Privacy Policy

Summary of Key Points

This summary highlights the most important points of this Privacy Policy. Please read the full policy for complete information.

We operate lead generation, pay-per-call, marketplace, and software businesses. When you submit an inquiry, we may sell or share your information with Partners so they can respond to your request.

You can opt out of the sale or sharing of your personal information at any time using the "Your Privacy Choices" link on each covered website, and we honor Global Privacy Control and other legally recognized opt-out preference signals.

Depending on your state, you may have rights to access, correct, delete, and receive a copy of your personal information, and to opt out of targeted advertising and certain profiling.

We obtain opt-in consent before processing sensitive personal information where the law requires it, and we do not sell the sensitive personal information of residents of states that prohibit such sales.

Health-related and Medicare-related inquiries may be covered by our separate Consumer Health Data Privacy Policy, available at https://www.astoriacompany.com/washington-health-data.

To exercise any privacy right, contact us as described in the "Contact Us and Submit Privacy Requests" section below.

1. Websites and Services Covered by This Privacy Policy

This Privacy Policy is designed to support a master privacy framework for Astoria-owned and operated websites, including the categories and domains below.

The following inventory lists current Astoria-owned or Astoria-operated websites and digital properties by category. Domains are listed once even if they host multiple vertical landing pages.

This inventory is representative and does not limit coverage. Related landing pages, campaign pages, forms, phone numbers, subdomains, microsites, and other digital properties that link to, display, incorporate, or reference these terms or this Privacy Policy are also covered, whether or not listed by name.

Some sites may have additional disclosures, consent language, product-specific terms, or vertical-specific notices. If a site-specific notice conflicts with this Privacy Policy, the site-specific notice controls for that site or service to the extent of the conflict.

This Privacy Policy does not apply to personal information we collect from our own job applicants, employees, or other personnel. That information is governed by a separate applicant and personnel privacy notice provided at or before the time of collection.

2. Important Role-Based Disclosures

Astoria operates in several different roles depending on the website, service, transaction, or commercial relationship. These roles matter because different privacy obligations may apply.

• Astoria Role

3. We Are Not the Underlying Provider of Third-Party Products or Services

Unless expressly stated otherwise in writing, Astoria is not the lender, insurance carrier, Medicare plan, law firm, attorney, contractor, school, financial institution, advertiser, seller, provider, or professional service provider for the third-party products or services that may be advertised, requested, matched, or offered through our websites.

Our websites and services may operate as marketing, routing, matching, lead generation, pay-per-call, software, or advertising platforms that help connect users with third-party partners, advertisers, service providers, lead buyers, call buyers, or other commercial participants (collectively, "Partners"). Any product, service, quote, advice, engagement, enrollment, financing, case review, consultation, appointment, or transaction offered by a Partner is governed by that Partner's own terms, privacy policy, professional obligations, licensing requirements, and applicable law.

4. Personal Information We Collect

The categories of personal information we collect depend on the website or service used, the type of inquiry submitted, the commercial relationship involved, and the information provided to us. We may collect the following categories of personal information:

Examples

5. Sources of Personal Information

We collect personal information from the following categories of sources. Unless otherwise stated, each source category may apply to each category of personal information described above.

• Directly from you when you submit a form, call us, text us, email us, create an account, use a portal, request information, or otherwise communicate with us.

Directly from you when you use a website chat feature, including Tawk.to chat where enabled, such as chat messages, name, email address, phone number, business contact information, page context, timestamp, IP address, user agent, device/browser information, and related technical metadata where applicable.

From Astoria-operated websites, landing pages, forms, phone numbers, call tracking systems, APIs, dashboards, and SaaS platforms.

From publishers, marketing partners, lead sellers, call sellers, advertisers, agencies, affiliates, vendors, business partners, and other commercial sources.

From Partners, lead buyers, call buyers, service providers, clients, customers, and counterparties involved in lead generation, call routing, ping/post, host/post, pay-per-call, or SaaS transactions.

From service providers and technology vendors, such as hosting providers, analytics providers, call tracking providers, consent documentation providers, fraud prevention vendors, CRM tools, email providers, payment processors, and communications platforms.

From publicly available sources, business directories, commercial databases, government records, or other lawful sources.

6. How We Use Personal Information

Provide, operate, maintain, improve, and secure our websites, forms, platforms, APIs, services, and business operations.

• Respond to inquiries, requests, support issues, account questions, and business communications.

