LEGACY ONLINE SCHOOL

PRIVACY POLICY

Effective date: Aug 1, 2026    Last updated: Jul 15, 2026

Contents

1. Introduction and Scope
2. Who We Are and How to Contact Us
3. Information We Collect
4. How We Use Personal Information
5. Whether You Must Provide Information
6. Children’s Privacy
7. Student Education Records
8. Cookies, Analytics, and Advertising Technologies
9. Marketing, Advertising, and the Sale or Sharing of Personal Information
10. How We Share Personal Information
11. Data Storage and Users Outside the United States
12. Data Retention
13. Data Security and Breach Notification
14. Your Privacy Rights
15. Changes to This Policy
16. Contact Us

 

1.  Introduction and Scope

Legacy School Inc., a Florida corporation doing business as Legacy Online School (“Legacy,” “we,” “us,” or “our”), respects your privacy and is committed to protecting it. This Privacy Policy explains the personal information we collect from you, or that you provide, when you visit legacyonlineschool.com (the “Website”) or use our educational services, and how we collect, use, share, protect, and retain it. It also describes your rights and choices. This Policy is incorporated into our Terms of Use. This Policy applies to Legacy’s United States operations and to individuals in the United States. It is designed to comply with the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA) to the extent applicable, the Florida Information Protection Act, and the comprehensive state privacy laws that apply to us. Programs for families located outside the United States are offered under a separate privacy policy and separate terms. This Policy covers families, students, and visitors to the Website. Personal information of Legacy’s employees, contractors, and job applicants is handled under separate notices and is not covered by this Policy.

2.  Who We Are and How to Contact Us

Legacy is the controller responsible for the personal information described in this Policy. You can reach us at Legacy School Inc., doing business as Legacy Online School, 5922 9th Avenue North, St. Petersburg, Florida 33710, United States. For privacy and legal matters, including requests and complaints, contact our privacy contact at [email protected]. Academic queries may be sent to [email protected], and general support queries to [email protected].

3.  Information We Collect

We collect the following categories of personal information.

• Device and usage information, collected automatically when you visit the Website, including your browser type, IP address, device identifiers, the pages and content you view, and how you interact with the Website, through cookies, pixels, and similar technologies.
• Enrollment and billing information, which you provide when you enroll or attempt to enroll, including name, billing address, payment information, email address, and phone number.
• Student information, including the student’s name, date of birth, grade level, and academic records. This information is processed on behalf of, and with the consent of, the parent or guardian who signs the enrollment agreement.
• Learning and activity data generated as a student uses the learning platforms, including coursework, assessments, attendance, engagement, recordings of live sessions, and platform usage data.
• Communications, such as messages, survey responses, and support requests.

Sources. Most information is collected directly from you. Information about a student is generally provided by the parent or guardian who enrolls the student, or is generated as the student uses our platforms. Where we receive information from a third party, such as a scholarship-funding organization, we handle it under this Policy. Sensitive information and biometrics. We generally do not seek sensitive information. Where a family voluntarily provides information such as a health condition or an accommodation need, we use it only to support the student and handle it with appropriate care. We do not collect biometric identifiers, such as facial-geometry, voiceprint, or fingerprint data, and we do not use proctoring tools that collect them. We would provide a specific notice and obtain any consent the law requires before doing so.

4.  How We Use Personal Information

We use personal information to enroll students and deliver the educational program, process payments and provide invoices and enrollment confirmations, communicate with families, monitor and support academic progress, maintain the security and integrity of our platforms, screen for fraud and meet our sanctions and legal obligations, operate and improve the Website and services, and measure and deliver marketing to adult audiences as described in this Policy. Artificial intelligence. We use artificial-intelligence-assisted tools for internal business operations, including document drafting, operational support, workflow assistance, marketing communications, and internal research. Current tools include OpenAI (ChatGPT), Anthropic (Claude), and Lovable. We do not use these tools to make automated decisions about a student that produce legal or similarly significant effects without meaningful human review. Our artificial-intelligence vendors are engaged on business or enterprise terms under which customer content is not used to train public models, and student personal information is not used to train public artificial-intelligence models. De-identified and aggregated data. We may create and use de-identified or aggregated information, which does not identify any individual, for any lawful purpose, including to analyze and improve our services. We maintain such information without attempting to re-identify it, except as permitted by law.

5.  Whether You Must Provide Information

Some personal information is necessary to enroll a student and deliver the program, and some is required by law or by the platforms we use. If you do not provide information that is necessary for these purposes, we may be unable to enroll the student or provide the services. Where we rely on consent, providing the information is optional, and you may decline or later withdraw consent, which may affect the related feature.

