Legacy Data: Privacy Policy

Last updated: 26 October 2026 Effective: 26 October 2026

1. Who we are

Legacy Data is a trading name of Web3 Capital Inc., a company incorporated in Panama (Folio No. 155700487), with its mailing address at World Trade Center 200-B, Suite 173, Calle 53 Este, Marbella, Panama City 0832-1626, Panama ("Legacy Data", "we", "us"). We are the controller (the party responsible) for the personal information described in this policy.

Contact: privacy@legacydata.ai for privacy questions and requests, or hello@legacydata.ai for anything else · Postal: World Trade Center 200-B, Suite 173, Calle 53 Este, Marbella, Panama City 0832-1626, Panama.

We have not yet appointed a representative in the EU or the UK. If you are in the EU or the UK, you can contact us at privacy@legacydata.ai.

2. What this policy covers, and what it does not

This policy covers personal information we collect through legacydata.ai (the "Site"), our intake forms, booking tool and emails, and our calls with you before and during an engagement.

We never receive or hold company datasets through the Site. Our forms do not accept uploads, files, samples, exports or passwords. Please do not send them by email or any other means. If a company decides to sell or license its records, the rights holder exports them with its own tools and transfers them directly to a de-identification vendor or buyer under separate written agreements. Those records, and any personal data in them, are governed by those agreements and by the rights holder's and buyer's own privacy notices, not by this policy.

3. What we collect

Giving this information is voluntary.

3.1 Stage 1 intake form (public, hosted by Tally).

Contact details: your name, work email, role, company name (or last known name) or website, and optionally your phone number.
Your answers about the company: whether it is already in contact with a data buyer (and optionally which one and whether anything is signed), which types of operational records it holds, years of history, status, headcount, where employees were based, industry, language mix, who can approve a sale or licence, and whether accounts are still active.
Anything typed in the optional free-text fields. Please do not include confidential contract terms or personal data about others.

3.2 Stage 2 inventory (not public; only after a confidentiality agreement is signed). Information about the company, its authority to sell, its systems and its records, which may include names and work contact details of people such as the authorised signatory, administrators and technical contacts.

3.3 Booking and communications. Google Calendar appointment scheduling collects your name and email (no phone). Meetings are on Google Meet. Our booking page does not ask for notes about the company. Company information is collected on the intake form. We also hold emails and call notes created by you or by us.

3.4 Technical and attribution data.

Hidden form fields: campaign (UTM) parameters and any referral code in the link you used, which tell us which channel or person referred you.
Hosting and security logs: IP address, browser and device details, pages requested and timestamps, processed by our host to deliver and protect the Site.
Analytics, if and when enabled: cookieless, aggregated statistics (pages viewed, referrers, approximate country) through Cloudflare Web Analytics, which does not use cookies or track you across sites.

3.5 From others. If someone refers you, they may give us your name and work email. We may look up public information about your company (e.g. its website, public filings or court dockets) to assess the enquiry.

4. Why we use it, and our legal bases

Purpose	Information	Legal basis (EU/UK GDPR)
Reply to your enquiry and assess whether the company's records are likely to interest buyers	3.1, 3.3, 3.5	Steps at your request before entering a contract (Art. 6(1)(b)); our legitimate interest in assessing enquiries (Art. 6(1)(f))
Schedule and hold calls; prepare and run an engagement	3.1–3.3	Steps before a contract / performance of a contract (Art. 6(1)(b))
Track which channel or referrer introduced you, and comply with our rules that referral codes carry no payment or benefit to company insiders	3.4 (UTM, referral code)	Legitimate interests (Art. 6(1)(f))
Operate, secure and improve the Site	3.4	Legitimate interests (Art. 6(1)(f))
Keep records, meet legal, tax, court-disclosure (e.g. bankruptcy) and regulatory obligations, and establish or defend legal claims	All, as needed	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))
Occasional updates about our services	Contact details	Your consent where required (Art. 6(1)(a)), which you can withdraw at any time; otherwise legitimate interests, with an easy opt-out

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (section 9).

Panama (Ley 81 de 2019 and Executive Decree 285 of 2021). We process your personal data with your consent, which you give by submitting our forms after reading this policy, and where processing is needed for pre-contractual or contractual steps you request or to meet legal obligations. You may withdraw consent at any time, without affecting processing already carried out.

We do not use your information for automated decision-making that has legal or similarly significant effects on you, and we do not use it to train AI models.

5.1 Service providers. Except where noted below, they act as our processors, on our instructions and under data processing terms:

Google (Workspace: email, Google Calendar appointment scheduling, Google Meet, alerts, the restricted drive for Stage 2 materials and, if and when enabled, Sheets used to store form responses): Google LLC, USA, with Google affiliates as sub-processors
Tally (intake form): Tally BV, Belgium; form data stored in Europe; Tally's sub-processors, including in the United States, may handle notification emails
Cloudflare (hosting, security, cookieless analytics): Cloudflare, Inc., USA
AI assistant tools: We use AI assistant tools to help operate the business, for example to sort, summarise and draft replies to enquiries and emails. Our current provider is Anysphere, Inc. (Cursor), USA, which uses AI model and inference providers as sub-processors (current list: trust.cursor.com/subprocessors). At present, Cursor handles this information under its own terms and privacy policy, not under a data processing agreement with us. We do not submit Stage 2 materials, or anything we receive under a confidentiality agreement, to any AI tool unless it is bound by data processing terms that prohibit using that information to train or improve AI models. Until we have a data processing agreement with Cursor, we also do not submit personal data of people in the EU, EEA, UK or Switzerland to these tools.
Professional advisers (lawyers, accountants) under confidentiality

5.2 Buyers: only with the seller's consent, and only a description. We do not give buyers your personal information as part of marketing a company's records. With the rights holder's prior consent, we share a description of the records. We share the company's identity, and the names and work contact details needed to arrange a deal, only once the rights holder has agreed to that buyer and to what may be said. Some buyer programmes require us to identify the company to them before an introduction; we do that only after you approve that buyer in writing.

