Privacy Policy
Effective October 15, 2026
YourLegacy Studio is a brand of Amper Group LLC, a Florida limited liability company. That company ("we") is the controller of your data. For any privacy question, write to contact@yourlegacy.tech.
1. Who this covers
- Visitors to this website.
- People who open a creator’s link, or tap or scan the card, ring, bracelet or QR code that carries it.
- People a creator refers to us as possible clients, with their permission.
- People who fill in our forms: contact, newsletter and creator application.
- People who leave their details on the page of one of our clients (for example, KonnectMD) so that client can contact them.
- Approved creators and clients who use the Panel.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact and identity | Name, email, phone (optional) and language. | Forms, the application and the Panel. |
| Creator profile | Country, social network and handle, followers you declare, level, group and creator code. | Your application and our team. |
| How you found us | The code of the creator who referred you (it travels in the link) and, only if you accept measurement, the campaign you came from (UTM parameters). In the application, if you write it, who referred you: a creator code or a name. | Links, the website and your application. |
| Website measurement (only if you accept it) | How many visits the home, “Join”, “Brands”, “Management” and “Contact” pages get, how many clicks their main buttons get and how many forms are sent, added up by day, page and source (creator code and campaign). We do not store your IP, any identifier of yours, the time or your browser’s details: only totals. We do it ourselves, without third-party analytics tools. | Your browser, only if you say yes in the cookie notice. |
| Program records | Clicks on your links, payments attributed to you, commissions, reversals and payouts, and the terms you accepted and when. | The platform. |
| Tax form | The W-9 or W-8BEN you upload before your first payout. It includes your taxpayer ID. It is kept in private file storage, outside the database; only administrators can open it, through a link that expires in 15 minutes, and every upload, view and review is logged. | You. |
| Referred contacts | The name, company, email or phone and needs of the person you refer to us. We keep your confirmation that this person agreed to be contacted (its wording, language and time). We use it only to talk to them about our services. | The creator who refers them. |
| Requests for our clients | Name, email, phone (optional), U.S. state, the service you are interested in, the best time to contact you, the code of the creator who referred you (and the link of theirs you came through), and your checkboxes: the privacy one and, if you tick it, the one allowing calls and texts (its wording, version, time, the number you gave and a proof: a code derived from your IP address, not the IP itself; a summary of your browser; and the page). That permission only counts once you confirm your email with the link we send you. We do not ask you for health information, although the service you choose may show an interest in a health service. | The client’s page on this website. |
| Link visits | The link, the day, where it came from (card, ring, bracelet, other NFC chip, QR code or link) and whether that visitor had already come that day. We do not store the IP address: we keep a code derived from it with a key that changes daily and is deleted after two days. | The link itself. |
| Website contacts | When someone leaves their details on yourlegacy.tech with your code, to count it in your activity: a code that identifies that contact without saying who they are, the day, the form, the line and the link. Not their name, email or phone. Deleted after 13 months. | The YourLegacy Tech website. |
| Abuse limits | If many forms are sent in a row from the same connection: how many, and a code derived from the IP address with a key that changes daily. We do not store the IP. Deleted one hour later. | This website’s forms. |
| Content | The videos you upload (up to 2 GB), their edited versions, where you publish them and our review of the ad disclosure. | You and our team. |
| Photos and city | The angle photos and intro video you upload, and the city you choose for the team map. Each one only with your permission, which you can withdraw. | You. |
| Assistant | What you write or say to it, so it can answer. If you turn its memory on, the notes it keeps about you. | You. |
| Risk alerts | If one of your messages to the assistant talks about harming yourself: your name, email, language, the day and an alert reference. We do not keep what you wrote or a summary of it. | The assistant. |
| Account and security | How you sign in (Google or email), email verification, session start and last activity, which browser and system you sign in from (roughly, for example “Chrome on Windows”, without your IP address), a log of actions on money and access and, to stop abuse, how many times someone tries to redeem an invitation code (of the IP address, only a code made with a key that changes every day). | The platform. |