Provide, operate, staff, review, and respond to website chat communications, including through third-party chat technology where enabled on a covered website.

Match, route, transfer, sell, share, disclose, license, post, ping, score, validate, suppress, deduplicate, or otherwise process leads, calls, inquiries, and related data.

Connect consumers or business users with Partners that may provide, advertise, quote, review, or offer products or services requested by the user.

Document, verify, preserve, audit, and defend consent, including TCPA, DNC, text message, call, email, and electronic signature consent records.

Operate call tracking, pay-per-call, live transfer, inbound call, lead distribution, ping/post, host/post, marketplace, and related marketing technology systems.

Operate SaaS products, including OrganicStack.com, PingPost.Exchange, account dashboards, API services, routing tools, suppression tools, compliance tools, and reporting functions.

Detect, investigate, prevent, or respond to fraud, invalid traffic, bot activity, abuse, unauthorized access, DDoS attacks, security incidents, suspicious leads, and unlawful conduct.

Maintain suppression lists, opt-out lists, internal do-not-contact lists, and records needed to honor privacy requests and legal obligations.

Send service, transactional, administrative, support, legal, account, security, or business communications.

Send marketing communications where permitted by law or with required consent, subject to available opt-out rights. Every marketing email we send includes an unsubscribe mechanism, and we honor unsubscribe requests within ten (10) business days as required by the CAN-SPAM Act. You may also opt out of marketing communications at any time by contacting us as described below.

Process billing, payments, invoices, collections, disputes, credits, returns, chargebacks, and commercial account administration.

Comply with applicable laws, rules, regulations, subpoenas, court orders, regulatory inquiries, law enforcement requests, and legal process.

Establish, exercise, investigate, prosecute, or defend legal claims, disputes, audits, compliance reviews, and contractual rights.

Evaluate or conduct a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or other business transaction.

7. Disclosure, Sale, and Sharing of Personal Information

Depending on the website, service, consent language, and transaction, Astoria may disclose, sell, share, transfer, license, or otherwise make available personal information to the following categories of third parties:

Partners, advertisers, lead buyers, call buyers, service providers, agencies, networks, publishers, sellers, resellers, and other parties involved in requested Website Services, lead generation, call routing, advertising, or matching.

Mortgage, insurance, Medicare, legal, home services, education, financial services, and other vertical-specific providers relevant to the inquiry submitted.

SaaS customers, API users, platform users, or commercial counterparties where the customer or counterparty controls, receives, routes, posts, pings, or processes data through Astoria systems.

Service providers, processors, contractors, and vendors that help us provide hosting, analytics, CRM, communications, email, SMS, Zoom Phone or related communications, call tracking, payment processing, security, fraud prevention, consent documentation, compliance, data storage, and business operations.

Chat and website messaging providers, including Tawk.to where implemented, that help us provide live chat or chatbot functionality, route chats to Astoria personnel, maintain chat transcripts, and support website visitor communications.

Professional advisors, lawyers, accountants, auditors, insurers, consultants, and financial institutions.

Government authorities, regulators, courts, law enforcement, or other parties when required or permitted by law, legal process, or to protect rights, safety, security, property, or operations.

Successors or potential successors in connection with a merger, sale, financing, acquisition, bankruptcy, restructuring, or transfer of all or part of our business or assets.

Because Astoria operates lead generation and data routing businesses, certain disclosures may constitute a "sale" or "sharing" of personal information under California and other state privacy laws. Where required, you may opt out of sale, sharing, targeted advertising, or similar processing as described in the "Your Privacy Rights" section below.

8. Third-Party Partners and Communications

When you submit an inquiry through one of our websites, you may be asking to be matched with one or more Partners. By submitting your information, and subject to the consent language presented at the point of collection, you authorize Astoria to disclose your information to Partners so they may respond to your request, evaluate your inquiry, provide quotes or information, contact you, or offer products or services.

Partners may contact you by telephone, email, SMS/MMS, direct mail, website redirect, or other lawful methods if they have legally sufficient consent or another lawful basis to do so. Partner communications are governed by the Partner's own privacy policy, terms, licensing obligations, consent practices, compliance obligations, and applicable law. Astoria is not responsible for a Partner's independent privacy or marketing practices once your information has been provided to that Partner, except to the extent required by applicable law or an agreement between Astoria and that Partner.

