Privacy Policy

1. Data Controller

The data controller responsible for the processing of personal data on this website is:

2. Data We Collect & Purpose of Processing

We process personal data lawfully, fairly, and transparently in accordance with major global data protection and privacy frameworks, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), the Indian Digital Personal Data Protection Act (DPDP), and international data protection standards:

• Contact & Consultation Inquiries: When you submit our contact form, we collect your name, email address, company (optional), budget preference, and technical message. We process this to respond to your inquiry and take steps prior to entering into a commercial agreement.
• Digital Product Orders & Fulfillment: When you purchase or request a website template or custom engineering package, we process your contact and transaction identifiers to deliver source code access, issue invoices, and provide deployment support.
• Technical Server Logs & Security: Web servers automatically record IP addresses, user-agent strings, and request timestamps to prevent brute-force abuse, DDoS attacks, and unauthorized system access under our legitimate security interest.

3. Sub-processors & Infrastructure

We do not sell, rent, or monetize your information. We rely on reputable infrastructure providers bound by Data Processing Agreements (DPAs):

• Neon Postgres: Encrypted cloud database for persisting contact requests and business leads.
• Resend API: Transactional email delivery service to notify us of inquiries and send confirmation receipts.
• Upstash Redis: Temporary rate-limiting cache used exclusively to block spam submissions.
• Vercel Inc.: Hosting platform providing edge routing and DNS delivery with privacy-first telemetry.

4. Data Retention

Contact submissions are retained only as long as necessary to fulfill our technical discussion and business relationship, or up to 24 months if no ongoing commercial contract is executed. Invoices and financial records are retained according to statutory commercial and tax accounting obligations (typically 5 to 8 years).

5. International Privacy & Data Subject Rights

Regardless of your country or territory, we provide comprehensive rights over your personal data under global standards (GDPR, CCPA/CPRA, DPDP, and international privacy principles):

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data when no legal retention obligation exists.
• Right to Restrict or Object to Processing: Request restriction or object to the processing of your data under applicable law.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Lodge a Complaint: Lodge a complaint with your competent data protection authority or supervisory body in your country or jurisdiction of residence.

6. Contact for Privacy Inquiries

To exercise any of your rights or request information regarding your data, contact our engineering desk at hello@legionmind.si. We respond to all verified requests within 30 calendar days.