Last Updated: February 7, 2026
Privacy Policy
1. Who We Are
LEGWORK (“LEGWORK,” “we,” “us,” or “our”) is a data integration and marketing automation sole proprietorship based in California. We provide two core services:
- Event Registration Integrations — connecting registration platforms (such as ACTIVE.com and Let’s Do This) to marketing, analytics, and attribution tools for event organizers and race directors
- Agentic Marketing Systems — AI-powered marketing agents that draft content, orchestrate campaigns, and generate reports for businesses, with human review before publication
When we process data on behalf of our clients, we act as a data processor (or “service provider” under CCPA). The client who contracted our services is the data controller (or “business” under CCPA) and determines the purposes for which data is processed.
This Privacy Policy applies to:
- Visitors to our website at legworkdata.com
- Individuals whose registration data is processed through LEGWORK’s integration services on behalf of our clients
- Individuals whose marketing data is processed through LEGWORK’s agentic marketing systems on behalf of our clients
2. Information We Collect
2.1 Registration Data (Processed on Behalf of Our Clients)
When event organizers use our integration services, we process the following categories of personal information from their registration platforms:
| Category | Data Fields |
|---|---|
| Identity | First name, last name, email address |
| Demographic | Date of birth, gender |
| Contact | Street address (line 1 & 2), city, state/region, country, ZIP/postal code, phone number (only when SMS consent is granted) |
| Registration & Event | Registration ID, registration number, event name, race distance, ticket type, race city, race year, consent date, first-timer program status |
| Financial | Payment amount (net & gross), processing fees, payment method, payment date, discount codes, discount amounts, order numbers |
| SMS Consent | Opt-in status, consent date, phone number (captured only upon opt-in) |
| Ambassador Attribution | Discount codes used, ambassador region, net ticket revenue |
2.2 Agentic Marketing Data (Processed on Behalf of Our Clients)
When businesses use our agentic marketing systems, we may process the following data provided by or on behalf of the client:
- Brand assets — brand voice guidelines, messaging frameworks, visual identity references
- Audience data — buyer persona definitions, audience segments, and behavioral data provided by the client
- Campaign data — marketing calendar details, campaign performance metrics, channel configurations
- Generated content — AI-drafted email copy, social posts, ad creative, and reports (stored until client review and approval)
We do not access or store end-customer personal data through our agentic marketing systems unless explicitly provided by the client for audience segmentation purposes.
2.3 Website Visitor Data
When you visit legworkdata.com, we collect contact form data (name, email address, message content) only when you submit a form. We do not set first-party cookies or use first-party analytics.
3. How We Collect Information
Registration data is collected through authorized API connections to our clients’ registration platforms (ACTIVE.com API, Let’s Do This API) and through Zapier triggers configured by the client. All API access is authorized by the client through API keys they provide.
Agentic marketing data is provided directly by the client during onboarding and ongoing collaboration. AI agents access only the data, brand assets, and platform credentials explicitly provided by the client.
Website data is collected directly from you when you submit a contact form on legworkdata.com. Form submissions are processed by Formspree.
4. How We Use Your Information
We process data strictly as instructed by our clients for:
Integration Services
- Email marketing automation — syncing contact profiles to the client’s email platform (e.g., Klaviyo)
- Registration reporting — populating Google Sheets dashboards
- SMS marketing — subscribing opted-in contacts to SMS lists
- Revenue attribution — tracking revenue by campaign and discount code
- Ambassador attribution — syncing order data to Roster for ambassador tracking
- Audience segmentation — tagging contacts by race year, city, distance, ticket type, and first-timer status
- EU/US data segregation — routing European contacts to a separate EU list
Agentic Marketing Services
- Content generation — drafting email sequences, social posts, and ad copy using AI agents trained on the client’s brand voice and personas
- Campaign orchestration — planning and coordinating multi-channel marketing campaigns
- Performance reporting — analyzing campaign metrics and generating insights
- Audience strategy — developing persona-targeted messaging and segmentation recommendations
5. Who We Share Your Information With
| Provider | Purpose | Data Shared |
|---|---|---|
| Klaviyo | Email & SMS marketing | Name, email, phone, address, DOB, gender, registration metadata, SMS consent, revenue events |
| Google Cloud (Sheets) | Registration dashboards | Registration data, revenue data, demographics |
| Roster | Ambassador attribution | Order IDs, discount codes, revenue, customer email/name |
| Amazon Web Services | Processing infrastructure (EC2) | All registration data during processing |
| Anthropic / AI Providers | Agentic marketing content generation | Brand assets, campaign briefs, anonymized audience segments (no PII sent to AI models) |
| Zapier | Workflow automation | Registration data per client configuration |
| Formspree | Contact form processing | Name, email, message |
| Cloudflare | Website hosting & CDN | IP address, browser information |
We do NOT sell your personal information. We do not share personal information for cross-context behavioral advertising.