9. Phone, Call, and SMS Communications

Astoria SMS and business communications

If you provide a mobile telephone number to Astoria, contact us by text message, submit an inquiry, request information, or otherwise communicate with us, you authorize Astoria to contact you by SMS or MMS text message for purposes related to your inquiry, request, account, transaction, service relationship, or business relationship with us.

• Astoria currently uses Zoom Phone and related messaging services to send and receive business communications. Astoria does not use SMS or MMS messaging to conduct outbound cold text messaging campaigns on its own behalf. Our SMS communications are intended to be responsive, transactional, service-related, support-related, account-related, or otherwise connected to an existing or requested communication or business relationship.

Message frequency may vary. Message and data rates may apply. Consent to receive text messages from Astoria is not a condition of purchasing any goods or services from Astoria. You represent that you are the account holder or authorized user of any mobile number you provide to us.

You may opt out of receiving text messages from Astoria by replying STOP to a message from us or by contacting us using the contact information below. You may request help by replying HELP or contacting us directly. We will honor reasonable requests to opt out of SMS communications as required by applicable law. Opting out of SMS communications from Astoria does not automatically opt you out of communications from Partners who may have separately received your information or consent. To stop communications from a Partner, follow that Partner's opt-out instructions or contact that Partner directly.

Third-party Partner SMS communications

Some Partners that receive leads or calls from Astoria may use TCPA-compliant permission to conduct outbound SMS or MMS communications. Astoria does not send those third-party text messages itself. Where permitted by the consent language presented at the point of collection and applicable law, Partners may contact you by SMS/MMS, telephone, email, or other methods. Those communications are the responsibility of the applicable Partner.

SMS Privacy Policy Statement

Astoria does not sell, rent, or share text messaging originator opt-in data or SMS consent information with third parties or affiliates for their own unrelated marketing or promotional purposes.

Astoria may use mobile numbers, text messaging opt-in data, and SMS consent records to communicate with you, respond to your inquiries, provide requested services, document consent, comply with applicable law, prevent fraud or abuse, and operate our lead routing, call routing, compliance, and business communication systems.

Where you submit an inquiry through one of our websites and consent to be contacted, Astoria may share your information, including your mobile number and related consent records, with Partners as necessary to provide requested Website Services, match you with relevant providers, document consent, or comply with applicable law. Those Partners may use your information to contact you where they have legally sufficient consent or another lawful basis to do so.

10. Website Chat and Messaging Tools

As of this update, Astoria uses the free version of Tawk.to chat, which is implemented only on AstoriaCompany.com and BestInsuranceLeads.com. Astoria does not currently deploy website chat functionality on its other websites, and this section applies only where a chat widget is actually present on the page. The chat feature may be staffed by an Astoria team member during limited business hours and may also provide automated or offline messaging functionality when staff is unavailable. By initiating or continuing a chat session, you acknowledge and consent to Astoria's and Tawk.to's collection, monitoring, recording, and storage of the chat communication and related metadata as described in this section, to the extent permitted by applicable two-party consent, wiretap, or electronic communications interception laws.

When you use a chat feature, Astoria and the chat provider may collect and process chat content and related technical metadata, such as timestamp, page URL, referrer, IP address, device/browser information, and other information you choose to provide in the chat. We use this information to respond to inquiries, provide support, document communications, improve website operations, prevent fraud or abuse, and comply with legal obligations.

Tawk.to operates as a third-party technology provider for the chat functionality. Chat communications are not intended for sensitive personal information, medical information, financial account numbers, Social Security numbers, or other highly sensitive information unless expressly requested through an appropriate secure process.

11. Consent Documentation, TrustedForm, Jornaya, Call Tracking, and Similar Technologies

We may use third-party consent documentation and verification technologies, including tools such as ActiveProspect TrustedForm, Jornaya LeadiD, call tracking systems, analytics tools, or similar technologies. These tools may collect information such as page URL, timestamps, IP address, browser and device information, form interactions, page snapshots, session activity, consent language, unique identifiers, and other data needed to document or verify consent, detect fraud, audit lead quality, or comply with law and contractual obligations.

We may combine consent documentation data with other information collected from or about you and may disclose consent records to Partners, service providers, counsel, regulators, courts, or other parties where necessary to document consent, audit compliance, investigate disputes, defend legal claims, or comply with law.

