Privacy Policy
Last updated: August 1, 2026
How we handle information on our website and in our platform, including the two different roles we play.
This Privacy Policy explains how Legacy X LLC, a Pennsylvania limited liability company, doing business as Luminary Impact ("Luminary Impact," "we," "us," or "our") collects, uses, shares, and protects information.
1. Scope
1.1 This Policy applies when we act as the controller of information, meaning when we determine why and how it is used. That includes: visits to lilxhub.com and its subdomains; use of the Resource Hub and its free tools and downloads; inquiries, support requests, and form submissions; account registration and administration; billing; and our marketing and events.
1.2 This Policy does not apply to information we process on behalf of a client organization inside the Platform. That processing is governed by our Data Processing Agreement with that organization. See Section 12.
1.3 This Policy does not apply to Third-Party Resources we link to. Those sites have their own privacy practices. See Section 15.
2. Information We Collect
2.1 Information you provide directly
- Contact and inquiry information. Your name, email address, organization, role, phone number where you provide it, and the content of your message when you contact us, submit a form, use the support chat, or request a Readiness Check.
- Account information. Name, email address, organization, role, and authentication credentials when an account is created for you on the Platform.
- Organization information. Legal name, EIN, address, leadership contacts, mission, program information, and brand assets that a client organization provides during onboarding.
- Billing information. Billing contact, billing address, and invoice history. Payment card details are collected and stored by our payment processor. We do not receive or store full card numbers.
- Event and communication preferences. Information you give us when you register for an event or subscribe to a mailing list.
2.2 Information collected automatically
- Device and connection data. IP address, browser type and version, operating system, device type, and referring page.
- Usage data. Pages viewed, links followed, downloads taken, time and date of visit, and similar first-party analytics.
- Platform activity records. Sign-in records, actions taken in the Platform, and access records used to operate and secure the service and to show client organizations who accessed their data.
2.3 Information from third parties
- Publicly available information about nonprofit organizations, such as IRS Form 990 data, public leadership listings, and published funding announcements, which we use for prospect research and to prepare materials.
- Information from our service providers, for example delivery and error information from our email provider, and payment status from our payment processor.
2.4 Information we ask you not to send
Do not send participant identifying information through our website forms, the support chat, or the free tools in the Resource Hub. Those surfaces are not designed to receive it. Where a client organization submits data inside the Platform, our Acceptable Use and Data Submission Policy and the intake screening described on our Trust page govern how participant data may enter.
3. How We Use Information, and Our Legal Basis
| Purpose | What we do | Legal basis |
|---|---|---|
| Operating the website and Resource Hub | Serving pages, delivering downloads, running tools, maintaining security and availability | Legitimate interest |
| Responding to you | Answering inquiries, support requests, and questions, and delivering a requested Readiness Check | Legitimate interest; steps prior to a contract |
| Providing the service | Creating and administering accounts, delivering the services, producing deliverables | Performance of a contract |
| Billing | Invoicing, processing payments, collecting amounts owed, and keeping financial records | Performance of a contract; legal obligation |
| Security and integrity | Preventing abuse, investigating incidents, recording access to client data, and enforcing our terms | Legitimate interest; legal obligation |
| Improving the service | Understanding how the site and platform are used, in aggregate | Legitimate interest |
| Marketing communications | Sending updates and information about our services to people who have asked for them or with whom we have a business relationship | Consent; legitimate interest |
| Legal compliance | Meeting tax, accounting, and other legal obligations, and responding to lawful requests | Legal obligation |
3.1 We do not sell personal information, and we do not share it for cross-context behavioral advertising.
3.2 We do not use client data or personal information to train artificial intelligence models, and we do not permit our providers to do so. Our AI provider processes content through its API to produce the requested output only, and under its commercial API terms does not use API inputs or outputs to train its models.
3.3 We do not use participant identifying data for our own purposes. Our platform is designed so that we do not hold it. See our Trust page and our Data Processing Agreement.
4. Cookies and Similar Technologies
4.1 We use only what the site needs to function and to understand basic usage. We use first-party analytics. We do not run third-party advertising trackers, we do not operate advertising networks, and we do not permit advertisers to target you through our site.
4.2 Your browser can be set to refuse cookies or to alert you when cookies are sent. Some parts of the site may not function properly if you refuse them.
4.3 We honor recognized browser opt-out signals, including Global Privacy Control, as a request to opt out of any sharing that would qualify as a sale or sharing under applicable law.
5. How We Share Information
We share information only as described here. We do not sell it, we do not rent it, and we do not provide it to data brokers or advertisers.
- Service providers and subprocessors. The infrastructure providers that operate our platform, website, payments, email, and AI drafting. Each is named, with what it does and what data it may process, in our public Subprocessor Disclosure. Each is bound by contract to protect the information and to use it only to provide its service to us.
- Professional advisers. Attorneys, accountants, auditors, and insurers, where necessary and under confidentiality obligations.
- Legal and safety. Public authorities where we receive a lawful order or where disclosure is necessary to comply with law, to establish or exercise our legal rights, or to protect against imminent harm. Where we are legally permitted to do so, we will notify the affected client organization before responding to a request for their data.
- Business transfer. A successor in the event of a merger, acquisition, reorganization, or sale of substantially all assets, subject to this Policy or a successor policy no less protective.
We do not disclose participant identifying data, because our platform is designed so that we do not hold it in a form our personnel or systems can read.
6. Subprocessors
6.1 Our current subprocessors are published at lilxhub.com/subprocessors, with the function each performs, the categories of data each may process, and its location. Electronic signature is performed inside our own platform, so no third-party signature provider processes client agreements.
