent prior to any such transfer.

6.5 With Your Consent

We may share your information with third parties for purposes not listed above when you have provided explicit consent to such sharing.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

The Platform uses the following categories of cookies and similar technologies:

• Strictly Necessary Cookies: Essential to Platform operation, enabling account authentication, session management, and security features. These cannot be disabled.
• Functional Cookies: Enable personalized features such as remembered preferences, language settings, and display preferences.
• Analytics Cookies: Allow us to understand how users interact with the Platform (e.g., Google Analytics or comparable tools). We use this data in aggregate form to improve the Platform.
• Security Cookies: Assist in detecting fraud, unauthorized access attempts, and other security threats.

7.2 Managing Cookies

You may control cookie settings through your browser preferences. Most browsers allow you to refuse or delete cookies; however, disabling strictly necessary cookies may prevent you from accessing certain Platform features. We do not currently respond to browser "Do Not Track" signals, though we will reassess this position as industry standards develop.

7.3 Third-Party Analytics

The Platform may use third-party analytics services. These providers are contractually restricted from using data collected on our Platform for their own purposes and must comply with applicable data protection laws.

8. Data Security

We implement and maintain commercially reasonable administrative, technical, and physical security measures designed to protect your information against unauthorized access, disclosure, alteration, and destruction. Our security program includes:

• Encryption of personal and financial data in transit (TLS/SSL) and at rest (AES-256 or equivalent)
• Multi-factor authentication for Platform access
• Role-based access controls and least-privilege principles
• Regular security assessments, penetration testing, and vulnerability management
• Employee training on data handling and information security
• Incident response and breach notification procedures

Notwithstanding the above, no system is completely secure. You are responsible for maintaining the confidentiality of your login credentials and for notifying us immediately at security@withphil.com if you suspect unauthorized access to your account.

9. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Policy, comply with applicable legal obligations, resolve disputes, and enforce our agreements. In general:

• Account and financial records: Retained for a minimum of seven (7) years following account closure, as required by SEC Regulation S-P, IRS requirements, and state financial recordkeeping laws.
• KYC/AML records: Retained for a minimum of five (5) years following the end of the account relationship, as required by the Bank Secrecy Act and applicable FinCEN rules.
• Investment advisory records: Retained as required under SEC rules applicable to registered investment advisors (generally five (5) years from the date of creation).
• Communications and correspondence: Retained in accordance with SEC electronic communications recordkeeping requirements.
• Usage and analytics data: Retained in identifiable form for up to twenty-four (24) months, after which it may be de-identified or aggregated for longer-term analysis.

When information is no longer required, we securely dispose of it in accordance with our data destruction policies.

10. Your Privacy Rights

Subject to applicable law and certain exceptions, you may exercise the following rights with respect to your personal information. To submit a request, see Section 17 (Contact Us).

• Right to Know / Access: You may request a copy of the personal information we hold about you and information about how we process it.
• Right to Correction: You may request correction of inaccurate or incomplete personal information.
• Right to Deletion: You may request deletion of your personal information, subject to our legal obligations to retain certain records (see Section 9).
• Right to Portability: Where technically feasible and legally required, you may request a portable copy of your personal information.
• Right to Opt Out of Marketing: You may opt out of receiving marketing communications at any time by following the unsubscribe instructions in any such communication or by contacting us directly.
• Right to Non-Discrimination: We will not discriminate against you for exercising any privacy rights available to you.

We will respond to verifiable requests within the timeframes required by applicable law. We may require identity verification before processing certain requests, and we reserve the right to deny requests where legally permitted.

11. California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Policy. It is provided pursuant to the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA").

Note: Certain categories of personal information we collect may be subject to an exemption under the Gramm-Leach-Bliley Act ("GLBA"). To the extent such an exemption applies, we comply with the applicable GLBA requirements, including our annual Privacy Notice obligation under Regulation S-P, in lieu of CCPA/CPRA requirements for that data. Non-GLBA-covered data remains subject to CCPA/CPRA.