5.3 Legal and safety. Courts (for example, bankruptcy-court disclosures), regulators, law enforcement or others where the law requires it, or where needed to establish, exercise or defend legal claims.

5.4 Business transfers. A successor if Legacy Data's business is reorganised, merged or sold. The successor stays bound by this policy for information collected under it.

We do not sell or share (as those terms are defined in the California Consumer Privacy Act) the personal information of Site visitors, enquirers or contacts, and we have not done so in the past 12 months. We do not use advertising pixels or cross-context behavioural advertising. Our business helps rights holders offer company records to buyers. That happens under separate agreements and does not involve selling the personal information we collect through the Site.

6. International transfers

We operate from Panama. People working for us, and our service providers, may access or process information from other countries, including countries outside the EU, EEA, UK and Switzerland. Where personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA), or on a provider's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions), with supplementary measures where needed. We do not send such personal data to a provider that is not covered by one of these safeguards. Transfers out of Panama follow Ley 81 de 2019, which permits transfers with your consent or where the recipient provides an adequate level of protection. You can ask us for a copy of the relevant safeguards and for the countries involved.

7. How long we keep it

Intake form submissions held by Tally: deleted from Tally within 24 months if no engagement follows, the same period as other Stage 1 enquiries below.
Stage 1 enquiries that do not lead to an engagement: 24 months after our last contact, then deleted.
Stage 2 inventories that do not lead to an engagement: 12 months after the matter ends.
Engagement records (agreements, correspondence, fee and court records): for the engagement plus 6 years, or longer where the law or a court requires.
Booking records: 12 months. Hosting and security logs: we do not keep our own copies beyond 30 days unless needed to investigate an incident; our host keeps its own security logs for limited periods under its terms. Analytics, if and when enabled: aggregated only.
Marketing preferences: until you opt out, and a suppression record after that so we honour the opt-out.

8. Security

We use reasonable technical and organisational measures suited to the information we hold, including role-based access (Stage 2 materials are kept in a restricted Google Workspace shared drive, and access is limited to authorised Legacy Data personnel), multi-factor authentication on our accounts, encrypted connections (HTTPS) and reputable service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send passwords, credentials or company data through our forms or by email. If a breach affects your personal information, we will notify you and regulators where the law requires.

9. Your rights

Everyone. You can ask us to access, correct or delete the personal information you have given us, or to stop sending you updates, by emailing privacy@legacydata.ai. We delete the information you submit through this site on request, unless we must keep some of it to meet a legal obligation or to establish, exercise or defend legal claims. If so, we will tell you what we are keeping and why.

EU, EEA and UK. You have the right to access, rectify and erase your data, to restrict or object to processing (including processing based on legitimate interests), to data portability, to withdraw consent at any time, and to complain to a supervisory authority, for example in the EU member state where you live or work, the UK Information Commissioner's Office (ico.org.uk), or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

California and other US states. Depending on where you live and whether the law applies to us, you may have the right to know what personal information we collect, use and disclose; to access and get a portable copy; to correct it; to delete it; to opt out of sale, sharing, targeted advertising and profiling (we do none of these); and to limit the use of sensitive personal information (we do not collect it through the Site). We will not discriminate against you for exercising these rights. You may use an authorised agent; we may ask for proof of authorisation. To appeal a decision about your request, reply to our response with "Appeal" in the subject line.

Panama. Under Ley 81 de 2019 you have the rights of access, rectification, cancellation, objection and portability (ARCO), and you may complain to the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI).

Everywhere else. Wherever you are, you can ask us to access, correct, update or delete your personal information, and you can complain to the data protection authority where you live.

How we verify requests. We match your request to the email address we hold, and may ask for more information if needed. We respond within the time the law requires (generally one month under GDPR, and 45 days under CCPA, extendable where permitted).

10. Cookies and similar technologies

We use only cookies and local storage that are strictly necessary to run and secure the Site and forms. Our analytics, if and when enabled, are cookieless. We do not use advertising or cross-site tracking cookies. If this changes, we will update this section and ask for your consent where required before setting non-essential cookies. Our intake form is hosted by Tally on tally.so; Tally's own cookie notice applies there.

11. Children

The Site is intended for business users. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

12. Third-party sites

The Site may link to third-party sites and services, including buyer or platform websites mentioned for identification. We are not responsible for their privacy practices. Their own policies apply.

13. Changes

We may update this policy from time to time. We will post the new version with a new "Last updated" date and, for material changes, give notice on the Site or by email where appropriate before the change takes effect.

14. Contact

Web3 Capital Inc. (trading as Legacy Data), Privacy team, World Trade Center 200-B, Suite 173, Calle 53 Este, Marbella, Panama City 0832-1626, Panama. Email: privacy@legacydata.ai (backup: legal@legacydata.ai).