6.  Children’s Privacy

Our public website is directed to adults. We do not knowingly collect personal information from a child through the public website, as distinct from the enrollment and learning platforms described below. If you believe a child has provided personal information through the public website, contact us and we will delete it. For students under the age of thirteen, we comply with COPPA. A parent or legal guardian completes the enrollment process on behalf of the student, including execution of the Enrollment Agreement and the required consents, before the student is onboarded. We obtain verifiable parental consent before the platforms we use as service providers collect personal information from a child online, for the limited purpose of operating the educational program. Student and parent information may be processed through the operational systems that support enrollment, instruction, communication, and billing, which currently include the Buzz learning management system, Google Workspace including Google Classroom and Google Meet, Zoom, Stripe, Bitrix24, Zoho Campaigns, and scholarship administration platforms such as Step Up For Students, ClassWallet, and Odyssey where applicable. The platforms that collect personal information from children under thirteen are identified in the COPPA platform disclosure attached to the Enrollment Agreement, which is updated as systems are added or retired. We collect only the information reasonably needed for the educational program, do not require a child to disclose more than is reasonably necessary to participate, and do not use a child’s information for behavioral advertising. A parent may review the information collected from the child, refuse to permit further collection or use, and request deletion, by contacting us at [email protected].

6.1  Disclosure of a child’s information to third parties

We disclose a child’s personal information only to the service providers that support the educational program, for purposes that are integral to providing that program, as described in the How We Share Personal Information section. We do not disclose a child’s personal information to a third party for targeted advertising or for any other purpose that is not integral to the program. If we ever propose to make such a disclosure, we will first obtain separate verifiable parental consent for that disclosure.

6.2  Children’s data retention policy

We collect personal information from children only to enroll the student, deliver and support the educational program, monitor academic progress, communicate with the family, administer billing and scholarship funding, and maintain the security and integrity of the platforms. We retain a child’s personal information only for as long as is reasonably necessary to fulfill the purpose for which it was collected, and we do not retain it indefinitely. Recordings of routine class sessions are retained for up to twelve months, subject to the exceptions described in the Data Retention section. Academic records, such as transcripts and enrollment confirmations, are retained for a minimum of five years, because families, receiving institutions, and scholarship programs rely on them for academic verification. Enrollment, billing, and consent records are retained for the period required by law and by the scholarship programs in which the family participates. When a child’s personal information is no longer reasonably necessary for the purpose for which it was collected, we delete it using reasonable measures designed to protect against unauthorized access to, or use of, the information in connection with its deletion. We establish, implement, and maintain a written information security program that contains safeguards appropriate to the sensitivity of children’s personal information and to our size and the nature of our activities, and we require our service providers to maintain reasonable security for the children’s personal information they receive.

7.  Student Education Records

To the extent FERPA applies, and in any event as a matter of policy, we treat student education records as confidential and afford parents (and eligible students) the right to inspect and review records, request correction of records believed to be inaccurate or misleading, and consent to disclosures except where disclosure is permitted without consent, such as to school officials and service providers with a legitimate educational interest. We do not designate or release directory information for external or commercial purposes. Requests are made to [email protected].

8.  Cookies, Analytics, and Advertising Technologies

We use cookies, log files, web beacons, tags, pixels, and click identifiers to operate and secure the Website, remember preferences, measure performance, and support marketing. The categories we use are:

• Strictly necessary cookies, which are required for the Website to function and are set without consent.
• Analytics cookies and tags, provided through Google Analytics and Google Tag Manager, which help us understand how the Website is used.
• Advertising, affiliate, and measurement cookies, pixels, and click identifiers, provided through Meta (Facebook and Instagram), Google Ads, Microsoft Advertising, TikTok, X, LinkedIn, Quora, PixelYourSite, Google AdSense and Site Kit, and affiliate-marketing partners such as ShareASale. These may set or read identifiers such as _ga, _fbp, _fbc, fbclid, gclid, gbraid, wbraid, msclkid, ttclid, and twclid.
• Functional third-party features on the public website, such as our webinar and open-house registration provider.

We do not deploy advertising or marketing trackers inside the student learning platforms. You can manage cookies through our cookie preference tool, through your browser settings, and through the opt-out mechanisms described in the next section. Where required by law, we honor browser-based opt-out preference signals such as the Global Privacy Control.

9.  Marketing, Advertising, and the Sale or Sharing of Personal Information

We market our programs to parents and other adult decision-makers. With your consent where required, we may send you marketing communications. Marketing messages identify Legacy as the sender, include our valid physical postal address, and provide a way to opt out. You may revoke consent to marketing email or text messages by any reasonable means, and we honor opt-out and revocation requests within ten business days.

9.1  Advertising technologies on our public website

Our public website uses the advertising and measurement technologies listed in the previous section. These technologies allow us and the advertising platforms to measure the performance of our campaigns and to present advertisements about our programs to adult website visitors on other services.

9.2  Sale and sharing under state privacy laws

We do not sell personal information for money. However, under the California Consumer Privacy Act as amended and comparable laws in other states, our use of these advertising technologies may be treated as a “sale” of personal information, or as “sharing” of personal information for cross-context behavioral advertising, because identifiers and internet-activity information are made available to the advertising platforms. We therefore treat this activity as sale and sharing, disclose it here, and provide the opt-out described below so that you can make an informed choice.