| Shipping your kit | If you give us your address so we can send your card, wristband and ring: the recipient’s name, the address, the country and, if you want, a phone number for the carrier. Only the admin team sees it, and every time they open it, it’s recorded. | You. |
| Panel notifications | The notifications we leave you in the panel about your activity in the program (your videos, your commissions and payouts, your kit) and whether you’ve read them. | The platform. |
| Newsletter | Your email, language, the page you subscribed from, how you found us, the consent version and date, and whether you want to hear about the WhatsApp group. | The newsletter form and your platform sign-up. |
| US sanctions | Your country (and, if it is Ukraine, your region) and, before each payment, the date and reference of the check against the OFAC list of sanctioned persons (the SDN list). | You and the team. |
| Activity log | Who does each action and when: on money and access, and also when the admin team opens your profile, your photos or your original video, or downloads data. Every day a chained hash of the log and of the commission ledger is computed, and a copy is kept that cannot be deleted or changed. | The platform. |
| Platform errors | When something fails, on the server or in your browser: the type of error, a message without emails, phone numbers or identifiers, the page without its parameters, the version and how many times it happened that day. Without your name or your account. | The platform and your browser. |
| Content reports | If you report content to us: the reason, where it is, your explanation and, if you give them, your name and email. | You. |
We do not collect payment card data, and we do not store bank account numbers, government IDs or sensitive data in our database.
3. Why we use it
- To run the creator program: review applications, create accounts, attribute referrals, calculate and pay commissions, and keep the commission ledger.
- To keep the platform secure: sessions that expire, access control, audit logs, and preventing fraud and abuse.
- For taxes and accounting: payment records and tax forms.
- For your content: to edit and use your videos under the permission you give when you upload them.
- To communicate with you: service emails and the newsletter, if you subscribe. When we approve your platform access, we add you to the members’ newsletter and the network’s WhatsApp group, unless you said no when signing up; you can leave anytime with the unsubscribe link in every email.
- For the Panel assistant: to answer you and, if you ask, pass your question to the team.
- To learn which pages, buttons and campaigns work, with counters added up by day, only if you accept measurement in the cookie notice. You can change your answer anytime under “Cookie preferences” in the website footer.
- To pass your request to the client you chose on its page (for example, KonnectMD) so it can reply, and to know which creator referred you. The client only calls or texts you if you allowed it in its checkbox.
- So that a person can help you if you seem to be at risk: if one of your messages to the assistant talks about harming yourself (our server detects it or the AI flags it), the assistant gives you 988 (and 911 for an emergency) and an alert is created for the owner of YourLegacy Studio, who will write to you by email.
- To comply with the law wherever we operate: we do not work with people in countries or regions under US sanctions and, before each payment, we check the OFAC SDN list; we handle content reports (the EU Digital Services Act); and we keep an activity log sealed every day so we can prove what happened.
- To find and fix platform errors, with our own copy of each error without anyone’s data.
4. Who we share it with
If you leave your details on the page of one of our clients (today, KonnectMD), we pass them to that client, at your request, so it can reply; from then on, it handles them under its own privacy policy.
These service providers process data on our behalf:
- Vercel: website hosting.
- Google Cloud / Firebase: database, sign-in, file storage and the sealed copy of the activity log (in the United States).
- Resend: email delivery.
- OpenRouter, and through it OpenAI, Google or Anthropic: the assistant’s answers and voice. They only receive the conversation and the data of yours the assistant needs to answer.
- Sentry: platform error alerts, set up to send no cookies, user IDs or emails.
- Stripe: payouts, once enabled.
- The carrier that delivers your kit (USPS, UPS, FedEx, DHL or another): the name, the address and, if you gave it, the phone number, to deliver it to you.
- WhatsApp (Meta): only if you are in the group.
- YourLegacy Tech’s CRM: the newsletter list, contact requests and clients, within the same company.
The Panel maps (the community map and the team’s map) are drawn with OpenStreetMap: your browser downloads the map tiles directly from the OpenStreetMap Foundation’s servers, which receive your IP address, your browser’s technical details and the address of this website (not the specific page). We do not send them your name or any of your account data. What they do with that data is governed by their own privacy policy.
