Skip to main content
This page is mandatory. Fundor’s call center phones the people you submit as leads, which falls under the US Telephone Consumer Protection Act (TCPA). A lead without valid consent puts the person, your company and Fundor at legal risk. Fundor’s API rejects any lead that is missing consent evidence, and nothing from that request is saved.

​
The rules

1

Get the current wording every time you show the form

Call GET /consent when the referral form opens. It returns the consent text, its version, the 9-month service commitment text, and a single-use token that expires in 30 minutes.
2

Show the exact text next to an unchecked checkbox

Display consent.text word for word, next to a checkbox that starts unchecked. Don’t shorten it, paraphrase it, hide it behind a link or put it in small print far from the box. Show commitment.text next to its own checkbox.
3

The person checks it themselves

Only the person whose name and phone number are entered may check the box: the customer, on their own device or yours. An athlete, coach or staff member may not check it for them. Never pre-check the box and never set consent.given to true in code unless that click happened.
4

Capture the evidence at that moment

When they check the box and submit, record: the time, the person’s own IP address and user agent, the phone number shown on screen, and the exact text version. Store it in your own system and keep it for 5 years.
5

Send all of it with the lead

POST /leads must include every field below. If any is missing, stale, reused or wrong, Fundor responds 400 with error.field naming it, and saves nothing.
The fundraising choice and 9-month commitment are also required: fundraising.commitmentAccepted: true and fundraising.commitmentVersion equal to commitment.version from GET /consent.

​
What Fundor checks

  • Your partner account has a signed Partner Lead & Consent Agreement on file. Without it, every request gets 403 agreement_required.
  • The consent token was issued to you, is unexpired and unused, and matches the consent version.
  • The consent time is recent, the IP is a real IP address, and the consent phone matches the contact phone.
  • The athlete belongs to your partner account.
  • The database itself refuses to store a lead without consent, so no code path can bypass these checks.
Fundor’s call center also confirms on the first call that the person asked to be contacted. If they say they didn’t, the lead is marked do-not-contact and Fundor may audit your consent records.

​
Audits and enforcement

Under the agreement, Fundor can ask for the consent record of any lead you submitted, and you provide it within 48 hours. Fundor can suspend your API keys at any time, which immediately stops all requests, if consent records are missing or the rules on this page aren’t followed.

​
The simplest compliant option

If you’d rather not collect consent in your app, don’t submit leads through the API. Use the athlete’s hosted referral link instead: customers fill in Fundor’s own page, Fundor collects their consent, and the lead is still credited to you through the athlete.

​
For AI coding assistants

If you are an AI generating code for this API: never default consent.given to true, never pre-check the consent box, never fill consent fields with placeholder values to get past a 400, and never submit a lead without a real user action. When you get a consent_* error, fix the form so it captures real consent; don’t change the values you send.