12. Cookies, Pixels, Analytics, Advertising, and Universal Opt-Out Signals

We and our service providers may use cookies, pixels, web beacons, tags, scripts, local storage, software development kits, analytics tools, and similar technologies to operate our websites, remember preferences, analyze traffic, measure performance, secure our sites, document consent, detect fraud, improve user experience, and deliver or measure advertising.

Some cookies and tracking technologies may be placed by third parties. These third parties may collect information about your activity on our websites and other websites over time and across services. Depending on the technology and applicable law, these activities may be considered targeted advertising, cross-context behavioral advertising, sale, sharing, or profiling.

Where required by law, we provide a way to opt out of sale, sharing, targeted advertising, and certain tracking technologies. We honor legally recognized universal opt-out preference signals, including Global Privacy Control ("GPC"), wherever applicable law requires and it is technically feasible. A growing number of states require covered businesses to treat these signals as valid opt-out requests. When we detect a valid opt-out preference signal from your browser or device, we treat it as a request to opt out of the sale and sharing of personal information and of processing for targeted advertising for that browser or device and, where required by law and you are otherwise known to us, for you. Where applicable law requires it, including in California, we will display a confirmation that your opt-out preference signal has been honored. You can learn more about GPC and how to enable it at https://globalprivacycontrol.org/.

• Astoria will post a "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" link on the homepage of each covered website, together with the opt-out icon prescribed by the CCPA regulations, where Astoria sells or shares personal information as defined under the CCPA.

You may also opt out of interest-based advertising by participating companies through the industry self-regulatory programs operated by the Digital Advertising Alliance at https://optout.aboutads.info/ and the Network Advertising Initiative at https://optout.networkadvertising.org/. These industry tools are browser-specific and cookie-based, so you may need to renew your choices if you clear cookies or change devices.

You can also configure your browser to refuse or delete cookies. If you do so, certain website features may not function properly.

A complete and current list of cookies and tracking technologies appears in our Cookie Policy at https://www.astoriacompany.com/cookies.

13. Artificial Intelligence, Automation, Scoring, and Routing

We may use automated systems, rules, algorithms, routing logic, lead scoring, fraud detection, quality scoring, deduplication, suppression, validation, or other automated tools to operate our websites and services. These tools may help determine whether a lead is valid, which Partner may receive an inquiry, whether a call or lead matches campaign criteria, whether a record appears duplicative or fraudulent, or how a SaaS customer's configured routing rules are applied.

Where automated processing, including automated decisionmaking technology as defined by the California regulations, is used to make or substantially facilitate a decision that produces legal or similarly significant effects concerning a consumer, we will provide the pre-use notices, opt-out rights, and access rights required by applicable law. Where required by applicable law, we will also provide required disclosures, rights, or opt-out mechanisms related to profiling, targeted advertising, or similar processing.

• Astoria personnel may use meeting platforms, such as Zoom or Microsoft Teams, that offer built-in artificial intelligence notetaking, transcription, or summarization features. If Astoria enables an AI notetaker for a call or meeting involving you, Astoria will disclose that feature and, where required by applicable two-party consent or wiretap law, obtain your consent before the AI notetaker records, transcribes, or summarizes the communication. Astoria does not use personal information collected through our websites or services to train third-party or public artificial intelligence models.

14. Sensitive Personal Information

Some websites or services may collect information that applicable law treats as sensitive, such as health-related inquiries, Medicare or insurance interests, financial information, government identifiers, account information, precise geolocation, racial or ethnic origin if voluntarily provided, or legal matter details. We use sensitive personal information only as reasonably necessary to provide requested services, route or process inquiries, document consent, secure our services, comply with law, prevent fraud, manage accounts, or as otherwise permitted by applicable law.

We do not use sensitive personal information to infer characteristics about you except as permitted by law or where reasonably necessary for the purpose for which the information was provided. Where applicable, you may have the right to limit the use or disclosure of sensitive personal information.

Most state comprehensive privacy laws require affirmative, opt-in consent before a business processes sensitive personal information for purposes beyond those strictly necessary to provide the product or service the consumer requested. Where applicable law requires opt-in consent, Astoria obtains that consent before processing sensitive personal information, including health-related, Medicare-related, and insurance-related inquiries, for any other purpose. California residents may instead have the right to limit the use and disclosure of sensitive personal information as described in the California Privacy Notice below.

