Last updated: 21 October 2026.
This policy explains how LegionStories uses personal data when you browse this website, comment, contact us, follow merchandise-shop links or choose your cookie preferences. Our Fourthwall-hosted shop also has its own privacy information, described below. The Legion Training app has a separate privacy policy.
Who is responsible for your data?
Invometa Korlátolt Felelősségű Társaság, operating the LegionStories brand, is the operator and data controller for legionstories.com. Registered office: Erdősor utca 16., 2318 Szigetszentmárton, Hungary. Company registration: 13-09-238897, Budapest Környéki Törvényszék Cégbírósága. Hungarian tax number: 27727746-2-13. For privacy questions or to exercise your rights, email info@legionstories.com.
Comments
When you comment, WordPress collects your display name, email address, comment, IP address and browser user-agent information. Your display name, comment and publication date become public if the comment is published. Your email address is not displayed with the comment. A name and email address are required to submit a comment; you can read the website without commenting.
We use this information to publish and moderate discussions and protect the website against spam and abuse. The legal basis is our legitimate interest in maintaining a useful, secure discussion space. Antispam Bee performs automated spam checks on the website. A comment identified as spam may be withheld from publication; contact us if you believe your comment was blocked incorrectly.
We keep published comments while the discussion remains useful and review their relevance annually. Spam comments are scheduled for automatic deletion after 30 days. We review private comment details, including email addresses, IP addresses and browser information, quarterly, with a target of removing or anonymising them 90 days after moderation is complete. We may keep details longer where needed to prevent continuing abuse, meet a legal obligation or resolve a dispute. The quarterly review is manual; it is not an automatic 90-day expiry. You can ask us to delete or anonymise a comment and the personal data associated with it.
Contact messages and email
The contact form asks for your name, email address and message, with an optional subject. We need the required fields to understand your request and reply. You can also email us directly. Contact Form 7 handles the form and sends messages to info@legionstories.com through Hostinger SMTP. Correspondence is received and kept in the active Hostinger Free Business Email mailbox.
We use correspondence to answer questions about LegionStories, provide Legion Training app support and discuss working together. The legal basis is our legitimate interest in responding to enquiries. Where your enquiry concerns a proposed contract, processing needed to take steps you request before entering that contract is based on Article 6(1)(b) GDPR.
We review routine correspondence monthly and delete it 12 months after the enquiry is resolved or the last necessary follow-up is complete. We may keep records longer where an enquiry remains open or a contract, legal obligation or dispute requires them. This is a manual review process, rather than an automatic inbox expiry. Contact us to request earlier deletion. Hostinger documents automatic cleanup of its Spam and Trash folders after 30 days, and a 30-day availability window for email access and delivery logs. These are separate from the retention of correspondence in the inbox and do not establish when every provider-held copy is erased. Mail-storage locations and provider backup lifecycles remain under review.
Hosting and security
Our hosting provider is Hostinger International Ltd. (Cyprus), which also provides the SMTP service used to send form messages. The main website server is in the United Kingdom, and website backups are stored in Germany. Hostinger’s content delivery network is enabled and can serve website resources through its global network. Serving and protecting the website requires technical connection information, including your IP address and the requested page. Our legal basis for necessary operation, maintenance and security is our legitimate interest in keeping the website available and protecting it from abuse.
Automated daily backups of the website and database are enabled. Backup copies rotate according to Hostinger’s schedule. We are clarifying the exact rotation period because the provider’s help documentation and hosting agreement give different weekly backup periods. The full retention periods for website access, error, security and content-delivery-network logs have not yet been confirmed.
Google Analytics and app-store links
Google Analytics 4, delivered through Google Tag Manager, measures visits and interactions with app-store download links. Analytics information includes page addresses, referral information, device and browser characteristics, visit times and interaction events. Analytics identifiers are pseudonymous: an identifier can distinguish a browser even if a report does not show your name. Clicking an app-store link does not tell us whether you installed the app or bought a subscription.
Analytics cookies require your consent to the Statistics category. Statistics storage is denied by default. We use consent-only loading: Google Tag Manager and Google Analytics load only after you allow Statistics. If you refuse Statistics, those tags remain blocked. Turning Statistics off and saving your choice reloads the page with the tags blocked again.
The legal basis for analytics is your consent. You can withdraw it at any time using Cookie Preferences. The website’s GA4 property is configured to retain event data for 2 months and user data for 14 months, with user-data expiry reset by new activity. These controls do not affect most standard reports based on aggregated data. Cookie expiry and retention of analytics data on Google’s servers are separate matters.
Merchandise shop and Fourthwall checkout
Our merchandise shop is hosted by Fourthwall, Inc. Catalog-product purchases are transactions with Fourthwall, which handles checkout, payment, production, shipping and order-related support under its purchase terms. Invometa operates the LegionStories brand and website. Read the shop privacy policy, shop terms, returns information and Fourthwall privacy policy before providing information in the shop.
When you follow a shop link or open Fourthwall checkout, your browser connects to Fourthwall. The shop and its providers can process your name, email address, delivery and billing details, phone number where requested, selected products and order information, device and connection information, and payment information needed to process your purchase. Payment details are entered into the payment provider’s checkout; this WordPress website does not collect full payment-card details.
