The short version
This notice covers Herron & Co. Legacy Agency ("we," "us," "our") and describes how we access, collect, store, use, and share your personal information when you visit our website, request information about life insurance or annuity products, talk to the Legacy Concierge, or otherwise contact us. If you don't agree with it, please don't use our services.
What we collect
Your name, phone, email, and mailing address when you ask us for information. If you apply for coverage, the carrier's application also collects underwriting information.
Why we collect it
To answer you, quote you, service your policy, market to you if you've opted in, keep our systems secure, and follow the law.
We don't sell it
We have not sold or shared personal information for a business or commercial purpose in the last 12 months, and we won't in the future.
Your phone number
Your SMS opt-in and consent are never shared with third parties or affiliates for their marketing. Reply STOP to any text to end it.
Your rights
Depending on your state, you can see what we hold, correct it, get a copy, or have it deleted. Ask and we act.
How to reach us
Email [email protected] or call 610-360-8583. A real person answers.
What information we collect
We collect what you hand us, plus basic technical data your browser sends automatically, plus limited data from public and marketing sources.
Information you give us
We collect personal information you voluntarily provide when you register on our services, ask about our products, take part in activities on our site, or otherwise contact us. That typically includes:
- Names
- Phone numbers
- Email addresses
- Mailing addresses
Everything you give us must be true, complete, and accurate, and you need to tell us when it changes.
Sensitive and underwriting information
We do not collect sensitive personal information through this website, our marketing forms, or the Legacy Concierge. If you move forward with an application, the insurance carrier's application process collects the information required to underwrite the policy — which can include date of birth, Social Security number, income, medical history, prescription history, lifestyle information, driving record, and consumer report data. That information is collected and used only to place and service coverage, and only with your authorization on the application. See our Pennsylvania insurance notice below for how insurance-specific information is handled.
Payment information
If you make a purchase, payment data — including your payment instrument number and its security code — is handled and stored by Ethos. Their privacy notice: privacy.ethoslife.com/policies.
Information collected automatically
Some information is collected automatically when you visit our services. It doesn't reveal your identity on its own, and we use it to keep the site running, secure, and measurable.
- Log and usage data. IP address, device information, browser type and settings, date/time stamps, pages and files viewed, searches, features used, and error reports.
- Device data. Information about the computer, phone, or tablet you use, including IP address, device and application identifiers, browser type, hardware model, ISP or mobile carrier, operating system, and configuration.
- Location data. Precise or imprecise location, depending on your device settings. You can turn this off in your device's location settings, though some features may stop working.
Information from other sources
To improve our marketing and keep our records current, we may obtain information about you from public databases, joint marketing partners, affiliate programs, data providers, social media platforms, and other third parties. This can include mailing addresses, job titles, email addresses, phone numbers, intent data, IP addresses, social media profiles and URLs, and custom profiles, used for targeted advertising and event promotion.
If you interact with us on a social platform using your social account, we receive information from that platform depending on your settings there. Their use of your information isn't governed by this notice.
Google APIs
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we use it
To provide and improve our services, talk to you, prevent fraud, and comply with the law. Anything else needs your consent.
We process your personal information for these reasons, depending on how you interact with us:
- To create and manage your account so you can log in and keep it in working order.
- To answer your questions and support you when you contact us about a quote, a policy, or a problem.
- To enable communication between users if you use a feature that allows it.
- To send you marketing and promotional messages, consistent with your preferences. You can opt out any time — see Your privacy rights.
- To deliver targeted advertising — developing and displaying content and ads tailored to your interests and location.
- To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend legal rights.
Who we share it with
Only in the specific situations listed here. We don't sell your information.
We may need to share your personal information in these situations:
- Business transfers. In connection with, or during negotiations of, a merger, sale of assets, financing, or acquisition of all or part of our business.
- Affiliates. With our affiliates, who are required to honor this notice. Affiliates include any parent company, subsidiaries, joint venture partners, or companies under common control with us.
- Business partners. With partners, to offer you certain products, services, or promotions.
- Service providers. With vendors who run parts of our business under written contract — including our CRM, SMS provider, scheduling software, and insurance carriers processing your application.
We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, and we will not sell or share the personal information of website visitors, users, or other consumers in the future.
The Legacy Concierge and automated tools
Yes, we use automated tools, including the Legacy Concierge on our site. Your information passes through those providers under contract, handled the same way as the rest of this notice describes.
As part of our services we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies ("AI Products"). The terms of this notice govern your use of them.
Our AI products
- The Legacy Concierge, our on-site insurance assistant
- AI automation
- AI bots
Providers
We provide AI Products through third-party service providers, including Anthropic (Claude). Your input, output, and personal information are shared with and processed by these providers to enable your use of our AI Products, for the purposes described in Who we share it with. You must not use the AI Products in any way that violates a provider's terms or policies.