Maryland law prohibits the sale of sensitive personal information altogether, and that prohibition cannot be waived by consent. Astoria does not sell the sensitive personal information of Maryland residents and limits its collection of Maryland residents' personal information to what is reasonably necessary to provide the product or service the resident requested. See also the Washington and Nevada Consumer Health Data Notice section of this Privacy Policy and our separate Consumer Health Data Privacy Policy, available at https://www.astoriacompany.com/washington-health-data, for heightened consent and authorization requirements applicable to health-related inquiries.

15. De-Identified and Aggregated Data

We may create or use de-identified or aggregated data, such as aggregate lead performance, campaign, quality, analytics, and traffic data, that cannot reasonably be linked to an identified or identifiable individual. Where we maintain de-identified data, we (a) take reasonable measures to ensure the data cannot be associated with an individual, (b) publicly commit, through this Privacy Policy, to maintain and use the data only in de-identified form and not to attempt to re-identify it, except as permitted by law to test our de-identification processes, and (c) contractually obligate any recipients of the de-identified data to comply with the same requirements.

16. Data Broker Disclosures

Astoria may act as a data broker or similar entity under certain state laws when it collects, processes, sells, licenses, discloses, transfers, or otherwise makes available personal information that it did not collect directly from the individual, or when it operates lead generation or data routing activities covered by applicable data broker laws.

• Astoria will register as a data broker in jurisdictions where it is legally required to do so and will provide required public disclosures, registry information, consumer request methods, and opt-out or deletion mechanisms. State data broker laws may include, without limitation, California, Texas, Oregon, Vermont, and any other state that enacts or applies similar requirements.

In accordance with Texas law, Astoria posts the conspicuous data broker notice prescribed by the Texas Secretary of State on each covered website and application through which it conducts business as a data broker.

California residents may have additional rights through California's Delete Request and Opt-Out Platform, known as DROP, for registered data brokers. Beginning August 1, 2026, California data brokers are required to process qualifying DROP deletion requests according to California law. Astoria will maintain procedures intended to support applicable DROP obligations where Astoria is required to participate. Astoria's California data broker registration discloses, as required, whether Astoria collects the personal information of minors, consumers' precise geolocation, or consumers' reproductive health care data, and the disclosures on Astoria's data broker disclosure page are intended to mirror the registry. Astoria will also undergo the periodic independent compliance audits required of registered California data brokers and retain related records as required by law.

Where Astoria is required to register as a data broker, Astoria will comply with the applicable registration and disclosure requirements of each state, including, without limitation: California (annual registration with the California Privacy Protection Agency between January 1 and January 31, with an associated registration fee); Texas (registration with the Texas Secretary of State under Chapter 509 of the Texas Business and Commerce Code before conducting business as a data broker, with an associated registration fee, and required website disclosures); Oregon (annual registration with the Oregon Department of Consumer and Business Services, with an associated registration fee); and Vermont (annual registration with the Vermont Secretary of State, with an associated registration fee and surety bond, and disclosures regarding the collection of data concerning minors, geolocation, and biometric or reproductive or sexual health information, as required under Vermont's data broker statute as amended). Astoria will monitor these requirements and update its registrations, fees, and disclosures as they change.

Important retention note: Even after a deletion request, we may retain limited information when permitted or required by law, such as suppression records, do-not-contact records, opt-out records, consent records, legal defense records, fraud prevention records, billing records, security records, and records necessary to comply with legal obligations or prevent future processing of deleted data.

17. Your Privacy Rights

Depending on where you live and how we process your personal information, you may have some or all of the following rights under California and other U.S. state privacy laws:

• Right to know or confirm whether we process your personal information.
• Right to access personal information we maintain about you.
• Right to receive a portable copy of certain personal information.
• Right to correct inaccurate personal information.
• Right to delete personal information, subject to legal exceptions.
• Right to opt out of the sale of personal information.
• Right to opt out of sharing personal information for cross-context behavioral advertising or targeted advertising.
• Right to opt out of certain profiling or automated decision-making where applicable.
• Right to limit the use or disclosure of sensitive personal information where applicable.
• Right to obtain, in certain states, a list of the specific third parties to which we have disclosed personal data.
• Right to appeal a privacy request decision where applicable.
• Right not to be discriminated against for exercising privacy rights.