Authorised Invometa administrators may access customer contact details, order items and status, and correspondence made available through Fourthwall to answer enquiries, help resolve order issues, review business activity and meet applicable record-keeping duties. Our legal bases for these activities are our legitimate interests in customer support, business administration and resolving disputes, and compliance with applicable legal obligations. We use only the information needed for those purposes. Marketing use requires a separate appropriate permission or legal basis; a purchase alone does not subscribe you to a mailing list.
Routine shop-support correspondence held by Invometa follows the 12-month review and deletion rule described above. Necessary accounting and legal-claim records are kept for the applicable statutory retention period or until the relevant claim is resolved; information not needed for those purposes is removed. Fourthwall controls retention within its platform under its own published policy and applicable obligations.
The Fourthwall shop uses its own cookie and analytics controls, including a native Google Analytics integration. The Cookie Preferences control on this WordPress site does not by itself establish your choices on the separate shop. Review and manage the shop’s cookie settings separately. Fourthwall and its service providers can process information in the United States and other countries involved in providing the service; consult the shop and Fourthwall privacy policies for their processing and contact information. For information about Invometa’s use of shop data or applicable transfer arrangements, contact info@legionstories.com.
Cookies and your choices
Cookies are small records stored by your browser. Essential cookies support necessary website functions, including remembering your cookie choice. Statistics cookies are optional. The banner offers Reject All, Accept All and Preferences. Continuing to browse does not give consent. Refusing Statistics cookies does not prevent you from reading articles, commenting or sending a message.
Use the persistent Cookie Preferences control or the button below to change your choice at any time. To withdraw analytics consent, turn Statistics off and choose Save and Close. The page reloads when a saved choice changes. Withdrawal does not affect processing already carried out while your consent was valid. For deletion of data already held, email info@legionstories.com.
Your acceptance or refusal choice is configured to be remembered for 180 days. You can change it sooner. Existing preference cookies saved before this update may retain their previous expiry until you save a new choice. Browser restrictions can shorten cookie lifetimes.
| Cookie or family | Purpose and choice | Duration |
|---|---|---|
wpconsent_preferences | Remembers acceptance and refusal. Essential. | 180 days for newly saved choices. |
_ga and _ga_* | Google Analytics browser identification and session state. Statistics consent required for storage. | Listed as 2 years in the current cookie inventory, matching Google’s default. Browser expiry can differ. |
comment_author_*, comment_author_email_* and comment_author_url_* | Remember comment-form details when you select the form’s save-details checkbox. | WordPress default: 1 year. The browser may shorten this. |
Staff sign-in and editing use additional WordPress authentication and preference cookies. Public browsing does not require an account. Cookies used for analytics remain subject to the Statistics choice even when a separate form checkbox remembers your comment details.
WordPress can also cache emoji capability results in your browser’s session storage under wpEmojiSettingsSupports to help display characters correctly. This functional cache is separate from analytics.
Who receives data?
Website administrators access comments and correspondence to manage the site and answer requests. Hostinger receives information needed for hosting and email delivery. Google receives the analytics and consent signals described above. Authorised maintenance providers can access records needed for their work. Relevant records can also be disclosed where required by law or necessary to establish, exercise or defend a legal claim.
Links to Reddit, the Apple App Store and Google Play take you to independent services with their own privacy policies. The current article comment layout does not display Gravatar avatars. This policy concerns the website; app processing is described in the separate Legion Training policy.
International processing and safeguards
Google’s global analytics infrastructure can involve processing outside the European Economic Area, including in the United States. Google’s published processing terms provide for international-transfer safeguards, including the EU–US Data Privacy Framework where applicable and standard contractual clauses for relevant transfers. Hostinger’s published data-processing addendum also addresses transfers and contractual safeguards.
The Hostinger supplier and the website’s primary server and backup locations have been verified. Mailbox storage and backup locations, further processing through provider networks and subprocessors, and the complete account-specific processing and transfer arrangements remain under review. We are also completing the documentation of Google’s account-level processing terms and contacts. For available details or a copy of applicable safeguards, contact info@legionstories.com.
Provider information: Hostinger privacy policy, Hostinger data-processing addendum, Google privacy policy and Google processing terms.
Your privacy rights
Subject to the applicable conditions, you can request access to your personal data, correction, erasure, restriction of processing or data portability. You can object to processing based on legitimate interests and withdraw consent at any time. Some records must be kept where a legal obligation or a justified legal claim requires this.
Email info@legionstories.com and describe your request. Identifying the relevant comment or correspondence helps us find the record. We may request proportionate information to verify that the request concerns your data. We normally respond within one month. If a permitted extension is necessary, we will explain it within that initial month.
You can complain to a data-protection supervisory authority, particularly where you live, work or believe an infringement occurred. In France, you can contact the CNIL. You do not have to contact us first to exercise this right.
Changes to this policy
We will update this page when website practices change and as the outstanding provider and retention checks are completed. The revision date appears at the top. A revised policy does not replace a consent request where new consent is required.