Last updated: 10 October 2026.
This policy explains how LegionStories uses personal data when you browse this website, comment, contact us or choose your cookie preferences. The Legion Training app has a separate privacy policy.
Who is responsible for your data?
Invometa is the operator and data controller for legionstories.com. This means it is responsible for deciding how personal data collected through this website is used. For privacy questions or to exercise your rights, email info@legionstories.com.
Comments
When you comment, WordPress collects your display name, email address, comment, IP address and browser user-agent information. Your display name, comment and publication date become public if the comment is published. Your email address is not displayed with the comment. A name and email address are required to submit a comment; you can read the website without commenting.
We use this information to publish and moderate discussions and protect the website against spam and abuse. The legal basis is our legitimate interest in maintaining a useful, secure discussion space. Antispam Bee performs automated spam checks on the website. A comment identified as spam may be withheld from publication; contact us if you believe your comment was blocked incorrectly.
We keep published comments while the discussion remains useful and review their relevance annually. Spam comments are scheduled for automatic deletion after 30 days. We review private comment details, including email addresses, IP addresses and browser information, quarterly, with a target of removing or anonymising them 90 days after moderation is complete. We may keep details longer where needed to prevent continuing abuse, meet a legal obligation or resolve a dispute. The quarterly review is manual; it is not an automatic 90-day expiry. You can ask us to delete or anonymise a comment and the personal data associated with it.
Contact messages and email
The contact form asks for your name, email address and message, with an optional subject. We need the required fields to understand your request and reply. You can also email us directly. Contact Form 7 handles the form and sends messages to info@legionstories.com through Hostinger SMTP. Correspondence is received and kept in the active Hostinger Free Business Email mailbox.
We use correspondence to answer questions about LegionStories, provide Legion Training app support and discuss working together. The legal basis is our legitimate interest in responding to enquiries. Where your enquiry concerns a proposed contract, processing needed to take steps you request before entering that contract is based on Article 6(1)(b) GDPR.
We review routine correspondence monthly and delete it 12 months after the enquiry is resolved or the last necessary follow-up is complete. We may keep records longer where an enquiry remains open or a contract, legal obligation or dispute requires them. This is a manual review process, rather than an automatic inbox expiry. Contact us to request earlier deletion. Hostinger documents automatic cleanup of its Spam and Trash folders after 30 days, and a 30-day availability window for email access and delivery logs. These are separate from the retention of correspondence in the inbox and do not establish when every provider-held copy is erased. Mail-storage locations and provider backup lifecycles remain under review.
Hosting and security
Our hosting provider is Hostinger International Ltd. (Cyprus), which also provides the SMTP service used to send form messages. The main website server is in the United Kingdom, and website backups are stored in Germany. Hostinger’s content delivery network is enabled and can serve website resources through its global network. Serving and protecting the website requires technical connection information, including your IP address and the requested page. Our legal basis for necessary operation, maintenance and security is our legitimate interest in keeping the website available and protecting it from abuse.
Automated daily backups of the website and database are enabled. Backup copies rotate according to Hostinger’s schedule. We are clarifying the exact rotation period because the provider’s help documentation and hosting agreement give different weekly backup periods. The full retention periods for website access, error, security and content-delivery-network logs have not yet been confirmed.
Google Analytics and app-store links
Google Analytics 4, delivered through Google Tag Manager, measures visits and interactions with app-store download links. Analytics information includes page addresses, referral information, device and browser characteristics, visit times and interaction events. Analytics identifiers are pseudonymous: an identifier can distinguish a browser even if a report does not show your name. Clicking an app-store link does not tell us whether you installed the app or bought a subscription.
Analytics cookies require your consent to the Statistics category. Statistics storage is denied by default. We use consent-only loading: Google Tag Manager and Google Analytics load only after you allow Statistics. If you refuse Statistics, those tags remain blocked. Turning Statistics off and saving your choice reloads the page with the tags blocked again.
