TormanoCookie Policy
This Cookie Policy explains how F&D Ventures LLC, doing business as Tormano (“Tormano,” “we,” “us,” or “our”), uses cookies and similar technologies on tormano.com, crm.tormano.com, and npcrm.tormano.com (collectively, the “Sites”). The Tormano application at crm.tormano.com and npcrm.tormano.com is called the “Service.” This policy should be read together with our Privacy Policy.
1. What cookies are
Cookies are small text files stored on your device by your web browser when you visit a website. Similar technologies include browser local storage, session storage, pixels, and web beacons. Cookies can be “first-party” (set by the site you are visiting) or “third-party” (set by a service embedded on the site, such as an analytics provider).
2. Categories of cookies we use
2.1 Strictly necessary
These are required for the Service to function and cannot be disabled. They hold your signed-in session, the moment it expires, a copy of your own user record, and your cookie consent choice. Without them you could not sign in or stay signed in. Section 3 lists each one by name.
2.2 Functional preferences
Some browser storage is not strictly necessary but remembers how you like things: your theme and display density, whether the sidebar is collapsed, which one-time notices you have dismissed, how you last sorted a dashboard, and which audience version of our marketing pages you were reading. They are first-party, are never sent to a third party, and are not used to track you. You can clear them at any time through your browser.
2.3 Analytics (optional, consent-based)
We use Google Analytics 4 on our public marketing pages at tormano.com to understand aggregate usage: which pages are visited, which features are looked at, and how visitors reach us. Analytics cookies are set by Google. Analytics is disabled by default for every visitor, wherever you are, and is enabled only after you click “Accept” on the cookie banner. Until you accept, Google’s consent signal for analytics storage is set to “denied” and no analytics cookie is written. IP anonymization is enabled. The application itself, at crm.tormano.com and npcrm.tormano.com, contains no analytics at all. You can withdraw consent at any time (see Section 4).
2.4 Advertising
We do not use advertising cookies. We do not sell personal information and do not share it with advertising networks. Google’s advertising consent signals (ad storage, ad user data and ad personalization) are set to “denied” before any Google script loads, and accepting the banner does not turn any of them on. The only signal the Accept button changes is the analytics one. That is what stands behind Section 4.2.1 of our Privacy Policy, which says we do not sell personal information or share it for cross-context behavioral advertising.
3. The cookies and storage keys we use
3.1 In the application
These are set on crm.tormano.com and npcrm.tormano.com when you sign in. None of them carries tracking information.
| Name | What it is for | Type | Lasts |
|---|---|---|---|
access_token | Your signed-in session | Browser storage (strictly necessary) | Until you sign out or clear your browser storage |
token_expires | When that session expires, so the app can renew it in time | Browser storage (strictly necessary) | Until you sign out or clear your browser storage |
refresh_token | Tells the app that the token that keeps you signed in is held in the rt_h cookie below. During the sign-in handoff between subdomains it can briefly hold that token itself | Browser storage (strictly necessary) | Until you sign out or clear your browser storage |
crm_user | A copy of your own user record: your name, email address, role and organization | Browser storage (strictly necessary) | Until you sign out or clear your browser storage |
client_portal_token | Your session in a client or donor portal, if you sign in to one | Browser storage (strictly necessary) | Until you sign out or clear your browser storage |
post_login_next | The page you were heading to before you were asked to sign in | Session storage (strictly necessary) | Until you close the tab |
login_bounce | A counter that stops a sign-in redirect loop | Session storage (strictly necessary) | Until you close the tab |
signup_source | On the registration page only: the website you arrived from, so we can tell where sign-ups come from | Session storage (strictly necessary) | Until you close the tab |
at | Lets pages recognize you as they load | Cookie, not readable by page scripts (strictly necessary) | 1 hour |
csrf_token | Stops another site from acting in your name; renewed with every change you make | Cookie, not readable by page scripts (strictly necessary) | 24 hours |
rt_h | Keeps you signed in without re-entering your password; limited to the application subdomain you sign in on | Cookie, not readable by page scripts (strictly necessary) | Until you sign out |
saml_request_id | Set only during a single sign-on exchange, and only if your organization uses single sign-on | Cookie, not readable by page scripts (strictly necessary) | The length of the sign-in exchange |
tormano_theme, tormano_density | Your theme and display density | Browser storage (functional, see 2.2) | Until you clear your browser storage |
tormano-sidebar-collapsed, dash-filters: entries | Whether the sidebar is collapsed and how you last sorted a dashboard | Browser storage (functional, see 2.2) | Until you clear your browser storage |
tormano_home_variant | Which audience version of the home page you were shown | Browser storage (functional, see 2.2) | Until you clear your browser storage |
tormano-nav-seen, tormano_onboarding_collapsed, tormano_onboarding_dismissed, tormano_welcome_shown, tormano_data_health_dismissed | Which one-time notices you have already dismissed, so we do not show them again | Browser storage (functional, see 2.2) | Until you clear your browser storage |
Two older key names, authToken and auth-storage, are read by a few older screens in case an earlier version of the Service left them behind. Nothing in the Service writes them. An earlier version also set a cookie named rt across all Tormano subdomains: we no longer set it and we clear it when we find it, but a browser that signed in before that change may still be holding one.