All personal information processed using our AI Products is handled in line with this notice and our agreements with those providers. The Legacy Concierge provides general information only — not individualized financial, legal, or tax advice.
Social logins
If you register using a social account, we receive some profile information from that platform.
Our services may let you register and log in using third-party social media account details, such as Facebook or X. If you do, we receive certain profile information from that provider — often your name, email address, friends list, and profile picture, plus anything else you've made public there.
We use what we receive only for the purposes described in this notice or made clear to you at the time. We don't control, and aren't responsible for, other uses of your information by your social media provider. Review their privacy notice and settings.
How long we keep it
As long as we need it for the purposes in this notice, unless the law requires longer.
We keep your personal information only as long as necessary for the purposes set out here, unless a longer retention period is required or permitted by law — for example tax, accounting, or insurance recordkeeping requirements. For account information, that period is generally the length of time you have an account with us.
When we no longer have a legitimate business need to process your information, we delete or anonymize it. If that isn't possible — for example, because it sits in a backup archive — we securely store it and isolate it from further processing until deletion is possible.
How we protect it
We use reasonable organizational and technical safeguards. No system on the internet is 100% secure, and we won't pretend otherwise.
We've implemented appropriate and reasonable technical and organizational security measures designed to protect the personal information we process. Despite those safeguards, no electronic transmission over the internet and no storage technology can be guaranteed 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorized third parties will never defeat our security. Transmission of personal information to and from our services is at your own risk. Access our services only from a secure environment.
Minors
We don't knowingly collect data from or market to anyone under 18.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using our services you represent that you're at least 18, or that you're the parent or guardian of a minor and consent to that minor's use of the services. If we learn that we've collected personal information from a user under 18, we'll deactivate the account and take reasonable measures to promptly delete the data from our records. If you become aware of data we may have collected from a child under 18, contact us at [email protected].
Your privacy rights
You can review, change, or close your account at any time, and withdraw consent whenever you want.
Withdrawing your consent
Where we rely on your consent to process your personal information — express or implied, depending on the law that applies — you can withdraw it at any time by contacting us using the details in Contact us. Withdrawal doesn't affect the lawfulness of processing before you withdrew, and it doesn't affect processing we carry out on lawful grounds other than consent.
Opting out of marketing
You can unsubscribe from marketing and promotional communications at any time by replying STOP or UNSUBSCRIBE to our texts, or by contacting us using the details in Contact us. We'll remove you from the marketing lists. We may still send service-related messages necessary to administer your account, respond to your requests, or for other non-marketing purposes.
Your account information
To review or change the information in your account, or close it, contact us using the details below. On request we'll deactivate or delete your account and information from our active databases. We may retain some information to prevent fraud, troubleshoot problems, assist investigations, enforce our legal terms, or comply with legal requirements.
Text and call consent
Your opt-in to texts is never shared with anyone for their marketing. Ever. Reply STOP to end it.
By submitting your contact information, you consent to be contacted by phone calls, text messages (SMS/MMS), and automated systems at the number you provided. Message frequency varies. Message and data rates may apply. You may opt out at any time by replying STOP.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors providing support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with third parties.
Consent to be contacted is not a condition of purchase, and submitting your information does not guarantee approval for any insurance product. All coverage is subject to underwriting and carrier approval. We are not a government agency.
Do-not-track signals
There's no agreed standard for DNT signals yet, so we don't respond to them.
Most browsers and some mobile operating systems and apps include a Do-Not-Track ("DNT") feature you can turn on to signal that you don't want your online browsing activity monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. California law requires us to tell you this. If a standard is adopted that we must follow, we'll say so in a revised version of this notice.
US state privacy rights
Residents of many states can request access to, correction of, a copy of, or deletion of their personal information. Ask us and we act.
If you're a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and details about the personal information we maintain about you and how we've processed it, correct inaccuracies, get a copy of it, or delete it. You may also have the right to withdraw consent. These rights can be limited in some circumstances by applicable law.
Categories of personal information we collect
The table below shows the categories of personal information we've collected in the past twelve (12) months, with illustrative examples of each.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details such as real name, alias, postal address, telephone or mobile number, unique personal identifier, online identifier, IP address, email address, and account name | Yes |
| B. California Customer Records | Name, contact information, education, employment, employment history, and financial information | No |
| C. Protected classifications | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | No |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information | No |
| E. Biometric information | Fingerprints and voiceprints | No |
| F. Internet or network activity | Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements | No |
| G. Geolocation data | Device location | No |
| H. Audio, electronic, sensory | Images and audio, video or call recordings created in connection with our business activities | No |
| I. Professional or employment | Business contact details to provide our services at a business level, or job title, work history, and qualifications if you apply for a job with us | No |
| J. Education information | Student records and directory information | No |
| K. Inferences | Inferences drawn from collected personal information to create a profile or summary about an individual's preferences and characteristics | No |
| L. Sensitive personal information | Information collected through the website and marketing forms | No |
We may also collect other personal information outside these categories when you interact with us in person, online, by phone, or by mail in the context of receiving help through our customer support channels; participating in customer surveys or contests; and our delivery of services and responses to your inquiries.
