Effective: July 11, 2026

Privacy Policy

How we collect, use, and safeguard your information — including insurance application data and AI-assisted communications.

Last updated: July 11, 2026

§1

Information we collect

To operate our insurance platform — application tracking, AI-assisted communications, and submission-node operations — we collect the following categories of information:

  • Account information: Name, email address, business details, and — for licensed producers — license and appointment information provided during registration and onboarding.
  • Insurance application data: Client information collected for insurance applications, including contact details and, where required by the application, health and payment information. Sensitive fields are encrypted at rest.
  • Payment data: Platform fees and wallet top-ups are processed by Stripe. We store transaction records and Stripe identifiers — never your full card number.
  • Communication records: Call recordings, transcripts, SMS, and email exchanged through the platform, including AI-assisted communications, retained for compliance and quality assurance.
  • Technical data: IP addresses, browser type, and usage statistics via our hosting provider, Vercel.
§2

How we use your data

We use your data strictly to provide the services offered by LegacyCore, including:

  • Tracking insurance applications from submission through carrier confirmation
  • Generating earnings statements, commission records, and platform reports
  • Operating AI-assisted calls and messages, with human review on client-facing sends
  • Meeting insurance, TCPA, and record-keeping compliance obligations
  • Providing customer support and technical troubleshooting

Non-disclosure:We do NOT sell, rent, or trade your personal or financial data to third parties for marketing purposes.

§3

Security

Sensitive personal information collected for insurance applications — including health and payment details — is encrypted at rest, and every user's records are isolated at the database level so accounts can only access their own data.

Encryption

Sensitive fields and credentials are encrypted at rest using AES-256.

Infrastructure

Hosted on Vercel with secure environment variables for credentials.

Data in transit

All data transmission is encrypted using TLS 1.2 or higher.

§4

Data sharing

We share data only with the service providers and parties needed to run the platform:

Vercel

For hosting and application performance monitoring.

Supabase

For database, authentication, and file-storage infrastructure.

Stripe

For payment processing of platform fees and wallet top-ups.

Telephony and voice-AI providers

To place and receive calls, transcribe them, and deliver SMS through the platform.

Insurance carriers

To submit and service the insurance applications you request.

§5

AI-assisted communications

Voice and text communications with LegacyCore may be handled by AI-assisted voice agents or AI-drafted text content. Where required by applicable state law, the AI agent identifies itself at the start of each call. Personal information collected during AI-assisted communications — including health information collected for insurance application purposes — is handled under the same data-protection practices described elsewhere in this policy. AI-assisted call transcripts are stored for compliance, quality-assurance, and training purposes. You may request access to or deletion of AI-assisted communication records by contacting us. You may also opt out of AI-assisted contact at any time by replying STOP to SMS or by request during a voice call. See /legal/recruiting-disclosures for the full AI communication disclosure.

§6

Your rights

Right to access

Request a copy of the data we hold about you.

Right to deletion

Request deletion of your account and associated data, subject to records we must keep by law.

Right to opt out

Stop AI-assisted contact any time — reply STOP to SMS or ask during a call.

§7

Data retention

We retain your data while your account is active. If you close your account, we delete your personal data within 30 days, except records we are required to retain under applicable law — such as insurance application records, TCPA consent logs, and call recordings kept for compliance purposes.