To exercise your privacy rights, including your rights to know, access, delete, correct, receive a copy of, opt out of the sale or sharing of, opt out of targeted advertising, limit certain uses of sensitive personal information, or appeal a privacy decision where applicable, please use our Privacy Rights Center at Privacy Request or email us at privacy@astoriacompany.com. California residents and residents of other applicable states may also use our "Do Not Sell or Share My Personal Information / Your Privacy Choices" link at Your Privacy Choices. Authorized agents may submit requests through Authorized Agent Request. We may need to verify your identity or authority before fulfilling certain requests. We will not require you to create an account solely to submit a privacy request.

We will respond to a verifiable privacy request within forty-five (45) days of receipt. Where reasonably necessary, we may extend that period once, by up to forty-five (45) additional days, and we will notify you of any extension and the reason for it within the initial 45-day period. If we decline to act on your request, we will tell you why and, where applicable law provides an appeal right, how to appeal. You may appeal by using the appeal form or by replying to our response, and we will respond to your appeal within the period required by your state's law. If your appeal is denied, you may contact your state attorney general to submit a complaint.

Authorized agents may submit requests where permitted by law. We may require proof of authorization and may ask the consumer to verify their identity directly with us unless prohibited by law.

18. California Privacy Notice

This section supplements the rest of this Privacy Policy and applies to California residents. Terms used in this section have the meanings given to them under the California Consumer Privacy Act, as amended by the California Privacy Rights Act and related regulations (collectively, the "CCPA").

In the preceding 12 months, we may have collected, disclosed for a business purpose, sold, or shared the categories of personal information described below. The exact categories depend on your interactions with us. The "Sold or Shared" column indicates whether the category may have been sold or shared, as those terms are defined by the CCPA, in the preceding twelve (12) months. We collect each category from the categories of sources described in Section 5, which apply to each category listed below.

We may sell or share categories of personal information, including identifiers, contact information, commercial information, internet or network activity, inquiry information, consent records, and related information, to Partners in connection with lead generation, call routing, advertising, matching, and similar services. We do not knowingly sell or share personal information of consumers under 16 years of age.

California residents may exercise CCPA rights using the following methods:

• Email: privacy@astoriacompany.com
• Online Privacy Request Form: Privacy Request
• Do Not Sell or Share / Your Privacy Choices Form: Your Privacy Choices
• Authorized Agent Request Form: Authorized Agent Request
• Appeal Form: Privacy Appeal
• Data Broker Disclosure / DROP Page: Data Broker Disclosure
• Mailing address: 6387 Camp Bowie Blvd, STE B #171, Fort Worth, TX 76116

California residents may also use recognized opt-out preference signals, such as Global Privacy Control, where required by law and technically feasible. Where applicable law requires it, including in California, we will display a confirmation that your opt-out preference signal has been honored. We will not use dark patterns, require account creation solely to opt out, or require more information than reasonably necessary to verify or fulfill a request.

California Shine the Light

Under California's "Shine the Light" law, California residents may request, once per calendar year, information about our disclosure of certain personal information to third parties for those third parties' own direct marketing purposes. To make a Shine the Light request, email us at privacy@astoriacompany.com with "Shine the Light Request" in the subject line, or write to us at 6387 Camp Bowie Blvd, STE B #171, Fort Worth, TX 76116.

19. Other State Privacy Notices

Residents of states with comprehensive privacy laws may have rights similar to those described above, including rights to access, correct, delete, receive a portable copy, opt out of targeted advertising, opt out of sale, opt out of certain profiling, appeal decisions, and not be discriminated against for exercising rights. These states may include, without limitation, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Tennessee, New Jersey, Nebraska, New Hampshire, Minnesota, Maryland, Kentucky, Indiana, Rhode Island, and other states as laws become effective or applicable.

We will apply state-specific rights as required by applicable law. Because the scope, thresholds, exemptions, definitions, and rights vary by state, not every right applies in every situation or to every person. The following state-specific disclosures supplement the general description above.

Oregon, Minnesota, and Delaware residents

If you are a resident of Oregon, Minnesota, or Delaware, you may request a list of the specific third parties (in Oregon, at our option, either the specific third parties to which we have disclosed your personal data or the specific third parties to which we have disclosed any personal data) to which we have disclosed personal data. Minnesota residents who are subject to profiling in furtherance of a decision that produces legal or similarly significant effects also have the right to question the result of the profiling, to be informed of the reason the profiling resulted in the decision, to be informed of what actions might have led to a different decision, and to have their personal data reviewed and corrected in connection with a re-evaluation.