The legal basis for analytics is your consent. You can withdraw it at any time using Cookie Preferences. The website’s GA4 property is configured to retain event data for 2 months and user data for 14 months, with user-data expiry reset by new activity. These controls do not affect most standard reports based on aggregated data. Cookie expiry and retention of analytics data on Google’s servers are separate matters.
Cookies and your choices
Cookies are small records stored by your browser. Essential cookies support necessary website functions, including remembering your cookie choice. Statistics cookies are optional. The banner offers Reject All, Accept All and Preferences. Continuing to browse does not give consent. Refusing Statistics cookies does not prevent you from reading articles, commenting or sending a message.
Use the persistent Cookie Preferences control or the button below to change your choice at any time. To withdraw analytics consent, turn Statistics off and choose Save and Close. The page reloads when a saved choice changes. Withdrawal does not affect processing already carried out while your consent was valid. For deletion of data already held, email info@legionstories.com.
Your acceptance or refusal choice is configured to be remembered for 180 days. You can change it sooner. Existing preference cookies saved before this update may retain their previous expiry until you save a new choice. Browser restrictions can shorten cookie lifetimes.
| Cookie or family | Purpose and choice | Duration |
|---|---|---|
wpconsent_preferences | Remembers acceptance and refusal. Essential. | 180 days for newly saved choices. |
_ga and _ga_* | Google Analytics browser identification and session state. Statistics consent required for storage. | Listed as 2 years in the current cookie inventory, matching Google’s default. Browser expiry can differ. |
comment_author_*, comment_author_email_* and comment_author_url_* | Remember comment-form details when you select the form’s save-details checkbox. | WordPress default: 1 year. The browser may shorten this. |
Staff sign-in and editing use additional WordPress authentication and preference cookies. Public browsing does not require an account. Cookies used for analytics remain subject to the Statistics choice even when a separate form checkbox remembers your comment details.
WordPress can also cache emoji capability results in your browser’s session storage under wpEmojiSettingsSupports to help display characters correctly. This functional cache is separate from analytics.
Who receives data?
Website administrators access comments and correspondence to manage the site and answer requests. Hostinger receives information needed for hosting and email delivery. Google receives the analytics and consent signals described above. Authorised maintenance providers can access records needed for their work. Relevant records can also be disclosed where required by law or necessary to establish, exercise or defend a legal claim.
Links to Reddit, the Apple App Store and Google Play take you to independent services with their own privacy policies. The current article comment layout does not display Gravatar avatars. This policy concerns the website; app processing is described in the separate Legion Training policy.
International processing and safeguards
Google’s global analytics infrastructure can involve processing outside the European Economic Area, including in the United States. Google’s published processing terms provide for international-transfer safeguards, including the EU–US Data Privacy Framework where applicable and standard contractual clauses for relevant transfers. Hostinger’s published data-processing addendum also addresses transfers and contractual safeguards.
The Hostinger supplier and the website’s primary server and backup locations have been verified. Mailbox storage and backup locations, further processing through provider networks and subprocessors, and the complete account-specific processing and transfer arrangements remain under review. We are also completing the documentation of Google’s account-level processing terms and contacts. For available details or a copy of applicable safeguards, contact info@legionstories.com.
Provider information: Hostinger privacy policy, Hostinger data-processing addendum, Google privacy policy and Google processing terms.
Your privacy rights
Subject to the applicable conditions, you can request access to your personal data, correction, erasure, restriction of processing or data portability. You can object to processing based on legitimate interests and withdraw consent at any time. Some records must be kept where a legal obligation or a justified legal claim requires this.
Email info@legionstories.com and describe your request. Identifying the relevant comment or correspondence helps us find the record. We may request proportionate information to verify that the request concerns your data. We normally respond within one month. If a permitted extension is necessary, we will explain it within that initial month.
You can complain to a data-protection supervisory authority, particularly where you live, work or believe an infringement occurred. In France, you can contact the CNIL. You do not have to contact us first to exercise this right.
Changes to this policy
We will update this page when website practices change and as the outstanding provider and retention checks are completed. The revision date appears at the top. A revised policy does not replace a consent request where new consent is required.