9.3  What we do not do

We do not sell or share student personal information. We do not use student personal information for targeted advertising. We do not direct targeted advertising to children. We do not deploy advertising or marketing trackers inside the student learning platforms. We do not knowingly sell or share the personal information of any individual we know to be under sixteen years of age.

9.4  How to opt out

You may opt out of the sale and sharing of your personal information and of targeted advertising by using the “Do Not Sell or Share My Personal Information” link in the Website footer, by adjusting your choices in our cookie preference tool, or by enabling a browser-based opt-out preference signal such as the Global Privacy Control, which we honor as required by law. You may also opt out of interest-based advertising through the settings offered by the advertising platforms and through industry opt-out tools. You may unsubscribe from marketing email at any time using the link in the message.

10.  How We Share Personal Information

We share personal information only as needed to provide our services and meet our obligations, with the following categories of recipients. Each service provider is required by contract to protect the data it handles and to use it only for the purposes we authorize.

• Learning and instruction: the Buzz learning management system, Google Workspace including Google Classroom and Google Meet, and Zoom.
• Enrollment, records, communications, and marketing: Bitrix24, including its customer relationship management and marketing functions, and Zoho, including Zoho Campaigns. We also communicate by email, telephone, text message, and messaging applications such as WhatsApp.
• Payments: Stripe and PayPal.
• Scholarship administration: Step Up For Students, ClassWallet, Odyssey, and similar platforms where applicable.
• Analytics, advertising, and affiliate marketing, on the public website only: Google Analytics, Google Tag Manager, Google Ads, Google AdSense and Site Kit, Meta, Microsoft Advertising, TikTok, X, LinkedIn, Quora, PixelYourSite, and ShareASale.
• Artificial-intelligence and productivity tools used for internal operations: OpenAI, Anthropic, and Lovable.
• Professional advisers, auditors, and insurers, where reasonably necessary; authorities and others where required to comply with law, respond to lawful requests, enforce our terms, or protect the rights, safety, and property of Legacy, our students, and others; and a successor in connection with a merger, acquisition, or transfer of operations, subject to the continued protection of personal information.

This list may change as we add or replace service providers, and we update this Policy accordingly.

11.  Data Storage and Users Outside the United States

We are based in the United States, and personal information is stored and processed in the United States by Legacy and its service providers. This Policy applies to Legacy’s United States operations. Programs for families located outside the United States are offered under a separate privacy policy. If you access the Website from outside the United States, you do so on your own initiative.

12.  Data Retention

We retain personal information for as long as needed for the purpose for which it was collected, after which it is deleted or de-identified. Information collected to perform a contract is retained until the contract is fully performed and for any additional period required by law, our insurers, scholarship programs, or accreditation obligations. Recordings of routine class sessions are retained for up to twelve months from the date of the recording. Where a recording is needed for a legal proceeding, a regulatory matter, a safeguarding concern, a disciplinary investigation, a complaint, or another legitimate business purpose, it may be retained for longer in accordance with our records-retention procedures and legal obligations. Core academic records, such as transcripts and enrollment confirmations, are retained for a minimum of five years for academic-verification purposes.

13.  Data Security and Breach Notification

We establish, implement, and maintain a written information security program with administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, or disclosure, appropriate to the sensitivity of the information and to our size and activities, and we require our service providers to maintain reasonable security for the information they receive. We review the program periodically. No system can be guaranteed to be perfectly secure. If a security incident affecting personal information occurs, we will respond and provide notice as required by applicable law, including the Florida Information Protection Act.

14.  Your Privacy Rights

14.1  Rights that may apply to you

Depending on your state of residence, United States privacy laws may give you the right to confirm whether we process your personal information and to access it, to correct inaccuracies, to delete it, to obtain a portable copy, to opt out of the sale of personal information, of sharing for cross-context behavioral advertising, and of targeted advertising, to opt out of certain profiling, and to limit the use of sensitive personal information. We do not discriminate against anyone for exercising these rights.

14.2  Categories of personal information

The categories of personal information we collect, the purposes for which we use them, and whether they are sold or shared for cross-context behavioral advertising are summarized below.     We retain each category for the periods described in the Data Retention section. We use and disclose sensitive information only as needed for the purposes above and do not use it to infer characteristics.

14.3  How to exercise your rights

To exercise any right, contact us at [email protected], or use the “Do Not Sell or Share My Personal Information” link in the Website footer for opt-out requests. We take reasonable steps to verify your identity and authority before responding, and we respond within the time required by applicable law. An authorized agent may submit a request with proof of authority. If we decline a request, you may appeal by replying to our decision, and where a state law provides, you may also contact your state attorney general. Where required by law, we honor browser-based opt-out preference signals such as the Global Privacy Control.

15.  Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. We will post the updated Policy with a new effective date and, where required by applicable law, notify you of material changes by email or a notice on the Website.

16.  Contact Us

If you have a question or complaint about this Policy or our handling of personal information, contact us at [email protected], or write to Legacy School Inc., doing business as Legacy Online School, 5922 9th Avenue North, St. Petersburg, Florida 33710, United States.