Maryland residents

Maryland law limits our collection of your personal data to what is reasonably necessary to provide or maintain the product or service you request, prohibits the sale of sensitive data, and prohibits the sale of personal data of consumers under eighteen (18) and the processing of their personal data for targeted advertising. Astoria does not sell the sensitive personal information of Maryland residents.

Nevada residents

Nevada residents may direct a website operator not to sell certain covered information collected through a website, as provided by Chapter 603A of the Nevada Revised Statutes. To exercise this right, submit a request through our designated request address, which is the dedicated privacy email address listed in the contact section below, or through the privacy request form. We will respond within sixty (60) days as required by Nevada law, and we may extend that period by up to thirty (30) days where reasonably necessary with notice to you. Nevada residents should also review the Washington and Nevada Consumer Health Data Notice below.

20. Retention of Personal Information

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, operate our business, comply with law, maintain records, resolve disputes, enforce agreements, document consent, prevent fraud, maintain suppression lists, and defend legal claims.

Retention periods may vary based on the type of data, source, applicable vertical, contractual requirements, legal requirements, statute of limitations, regulatory requirements, and business needs. For example, we may retain consent records, call records, lead transaction records, suppression records, billing records, and compliance records for longer periods when necessary to demonstrate compliance with TCPA, DNC, privacy, data broker, advertising, contractual, or other legal obligations.

The table below describes the criteria we use to determine the retention period for each category of personal information described in Section 4:

Retention Criteria

21. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. However, no method of transmission, storage, or security is completely secure, and we cannot guarantee absolute security.

If you use a SaaS account, API, dashboard, or customer portal, you are responsible for maintaining the confidentiality of your login credentials, API keys, authorized users, and account configurations.

22. Children, Teens, and Minors

Our websites and services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. We also do not knowingly sell or share personal information of consumers under 16 years of age. In addition, where applicable law restricts the sale of personal data of consumers under 18, or the processing of their personal data for targeted advertising or certain profiling, we do not knowingly engage in those activities with respect to consumers we know or should know are under 18. Our agreements prohibit Partners from purchasing leads known to relate to minors. If you believe a child or minor has provided personal information to us, contact us so we can review and take appropriate action.

23. International Users

Our websites and services are operated from the United States. If you access our websites or services from outside the United States, you understand that your information may be collected, processed, transferred, stored, and used in the United States and other jurisdictions that may not provide the same level of data protection as your location.

24. Third-Party Websites and Services

Our websites and communications may contain links to third-party websites, services, ads, offers, forms, or platforms. We do not control and are not responsible for the privacy practices of third parties. Review the privacy policies and terms of any third-party websites or services you visit or use.

Third-party chat widgets or messaging tools may be embedded on certain Astoria websites. Your interaction with a chat tool may involve processing by the chat provider under its own terms and privacy practices, in addition to Astoria's use of the information as described in this Privacy Policy.

25. Business Transfers

We may disclose or transfer personal information as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, assignment, due diligence process, or other business transaction involving all or part of Astoria's business or assets.

26. Financial Privacy Notice for Mortgage, Lending, and Financial Services Websites (Gramm-Leach-Bliley Act)

Some of our websites, including MortgageLeads.com, MortgageZone.com, and ExpressCash.com, help connect consumers with mortgage lenders, brokers, or other financial services providers. The Federal Trade Commission has stated that a "finder" that brings together buyers and sellers of financial products, including a website that helps a consumer find a mortgage lender, may itself be a "financial institution" subject to the Gramm-Leach-Bliley Act.

To the extent Astoria is treated as a financial institution or finder under the Gramm-Leach-Bliley Act for these websites, Astoria will: (a) maintain an information security program that satisfies the FTC Safeguards Rule, including risk assessments, access controls, encryption, multi-factor authentication, a designated Qualified Individual, and a written incident response plan, unless a small-business exemption applies; and (b) provide any notice and opt-out rights required by the GLBA Privacy Rule and Regulation P before sharing nonpublic personal information with nonaffiliated third parties for purposes not otherwise permitted by a statutory exception. Astoria does not publish a separate GLBA financial privacy opt-out webpage. Where an applicable GLBA opt-out right exists, you may submit a request using the privacy contact methods described in this Privacy Policy.