5. What other people see
- If you are part of a group lead’s group, the lead sees only your name, whether you are active, whether you have signed in to Studio, what you promote and the next step they can help you with. Group figures (clicks, contacts, referrals, sales and videos) and what the lead earns from the group are shown to them only as totals, together with the number of people in the group. If the group has fewer than 3 people, the group figures are not shown; what the lead earns from the group still is. The lead never sees your level, your individual figures or what you earn, nor your contact or payment details.
- Only the owner of YourLegacy Studio sees the assistant’s risk alerts: they arrive by email with your name, your email and the reference, without what you wrote. The rest of the team does not see them; the audit log only records that there was an alert and its reference, not who it was about.
- Only if you agree to appear in the community, other program members and the team see on the community map and network your first name with the initial of your last name, your city and country (if you share your city), your category and the month you joined. Never your email, phone number, earnings, links or photos. For those who do not agree, we only show how many of us there are. You can stop appearing at any time in the Panel, and it is deleted.
- We do not sell your personal data or share it for third-party advertising.
- We may disclose data when the law requires it, or to protect our rights.
6. International transfers
Our systems are in the United States. If you use the platform from another country, your data is transferred to and processed in the United States.
If you are in the European Economic Area, the United Kingdom or Switzerland, each transfer relies on the European Commission’s standard contractual clauses, included in each provider’s data processing agreement, and also on the EU-US Data Privacy Framework (DPF) when the provider is certified. The standard contractual clauses remain valid even if the DPF stopped applying. If you are in another country with its own transfer rules, such as Brazil, we apply the safeguards its law requires.
Each provider’s mechanism:
- Vercel: DPF and standard contractual clauses.
- Google Cloud / Firebase: standard contractual clauses in its data processing terms.
- Resend: DPF and standard contractual clauses.
- OpenRouter, and through it OpenAI, Google or Anthropic: standard contractual clauses in its data processing agreement.
- Sentry: standard contractual clauses.
- Stripe, when it is switched on: standard contractual clauses.
- The carrier that ships your kit and WhatsApp (Meta): the transfer is necessary to give you what you ask for (delivering your kit or being in the group).
We check each provider’s DPF certification on the official list (dataprivacyframework.gov) and review it every quarter.
7. How long we keep it
| Data | How long |
|---|---|
| Applications not approved | 12 months after they were sent, if they are still pending or were rejected. Then they are deleted. |
| Creator profile | While you are in the program and 3 years after you leave it. Then it is anonymized: your personal data, internal notes, photos, intro clip and profile photo are deleted, and only the data the commission ledger, payouts and tax form need is kept (such as your country, level, payout method and the terms you accepted). Your sign-in account, with your email, is not deleted at that point: you can ask us to delete it. If you ask for deletion from your dashboard, we do it without waiting for those 3 years, except what the law requires us to keep: your application to join and the list of products you promoted are deleted with your profile, and of the referrals you made we keep only the record of the permission you gave us, without your name or the referred person’s contact details. |
| Internal team notes about you | While you are in the program. They are deleted with your profile; any left without a profile, 30 days after they were written. |
| Commission ledger, payouts and tax forms | 7 years. During that time the ledger is never erased: mistakes are corrected with a new entry. After 7 years, each entry and each payout is deleted, except what is still owed. A replaced tax form is deleted when the new one arrives. |
| Audit log | 7 years. Then it is deleted. If you ask us to delete your data, your email in the log is replaced by a hash that cannot be read, and the rest is kept for the 7 years. |
| Contacts and information requests | 24 months after the last contact if they do not become clients; if they hire us, 7 years. If someone unsubscribed or objected, when that period ends we keep only a fingerprint of their email and phone (it cannot be read back) with the date, so we never write to them again. |
| Requests to the team from the assistant | 12 months. |