11.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

11.2 Your CCPA/CPRA Rights

California residents have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell.
• Right to Delete: Request deletion of personal information, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share personal information as defined under CCPA/CPRA. You may submit an opt-out request in any event via our "Do Not Sell or Share My Personal Information" link available on our website.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond the purposes authorized under CCPA/CPRA without your consent.
• Right to Non-Discrimination: We will not discriminate against you for exercising CCPA/CPRA rights.

To exercise these rights, contact us at privacy@withphil.com or via the methods in Section 17. We will verify your identity before processing requests. Authorized agents may submit requests on your behalf with written permission.

12. EU/EEA Data Subject Rights (GDPR)

This section applies to individuals located in the European Union or European Economic Area. Where Phil Advisors LLC or Phil Administration Inc. act as data controllers with respect to your personal data, you have the following rights under the General Data Protection Regulation ("GDPR"):

• Right of Access (Article 15): Request confirmation of whether we process your personal data and obtain a copy.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): Request deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing is unlawful, subject to legal retention obligations.
• Right to Restriction of Processing (Article 18): Request that we restrict processing of your data under certain circumstances.
• Right to Data Portability (Article 20): Request receipt of your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Article 21): Object to processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Article 7): Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: File a complaint with your local supervisory authority if you believe your data protection rights have been violated.

To exercise GDPR rights, contact our Data Protection contact at privacy@withphil.com. We will respond within 30 days as required under Article 12 GDPR, with a possible extension of two additional months for complex requests.

International Data Transfers: If you are located in the EU/EEA, your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and/or other appropriate safeguards to govern such transfers.

13. Financial Privacy Notice (Gramm-Leach-Bliley Act / Regulation S-P)

Phil Advisors LLC is a registered investment advisor subject to the Gramm-Leach-Bliley Act ("GLBA") and SEC Regulation S-P (Privacy of Consumer Financial Information and Safeguards for Client Records and Information, 17 C.F.R. § 248). This section constitutes part of our annual privacy notice obligation.

We collect nonpublic personal information ("NPI") about you from the sources described in Sections 2 and 3 of this Policy. We use NPI to provide investment advisory and account services and to comply with legal obligations. We do not share NPI with nonaffiliated third parties for purposes of marketing their products to you, and we do not sell NPI.

We share NPI with nonaffiliated third parties only as permitted by Regulation S-P, including:

• To service providers (e.g., custodians, technology vendors) that assist us in providing services to you, subject to confidentiality obligations;
• As required or permitted by law (e.g., to regulators, law enforcement, or tax authorities);
• In connection with the processing and settlement of transactions you authorize.

You may have a right to opt out of certain disclosures of NPI to nonaffiliated third parties. Because we do not share NPI for marketing purposes, no opt-out is currently required beyond the disclosures described above. However, if our practices change, we will provide you with a revised notice and opt-out opportunity as required by law.

Our Regulation S-P Safeguards Program includes written policies and procedures designed to protect client records and information against unauthorized access or use, in accordance with the Safeguards Rule amendments effective 2024.

14. Children's Privacy

The Platform is intended solely for use by adults aged 18 or older. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has submitted personal information to the Platform, we will promptly delete such information. If you believe a minor has provided us with personal information, please contact us at privacy@withphil.com.

15. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, or resources (e.g., charitable organization websites, financial data providers). We are not responsible for the privacy practices or content of such third parties. We encourage you to review the privacy policies of any third-party sites you visit. Our custodians, clearing firms, and other financial service providers maintain their own privacy practices, which are disclosed in their respective privacy notices.

16. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will notify you of material changes by:

• Posting a revised Policy on the Platform with an updated "Last Updated" date;
• Sending an email notification to the address associated with your account for significant changes; and/or
• Displaying a prominent notice on the Platform for a reasonable period following any material update.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acknowledgment of the changes. If you do not agree to the revised Policy, you must discontinue use of the Platform and, if applicable, close your account.

17. Contact Us

If you have questions, concerns, or requests relating to this Policy or our privacy practices, please contact us:

We endeavor to respond to all legitimate requests within thirty (30) days. Requests may require identity verification. We will not charge a fee unless your request is manifestly unfounded or excessive.