Privacy Policy

The controller responsible for the processing described here is ⟨legal entity name⟩, ⟨street, postal code, city⟩, Switzerland. For all privacy matters, contact us at info@productlegion.com.

Depending on how you use Product Legion, we process the following categories of personal data:

• check_circleAccount and profile data: name, email address, password (stored only as a secure hash by our authentication provider), language and the details you add to your profile
• check_circleContent you create: your digital products, pitch decks, roadmaps, notes, community posts and chat messages
• check_circlePayment and subscription data: your subscription status and billing history — your card details are collected and stored by our payment provider Stripe and never reach our servers
• check_circleUsage data: log and device information, approximate location derived from your IP address, and how you interact with the platform, including the web analytics described below
• check_circleMarketing data: if you use the marketing suite, the budgets, target audiences and results of the ad campaigns you run
• check_circleAI inputs: the prompts and content you submit to AI-assisted features
• check_circleCommunications: support requests, feedback and other messages you send us

We process your data to provide the platform and its features, process payments, keep the platform secure, communicate with you and comply with legal obligations. Where the GDPR applies, we rely on the following legal bases:

• check_circlePerformance of a contract: most processing is necessary to provide the platform you signed up for
• check_circleConsent: for optional processing such as promotional emails — you can withdraw consent at any time
• check_circleLegitimate interests: keeping the platform secure, preventing abuse and improving our services
• check_circleLegal obligation: for example the retention of billing records under commercial and tax law

We do not sell your personal data. We share it only with the service providers below, which process it on our behalf and under contract, or where the law requires disclosure:

• check_circleGoogle Firebase (Google): authentication, database, file storage, hosting and abuse protection (App Check, reCAPTCHA Enterprise)
• check_circleStripe: payment and subscription processing
• check_circleGoogle Gemini: processing of the inputs you submit to AI-assisted features
• check_circleMeta Platforms: only if you run ads through the marketing suite — your campaign settings are shared with Meta to place the ads
• check_circlen8n: workflow automation supporting platform operations
• check_circleAuthorities and courts: where we are legally obliged to disclose data
• check_circleGoogle Analytics (Google Ireland Limited): web analytics on our behalf — see 'Web Analytics' for details and how to switch it off

Your data is primarily stored in data centers in the European Union. Some processing by us and the providers named above takes place in the United States. Where personal data leaves Switzerland or the EEA, we rely on the Swiss–U.S. and EU–U.S. Data Privacy Framework certifications of our providers and on Standard Contractual Clauses.

Product Legion works without advertising cookies. We use technically necessary browser storage to keep you signed in and remember your settings (including your analytics choice), one first-party cookie (uniqueVisitorId, stored for up to 12 months) to recognise returning visitors for simple visit statistics on published landing pages, and the Google Analytics cookies _ga and _ga_C9PS9VLFBS (stored for up to 2 years) described under 'Web Analytics'. You can delete or block cookies in your browser at any time and switch analytics off below; some functions may then be limited.

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how productlegion.com and the platform are used and to improve them. Analytics runs without a consent banner; you can switch it off at any time below. Google Analytics collects, for example:

• check_circlePages and screens you view, the order you visit them in and how long you stay
• check_circleThe page that referred you, for example a search engine or a social network, and campaign parameters in the link you clicked
• check_circleYour approximate location (country and city) derived from your IP address — Google Analytics does not store the IP address itself
• check_circleDevice and browser information: device type, operating system, browser, screen resolution and language
• check_circleInteractions such as clicks on buttons, scroll depth, outbound links, file downloads and site searches
• check_circleKey actions on the platform: whether a visit led to the sign-up form being sent, an account being created (and whether via Google or an email link), the onboarding being completed, a call being booked or a subscription being purchased, including the subscription amount — never your name, email address or card details
• check_circleA random identifier stored in the cookies _ga and _ga_C9PS9VLFBS (kept for up to 2 years) so that returning visits can be told apart — this identifier is not linked to your account, name or email address

We have configured Google Analytics with data minimisation in mind: IP addresses are anonymised, Google Signals and advertising personalisation are switched off, we do not pass your user ID or any profile data to Google, and event data is deleted after 2 months. Google processes this data on our behalf under Google's data processing terms; where data is transferred to the United States, Google LLC's certification under the Swiss–U.S. and EU–U.S. Data Privacy Framework applies (see 'International Data Transfers').

Where the GDPR applies, we rely on our legitimate interest in measuring and improving the platform (Art. 6(1)(f) GDPR); under the FADP we process this data transparently for the same purpose. You can object at any time by switching analytics off below.

We keep your personal data for as long as your account exists. When you delete your account, your personal data is deleted or anonymised, unless we must keep it longer — in particular billing and accounting records, which Swiss law requires us to retain for ten years. Google Analytics event data is deleted after 2 months; only aggregated statistics without any personal reference are kept longer.

Under the FADP and, where applicable, the GDPR you have the right to:

• check_circleAccess: request a copy of the personal data we hold about you
• check_circleRectification: have inaccurate or incomplete data corrected
• check_circleErasure: have your personal data deleted
• check_circleRestriction: limit how we use your data in certain cases
• check_circlePortability: receive your data in a structured, machine-readable format
• check_circleObjection and withdrawal: object to processing based on legitimate interests or direct marketing, and withdraw any consent at any time

To exercise these rights, email info@productlegion.com — we respond within 30 days. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EEA, with your local data protection authority.

We protect your data with technical and organisational measures, including encrypted connections (TLS), strict access rules on all databases and storage, and abuse protection on every request. No system is absolutely secure, but we follow recognised good practice and review our measures regularly.

Product Legion is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. The current version is always published on this page, and the date above shows when it was last revised. We will announce significant changes by email or in the platform.

If you have questions about this Privacy Policy or how we handle your data, contact us at info@productlegion.com.