6.2 We give client organizations at least thirty days' written notice before adding a subprocessor that will process their data, and they may object as provided in our Data Processing Agreement.
7. International Transfers
7.1 We are based in the United States, our infrastructure providers are United States companies, and information is processed in the United States. Some providers operate global content delivery networks, which means static website content may be cached on servers outside the United States for performance.
7.2 If you access the Site from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law of your location.
7.3 Where a transfer of personal data out of the European Economic Area, the United Kingdom, or Switzerland occurs and requires a safeguard, we rely on the standard contractual clauses or another lawful mechanism.
8. How Long We Keep Information
| Category | Retention |
|---|---|
| Website inquiries and prospect contacts | Twenty four months from last contact, then deleted or on request |
| Account records | For the life of the account, then per the schedule below |
| Client data in the Platform | For the term of the engagement. After termination: export available for thirty days, deletion from active systems within sixty days, deletion from backup rotations within ninety days of that deletion, confirmed in writing |
| Platform activity and access records | Twenty four months rolling, except where subject to a legal hold or an open incident |
| Security and audit records | Thirty six months rolling |
| Billing and tax records | Seven years, as required for tax and accounting purposes |
| Executed contracts | Term plus six years |
Where we are required by law to retain information longer, we do, and it remains protected under this Policy.
9. How We Protect Information
9.1 We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These include encryption in transit and at rest, role-based and assignment-scoped access, recorded access to client data, server-side screening that rejects participant identifying information before storage, and written confidentiality agreements signed by every person before access is granted.
9.2 Our Trust page at lilxhub.com/trust describes these controls in detail, including their limits. We describe our security posture accurately: we state what is implemented and verified, and we do not claim certifications we do not hold.
9.3 No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you are responsible for keeping your credentials confidential.
9.4 If a security incident affects a client organization's data, we notify that organization without undue delay and no later than seventy two hours after we confirm the incident, as provided in our Data Processing Agreement.
10. Your Rights
10.1 Subject to applicable law, you may have the right to: access the personal information we hold about you; know how we process it; correct inaccurate or incomplete information; delete it; restrict or object to processing; receive it in a portable format; withdraw consent where we rely on consent; and not be discriminated against for exercising these rights.
10.2 To exercise a right, email support@lilxhub.com. We respond within thirty days where reasonably possible, and we will tell you if we need longer. We may need to verify your identity before acting, and we will use the information you provide only for that purpose.
10.3 We do not use automated decision-making that produces legal or similarly significant effects.
11. California Privacy Rights
11.1 If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect and the categories of sources, purposes, and recipients; to access a copy; to request deletion; to request correction; to opt out of any sale or sharing; and to be free from discrimination for exercising these rights.
11.2 We do not sell personal information and we do not share it for cross-context behavioral advertising. There is accordingly nothing to opt out of on that basis, and we honor Global Privacy Control signals regardless.
11.3 The categories of personal information we collect are described in Section 2, the purposes in Section 3, the recipients in Section 5, and retention in Section 8.
11.4 To exercise a California right, email support@lilxhub.com. An authorized agent may submit a request on your behalf with proof of authorization.
12. When We Act on Behalf of a Client Organization
12.1 When a nonprofit organization uses our Platform, that organization decides what data to collect and why. We process it on their instructions, as their processor. Our Data Processing Agreement with them governs that processing, not this Policy.
12.2 If you are a participant, client, donor, or contact of an organization that uses our Platform, and you want to access, correct, or delete information about you, contact that organization directly. They control it. We will support them in responding, and if you contact us and identify the organization, we will refer your request to them.
12.3 Participant identifying information collected through our coded forms is stored in a vault readable only by the client organization's own authenticated users. Our personnel and our AI systems have no read path to it. We cannot retrieve it on your behalf, and that is by design.
13. Children's Privacy
13.1 The Site and the Platform are intended for organizations and adults. We do not knowingly collect personal information from anyone under sixteen for our own purposes.
13.2 If you believe a child has provided information to us directly, contact support@lilxhub.com and we will delete it.
13.3 A client organization may serve children, and any information about them is that organization's data, governed by their own privacy practices and by our Data Processing Agreement with them.
14. Marketing Communications
14.1 We send marketing communications only to people who have asked for them or with whom we have a business relationship. Every marketing email includes an unsubscribe link.
14.2 Unsubscribing from marketing does not stop transactional and service communications, such as billing notices, security notices, contract communications, and messages about your requests.
14.3 To be removed from any telephone or text outreach, email support@lilxhub.com.
15. External Links
Our Resource Hub links to government databases, foundations, nonprofit associations, and other third-party resources. We do not control those sites and are not responsible for their content or privacy practices. Review their policies before providing information to them.
16. Changes to This Policy
16.1 We may update this Policy. When we do, we post the updated version with a new last-updated date.
16.2 We notify account holders of material changes by email or in the Platform before they take effect. Where a change materially reduces a client's protections under an executed agreement, that agreement's amendment terms govern.
17. Who We Are
The Site and the Platform are operated by Legacy X LLC, a Pennsylvania limited liability company, doing business as Luminary Impact. Luminary Impact is our operating brand. Where an affiliate processes information, it does so under the same protections described here.
18. Contact Us
Privacy questions, requests, and complaints: support@lilxhub.com
Legacy X LLC, a Pennsylvania limited liability company, doing business as Luminary Impact, East Stroudsburg, Pennsylvania
If you are not satisfied with our response and you are located in the European Economic Area or the United Kingdom, you may lodge a complaint with your supervisory authority.