6. SMS Consent & Communications
SMS consent is captured through registration survey questions on the source platform. A registrant is only enrolled in SMS marketing if they answer the consent question with “yes” or “oui” (case-insensitive). Any other answer results in no SMS enrollment.
When you opt in, your phone number is formatted to E.164 international format and subscribed to the client’s SMS marketing list in Klaviyo. The client (not LEGWORK) sends SMS messages through their Klaviyo account.
To opt out: Reply STOP to any message, contact the event organizer directly, or email [email protected].
7. AI & Agentic Marketing Data Processing
When providing agentic marketing services, LEGWORK uses AI models to generate marketing content on behalf of clients. Important details about this processing:
- No PII is sent to AI models — we do not send personally identifiable information (names, emails, phone numbers) to AI providers. Audience targeting is done through anonymized persona definitions and segment descriptions.
- Human review required — all AI-generated content is reviewed and approved by the client (or their designated representative) before publication or distribution.
- Brand data security — brand voice guidelines, messaging frameworks, and campaign briefs provided by clients are stored securely and used solely for that client’s marketing system.
- No cross-client training — data from one client’s marketing system is never used to train or improve systems for other clients.
8. Cookies & Tracking Technologies
LEGWORK’s website does not set any first-party cookies and does not use first-party analytics or tracking pixels.
Our hosting provider Cloudflare may set a __cf_bm cookie for bot management and security purposes. This cookie lasts 30 minutes and is classified as “strictly necessary” — it does not track users for advertising.
9. Data Retention
- Registration data on LEGWORK infrastructure: Duration of client contract + 30 days, then deleted
- Agentic marketing data: Duration of client contract + 30 days, then deleted
- AI-generated content: Retained for the duration of the client contract for reference and iteration
- Transient processing data: Deleted after each processing cycle (typically < 1 hour)
- Application log files: 30 days
- Contact form submissions: Retained by Formspree per their retention policy
Data in client-controlled platforms (Klaviyo, Google Sheets, Roster) is retained according to the client’s own retention policies.
10. International Data Transfers
LEGWORK identifies contacts from European countries based on their registered country code and routes them to a dedicated EU list in the client’s Klaviyo account. This covers 50+ European countries including all EU/EEA member states and the United Kingdom.
Data processed through LEGWORK’s infrastructure is stored on AWS EC2 instances in the United States. For EU data subjects, transfers are governed by Standard Contractual Clauses (SCCs) where required.
11. Your Privacy Rights
Regardless of where you are located, you may:
- Request access to the personal data we process about you
- Request correction of inaccurate personal data
- Request deletion of your personal data
- Object to processing of your personal data
- Request data portability (receive your data in a structured format)
Because LEGWORK acts as a data processor, we may need to redirect your request to the event organizer or business (our client) who is the data controller.
To submit a request: Email [email protected] with the subject line “Privacy Request.”
Current limitation: Data deletion is handled via manual request. We do not currently offer automated self-service deletion.
12. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose
- Delete your personal information
- Correct inaccurate personal information
- Opt out of sale/sharing — we do not sell or share your data for behavioral advertising
- Non-discrimination for exercising your rights
Categories of Personal Information Collected
| CCPA Category | Collected | Purpose |
|---|---|---|
| Identifiers | Yes | Marketing automation, contact sync |
| Personal info (Cal. Civ. Code §1798.80(e)) | Yes | Marketing automation |
| Protected classifications | Yes | Audience segmentation |
| Commercial information | Yes | Revenue attribution |
| Geolocation (inferred) | Yes | EU/US list routing |
| Inferences | Yes | First-timer status, EU/US classification, persona targeting |
Submit CCPA requests to [email protected] or call +1 (818) 447-6395. We respond within 45 days.
13. European Privacy Rights (GDPR)
If you are in the EEA, UK, or Switzerland, your data is processed under:
- Performance of a contract — processing your event registration
- Legitimate interests — the organizer’s interest in marketing their events
- Consent — where you have opted in to SMS marketing
You additionally have the right to restrict processing, withdraw consent at any time, and lodge a complaint with your local data protection supervisory authority.
14. Data Security
- All data transfers use TLS 1.2+ encryption
- AWS EC2 instances use encrypted EBS volumes
- API keys stored in environment variables, not in source code
- Access limited to authorized LEGWORK personnel
- AI model interactions use encrypted API connections with no data retention by AI providers
No method of transmission over the Internet is 100% secure. While we use commercially acceptable means to protect your data, we cannot guarantee absolute security.
15. Children’s Privacy
LEGWORK does not knowingly collect personal information from children under 13 (or under 16 in the EEA). When we identify a registration as a kids race, we apply additional data minimization measures.
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy with a revised “Last Updated” date and notify clients via email when changes affect data processing.
17. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights:
LEGWORK
Email: [email protected]
Phone: +1 (818) 447-6395
Website: legworkdata.com