| Requests to delete your data | While they are being handled. Once closed, the record (without your name or email, if the deletion was done) is kept for 3 years; then it is deleted. |
| Security counters | How many times someone tries to redeem an invitation code or downloads their data: 2 days at most. Of the IP address we only keep a code made with a key that changes every day. |
| Original video files | Deleted 60 days after the piece is closed (approved or rejected). The team can delete them earlier by hand, never sooner than 30 days. The edited version is kept. |
| Edited videos | For as long as the content permission lasts. |
| Session records | 30 days. |
| Link visits | 90 days. The daily key behind each visitor code, 2 days. The link’s totals stay with the link. |
| Website contacts | 13 months. |
| Abuse limits | One hour after their 10-minute window. |
| Assistant memory | Deleted automatically after 90 days without using the assistant, or when you delete it. |
| Risk alerts | Deleted automatically 90 days after they are created, by the daily cleanup. The email the owner receives stays in the owner’s mailbox until it is deleted there. |
| Kit shipping address | 30 days after your kit is marked as delivered; if it is never delivered, 12 months after the last change to your address or your kit. It is deleted sooner if you delete it, leave the program or ask us to delete your data from your dashboard. Once it expires, nobody sees it. |
| Panel notifications | 180 days from when they are created. From that day on, they aren’t shown. They are deleted sooner if you leave the program or ask us to delete your data from your dashboard. |
| Newsletter | Until you unsubscribe, with the link in every email. Then we keep proof of your sign-up and your unsubscribe for 3 years; after that, only your email and the unsubscribe date, so we never write to you again. |
| Daily log seal | The hashes of each day (no personal data), 7 years, like the log. The copy of each day’s log and ledger, 7 years in storage that cannot be deleted or changed during that period. |
| Platform errors | 90 days, in our own copy (grouped by day and without anyone’s data). Sentry keeps them for its own period. |
| Content reports | 3 years from when they arrive, as proof they were handled. Then they are deleted. |
| Sanctions check for each payment | With the payment: 7 years, like the ledger. |
| Measurement counters | 25 months from their day. Then they are deleted by the daily cleanup. |
8. Cookies and browser storage
We do not use advertising cookies or third-party analytics tools. Only these:
| Name | What it is for | How long |
|---|---|---|
| __session | Keeps you signed in to the Panel (strictly necessary). | Up to 24 hours. |
| yourlegacy_studio_idioma | Remembers the language you chose in the Panel. | 1 year. |
| yl_ref | Remembers which creator referred you, so they get credit if you hire us. Set by www.yourlegacy.tech. | 90 days. |
| yl-medicion (browser storage) | Your answer to the cookie notice about measurement (yes or no) and when you gave it. If yes, the website counts your visit and clicks as totals, without your IP or identifiers. | 12 months; then we ask you again. |
| yl-medicion-origen (tab storage) | Only if you accept measurement: the code of whoever referred you and the campaign you came from, so they are not lost as you move between pages. | Until you close the tab. |
| Browser storage | That you already saw the cookie notice, whether you prefer not to see the language notice, your Panel preferences and the assistant conversation (cleared when you sign out). | Until you clear it. |
9. Your rights
- You can ask us for access to your data, to correct it, delete it, get a copy, object to a use, or withdraw a consent. From your dashboard (Settings → Your data) you can download a copy of your data, up to 3 times a day, and ask us to delete it.
- For anything else, or if you cannot access the dashboard, write to contact@yourlegacy.tech. We answer within 30 days.
- Some data we must keep by law, such as payments and taxes.
- You can withdraw the photo, city, community and assistant-memory permissions yourself in the Panel.
- If you are not satisfied, you can complain to the data-protection authority in your country.
10. Security
- You sign in with Google or a verified email, and every account is approved by hand: there is no automatic sign-up.
- Sessions expire after 24 hours, and sooner if you are inactive.
- Private files open only through signed links that expire in 15 minutes.
- Admin data can be read only from the server, and every action on money or access is logged.
11. Children
The platform and the creator program are for adults (18+) only. We do not knowingly collect data from children. Anyone who signed up before October 5, 2026 has to confirm it when they open the dashboard to keep using it.
12. Changes
We will post any change on this page, with its date. If the change is significant, we will tell creators in the Panel.