• Astoria is not a consumer reporting agency and does not furnish or assemble consumer reports for purposes of the Fair Credit Reporting Act. Partners may not use information received from Astoria to make credit, insurance, employment, housing, or other eligibility determinations regulated by the Fair Credit Reporting Act unless expressly permitted under a separate written agreement with Astoria.

27. Washington and Nevada Consumer Health Data Notice

Washington's My Health My Data Act and Nevada's consumer health data law broadly define "consumer health data" to include information, such as insurance and Medicare inquiries, that reveals a consumer's physical or mental health status. This definition may extend to health-related and Medicare-related inquiries collected through NewMedicare.com and NewHealthInsurance.com. Consumer health data that is subject to the Gramm-Leach-Bliley Act, as described in the preceding section, is exempt from Washington's My Health My Data Act, but not all Medicare and health insurance inquiry data collected by Astoria will qualify for that exemption.

Where consumer health data is not exempt, Astoria maintains a separate Consumer Health Data Privacy Policy, linked prominently on applicable websites, disclosing the categories of consumer health data collected, the purposes for collection, the categories of sources, and the categories of third parties with whom the data is shared. Astoria obtains affirmative, opt-in consent, separate from any other consent or acceptance of terms, before collecting or sharing consumer health data except where collection or sharing is necessary to provide a product or service you requested. Astoria does not sell consumer health data and does not share consumer health data with affiliates. Astoria does not use geofencing within a defined radius of a mental health facility or reproductive or sexual health facility to identify, track, or send messages to consumers.

Washington and Nevada residents have the right to confirm whether we collect, share, or sell consumer health data about them; to access that data, including a list of the third parties and affiliates with whom it has been shared or to whom it has been sold and an active contact method for each; to withdraw consent; to have their consumer health data deleted; and to appeal a refusal to act on a request. You may exercise these rights through the Consumer Health Data Rights page or the Consumer Health Data Request Form. These rights and the process for exercising them are described in the Consumer Health Data Privacy Policy.

28. Video Content, Embedded Third-Party Platforms, and the Video Privacy Protection Act

OrganicStack.com hosts instructional videos, which may also be shared on Facebook and YouTube. The federal Video Privacy Protection Act restricts disclosure of a consumer's video-viewing history when linked to a personal identifier. Recent litigation trends have focused on advertising pixels embedded on pages that display video content, which may transmit a video title together with an identifier to a third-party advertising platform. Astoria will review whether tracking pixels are active on pages containing video content and will disclose any such practice, obtain any consent required by applicable law, or adjust its technical implementation to avoid transmitting video-viewing information to third parties in a manner inconsistent with the Video Privacy Protection Act.

29. Accessibility of This Privacy Policy

We are committed to ensuring that this Privacy Policy is reasonably accessible to consumers with disabilities. This policy is published in a format intended to conform to recognized industry accessibility standards, including the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. If you have difficulty accessing this policy, or if you would like a copy in an alternative format, contact us using the information below and we will provide the policy in a format that works for you.

30. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we update it, we will revise the effective date or last updated date above. The updated version will be posted on the applicable website. If we make material changes to how we collect, use, sell, or share personal information, we will describe the change at the top of the updated policy and, where required by law, provide additional notice or obtain any required consent. Your continued use of our websites or services after an update means you acknowledge the updated Privacy Policy.

31. Contact Us and Submit Privacy Requests

To submit a privacy request, opt-out request, data broker request, consumer health data request, or question about this Privacy Policy, please contact:

Privacy Officer
Astoria Company Marketing LLC d/b/a Astoria Company
6387 Camp Bowie Blvd, STE B #171, Fort Worth, TX 76116
Dedicated Privacy Email: privacy@astoriacompany.com
General Business Email: bizdev@astoriacompany.com

• Privacy Request Form: Privacy Request
• Do Not Sell or Share / Opt-Out Form: Your Privacy Choices
• Authorized Agent Request Form: Authorized Agent Request
• Appeal Form: Privacy Appeal
• Data Broker / DROP Request Page: Data Broker Disclosure
• Cookie Policy: Cookie Policy
• Consumer Health Data Privacy Policy: Consumer Health Data Privacy Policy
• Consumer Health Data Rights / Request Page: Health Data Rights
• Consumer Health Data Request Form: Consumer Health Data Request Form

Astoria does not use or disclose sensitive personal information for purposes that require a separate "Limit the Use of My Sensitive Personal Information" link under California law, and therefore does not publish that link. If our practices change, we will update this Privacy Policy and provide any required request method.