3.2 On the marketing site
| Name | What it is for | Type | Lasts |
|---|---|---|---|
tormano_cookie_consent | Records whether you accepted or declined analytics, so we do not have to ask on every page | Browser storage (strictly necessary) | Until you clear your browser storage |
tormano_audience, tormano_mcta | Which audience version of the page you were reading and which call to action you last saw | Browser storage (functional, see 2.2) | Until you clear your browser storage |
_ga | Distinguishes one visitor from another, for Google Analytics | Third-party cookie (analytics, only after you accept) | 2 years |
_ga_KY6LET7ELF | Holds the state of your visit, for Google Analytics | Third-party cookie (analytics, only after you accept) | 2 years |
3.3 On a public donation form
doublethedonation is the only third-party storage outside our marketing site. If the organization you are donating to has connected Double the Donation, that provider’s employer-lookup widget on the donation form writes your employer selection into this key so the form can submit it with your gift. It is written by that widget, not by us, and only on that form. It is not analytics or advertising storage and it is not used to track you across sites. There is no cookie banner on a donation form: if you would prefer the widget not to run, the organization running the form can disconnect the integration, and you can clear the key through your browser.
4. Managing and withdrawing consent
4.1 Cookie banner
The first time you visit tormano.com, a banner asks whether you want to enable analytics. It is shown to every visitor, and analytics stays off until you accept. Your choice is remembered on your device.
4.2 Change your choice
You can change your analytics preference at any time by clicking “Cookie preferences” in the footer of any tormano.com marketing page, which reopens the banner, or by clearing your browser storage. There is no equivalent control inside the application at crm.tormano.com or npcrm.tormano.com because the application sets no analytics cookie for it to change.
4.3 Browser controls
Most browsers let you block or delete cookies through their settings. Blocking strictly necessary cookies may cause the Service to stop functioning.
4.4 Do Not Track
Because there is no industry consensus on how to respond to browser Do Not Track signals, our Sites do not currently respond to them. Our analytics cookies are gated on the cookie banner consent instead.
5. International users (GDPR, UK GDPR and CCPA)
5.1 EEA, UK and Switzerland
For visitors from the European Economic Area, the United Kingdom, and Switzerland, we rely on your explicit consent (via the cookie banner) as the legal basis for analytics cookies under the GDPR and UK GDPR, and we obtain that consent before the cookies are set, as Article 5(3) of the ePrivacy Directive requires. Strictly necessary cookies are exempt from that consent requirement under the same Article, because they are strictly necessary to provide the service you asked for; for the personal data they involve, our legal basis under the GDPR is performance of our contract with you. Functional preference storage (2.2) is set only after you have signed in or, on the marketing site, only in response to something you clicked, and is not used for analytics or advertising.
5.2 California (CCPA and CPRA)
California residents have the right to opt out of the sale or sharing of personal information. Tormano does not sell or share personal information with advertisers. Our only optional cookie category is analytics, which you can disable at any time as described in Section 4.
6. Changes to this policy
We may update this Cookie Policy from time to time. The current version is always published at this address, and the Effective Date at the top shows when it last changed and which version it replaced. When we update it we publish a notice in the Tormano notification center of every user of every account, naming the new Effective Date and linking to the updated policy, and that notice cannot be switched off in notification preferences. Where we consider a change material we also email it to the address on your account, as a legal notice that a marketing opt-out does not suppress. Both are sent when the updated policy is published. Section 19.2 of the Terms of Service sets out the same mechanism for all of our published documents.
We will not add a new optional cookie category, or begin using an existing one for a new purpose, without asking for your consent again through the cookie banner first. Your existing choice is never silently reinterpreted as consent to something you were not asked about.
7. Contact
Questions about this Cookie Policy can be directed to privacy@tormano.com or through our contact form.
F&D Ventures LLC
8401 Mayland Drive #5368, Richmond, VA 23294, USA
Privacy: privacy@tormano.com
Legal: legal@tormano.com
Support: support@tormano.com