We retain Category A information for as long as you have an account with us.
We may use your personal information for our own business purposes, such as internal research for technological development and demonstration. This is not considered "selling" your personal information.
Your rights
These rights aren't absolute, and in certain cases we may decline a request as permitted by law. They include:
- Right to know whether we're processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of processing your personal data for targeted advertising (or "sharing" as defined under California law), the sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects
Depending on your state, you may also have the right to:
- Access the categories of personal data being processed (including under Minnesota law)
- Obtain a list of the categories of third parties we've disclosed personal data to (including under California, Delaware, and Maryland law)
- Obtain a list of specific third parties we've disclosed personal data to (including under Minnesota and Oregon law)
- Obtain a list of third parties we've sold personal data to (including under Connecticut law)
- Review, understand, question, and where applicable correct how personal data has been profiled (including under Connecticut and Minnesota law)
- Limit use and disclosure of sensitive personal data (including under California law)
- Opt out of the collection of sensitive data and personal data collected through a voice or facial recognition feature (including under Florida law)
How to exercise your rights
Submit a data subject access request, email us at [email protected], or use the contact details at the bottom of this page.
Under certain state laws you can designate an authorized agent to make a request for you. We may deny a request from an agent who doesn't submit proof they've been validly authorized to act on your behalf.
Request verification
When we receive your request, we need to verify you're the person we hold information about. We'll use the personal information in your request only to verify your identity or authority. If we can't verify you from what we already hold, we may ask for additional information for verification and fraud-prevention purposes. If you submit through an authorized agent, we may need additional information, and the agent will need to provide your written, signed permission.
Appeals
If we decline to act on your request, you may appeal by emailing [email protected]. We'll tell you in writing what action we took or didn't take, with a written explanation of the reasons. If your appeal is denied, you may submit a complaint to your state attorney general.
Pennsylvania insurance notice
Pennsylvania has its own rules for insurance information. Here's how we follow them.
In accordance with the Pennsylvania Insurance Data Security Act and 31 Pa. Code Chapter 146a, Herron & Co. Legacy Agency is dedicated to protecting your non-public personal information.
Information we collect
We collect "non-public personal financial information," which can include:
- Direct information. Name, address, income, and Social Security number provided on applications.
- Underwriting data. Medical history, lifestyle data, and credit information from consumer reporting agencies.
- Usage data. IP addresses and browsing activity on our Pennsylvania-facing site.
Disclosure
We do not disclose any non-public personal information about our customers or former customers to anyone, except as permitted or required by law. That includes sharing with affiliates, to provide common insurance and financial services, and with non-affiliated third parties, only as necessary to process or service your transactions — for example, medical examiners or reinsurers.
Data security standards
We maintain physical, electronic, and procedural safeguards that comply with the Pennsylvania Insurance Data Security Act. Our systems are monitored to prevent unauthorized access to your sensitive health and financial records.
Access and correction
Under Pennsylvania law you have the right to access and request correction of the personal information we have on file. Requests must be sent in writing to [email protected].
Fraud notice
As required by Pennsylvania law, we must advise you that submitting false information on an insurance application is a fraudulent act, which is a crime that can lead to penalties and legal action.
"Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance or statement of claim containing any materially false information or conceals for the purpose of misleading, information concerning any fact material thereto commits a fraudulent insurance act, which is a crime and subjects such person to criminal and civil penalties."
Updates to this notice
Yes, we update it as the law changes. Check the date at the top.
We may update this privacy notice from time to time. The updated version is marked by a revised "Last updated" date at the top of this page. If we make material changes, we may notify you by prominently posting a notice of the changes or by contacting you directly. We encourage you to review this notice regularly.
Contact us
Email, call, or write. To see, correct, or delete your data, use the request link.
If you have questions or comments about this notice, or you want to review, update, or delete the personal information we hold about you, reach us here:
- Agency
- Herron & Co. Legacy Agency
Connor Herron · NPN 21556594 - [email protected]
- Phone
- 610-360-8583
- 30 S 15th Street, Suite 1550
Philadelphia, PA 19102-4806
United States
Depending on the laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we've processed it, correction of inaccuracies, or deletion. You may also have the right to withdraw your consent. These rights may be limited in some circumstances by applicable law.