Privacy
Policy

Introduction

The Legacy Foundation ("we," "our," or "us") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or interact with our services.

Information We Collect

We may collect personal information that you voluntarily provide to us when you:

• Make a donation
• Donate tickets through our platform
• Subscribe to our newsletter
• Contact us with inquiries
• Apply for our programs
• Register a family, claim an experience, or complete an outing consent slate
• Request accessibility support or provide emergency and medical information for a specific outing

Depending on the interaction, this may include your name, email address, phone number, mailing address, payment information, household and eligibility information, guardian relationship, attendance and consent records, accessibility needs, emergency contact details, and limited medical information needed for a specific outing.

How We Use Your Information

We use the information we collect to:

• Process donations and provide tax receipts
• Coordinate ticket donations and transfers
• Communicate about our programs and impact
• Respond to your inquiries
• Improve our website and services
• Match donated tickets with eligible recipients and administer event attendance
• Coordinate accessibility, safeguarding, emergency response, and family communications
• Maintain versioned records of donor, guardian, recipient, and event-rule acknowledgments
• Comply with legal obligations

Information Sharing

We do not sell, trade, or rent your personal information. We may share the minimum information needed with service providers that host, secure, process, or communicate for the Foundation; ticket issuers, venues, event organizers, or transportation providers when needed to fulfill an experience; and vetted community partners when needed to administer a match. We require appropriate confidentiality and security commitments, and we do not disclose a youth's identity in public impact stories without the applicable permission.

Analytics & Advertising

On donor-facing pages, and subject to applicable cookie and consent choices, the Foundation may use Google Analytics, Google Tag Manager, Google Ads, and Enhanced Conversions to measure website use and donation attribution. Information such as an adult donor's email address may be normalized and cryptographically hashed before transmission to Google for matching and measurement. Hashing reduces exposure in transit but is not anonymization and does not prevent the receiving platform from matching the hashed value to information it already holds. The Foundation does not deploy advertising tags within authenticated family or recipient pages and does not send youth-identifying, household, eligibility, guardian, accessibility, emergency, medical, attendance, or consent records to advertising platforms.

You can control ad personalization through your Google Account settings and manage cookies through your browser settings. To opt out of analytics tracking, you may use Google's browser add-on or block analytics cookies in your browser. The Foundation does not use program safety, eligibility, guardian, accessibility, emergency, medical, attendance, or consent information for fundraising, advertising, donor recognition, or general analytics.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information. However, no method of transmission over the internet or electronic storage is 100% secure.

Children and family information

Children under 13 may not create a Seat Forward account, submit information directly through the portal, or independently accept program documents. A parent or legal guardian must create and control the family account and provide information about the child. In Groundwork Academy, everyone is asked their age band before the Foundation collects an email address, a name, or anything else. A learner under 13 is not asked for their own email at all: they give a parent or guardian's address, the guardian is invited to create the account, and the guardian gives consent by reading and signing an electronic consent form — typing their full legal name as a signature and confirming that they are the parent or legal guardian and are 18 or older. The Foundation keeps a copy of the exact form that was signed. A learner aged 13 to 17 gives their own agreement as well, including a separate decision about whether to use the AI tutor, and a parent or guardian separately acknowledges the program; a guardian's yes does not replace the teen's. The Foundation records an age band rather than a full date of birth. For learners under 13 the Foundation collects only what the program needs — the learner's name, age band, state of residence, parent or guardian contact, emergency contact, and lesson progress. A parent or guardian can review, correct, download, or delete that information, withdraw consent, or stop future AI processing at any time, either through the privacy portal in the learner's account or by writing to privacy@supportlegacy.org. Withdrawing consent stops the AI tutor and stops the Foundation collecting anything further about that learner; it is a separate request from deletion. For all minors, the Foundation limits processing to information reasonably necessary for the requested program function, safety, legal compliance, and the family's authorized choices.

Parents and guardians may use the Groundwork Academy privacy portal, or contact privacy@supportlegacy.org, to request access, correction, download, deletion, withdrawal of consent, or a stop on future AI processing — subject to safety, legal, accounting, and record-preservation requirements. Where a record must be preserved for one of those reasons, the Foundation says so and says why rather than deleting silently. Media permission is separate and optional. We do not condition access on photography, public recognition, or marketing permission.

Groundwork Academy: AI tutoring and safety monitoring

Learners aged 8 and over can use an AI tutor in Groundwork Academy, with a parent or guardian's consent for anyone under 18. The tutor is software, not a person. Messages a learner sends to the tutor, and the tutor's replies, are sent to our AI provider to generate the response, are handled under that provider's data terms, and are used by the Foundation for no other purpose.

Those messages are also checked automatically for safety concerns, such as a disclosure of harm, abuse, or a crisis. When a check flags something, an authorized adult at the Foundation reviews it. No one watches Academy conversations as they happen, and the Academy is not an emergency service. For immediate danger call 911. For suicide or emotional crisis support, call or text 988. Our AI provider is Anthropic, and we use its commercial API. Anthropic states that commercial API data is not used to train its models unless separately authorized, and that it generally deletes API inputs and outputs within 30 days. If content is flagged for usage-policy enforcement, Anthropic states it may retain those inputs and outputs for up to two years and safety-classification scores for up to seven years. Groundwork Academy cannot shorten Anthropic's independent retention periods.

Retention and deletion

Absent an incident, claim, legal hold, continuing accommodation need, or other legal requirement, outing-specific medical details will be deleted or de-identified within 30 days after the outing. Academy safety-review records are kept for 12 months after an authorized adult reviews them and are then deleted or de-identified; a safety record that is never reviewed is deleted no later than 180 days after it is created. Either way, a record tied to a safety report, an ongoing school or agency process, a contractual preservation requirement, or a legal hold is preserved until the latest of those concludes. Learner account and progress records are kept while the account is in use and are deleted after 24 months without activity. A guardian consent request that is never answered is deleted 30 days after it is sent; a recorded consent or withdrawal decision is kept while the account is active and for as long as we must be able to document it. Donor, transfer, disposition, acknowledgment, and tax-administration records will be retained for seven years after the later of the donation, disposition, or related tax filing. Electronic acceptance, attendance, and consent evidence will be retained for seven years after the event; for a minor, the record will be retained until seven years after the participant reaches age 18. Safeguarding incident records will be retained for at least 25 years, or longer when required by law, insurer instruction, or legal hold. Background-check and training records will be retained for the individual's service period plus seven years.

Your Rights

You may request access to, correction of, or deletion of your personal information by contacting us at privacy@supportlegacy.org. You may also unsubscribe from our communications at any time.

Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@supportlegacy.org. The Legacy Foundation (EIN: 20-4557510).