Privacy Policy

01Who we are

Legion Productions Pte Ltd ("Legion", "we", "us") is a fabrication and model-making studio registered in Singapore, at 970 Toa Payoh North #01-18, Singapore 318992. We are the organisation responsible for the personal data described in this notice.

This notice is written to meet our obligations under Singapore's Personal Data Protection Act 2012 (PDPA). It covers legion.sg and its subpages. It does not cover sites we link to, which have their own policies.

For anything in this notice, including access and correction requests, contact us at [email protected] or +65 8299 1120.

02What we collect, and when

We collect personal data in three situations. We do not require you to create an account, and we do not buy contact lists.

a) When you send an enquiry. Our contact form asks for:

• Your name, and your company if you give one
• Your work email and phone number, so we can reply
• Organisation type, indicative budget and project timeline, so we can tell quickly whether we are the right studio for the job
• Your project brief, and any reference images you attach

Only name, email, phone, organisation type and the brief are required. Budget and timeline are optional.

b) When you use the site assistant. Our chat widget collects the messages and images you send it, along with a randomly generated session identifier used to keep one conversation together. If you give contact details in the chat, those are collected too.

c) Automatically, as you browse. Like most websites we receive your IP address, browser and device type, and the pages you view. Your IP address is also used briefly to rate-limit the chat widget so it cannot be abused.

03Why we use it

• To answer your enquiry and prepare an estimate — the budget and timeline fields exist so we can tell you honestly and early whether a project is a fit.
• To deliver a project you go ahead with, including contacting you about schedules, approvals and delivery.
• To keep business records, including quotations and invoices, as required of a Singapore company.
• To keep the site working and free of spam, including bot checks on the contact form and rate limits on the chat.
• To understand how the site is used in aggregate, so we can improve it.

We do not use your data for automated decisions that produce legal effects, and we do not send marketing emails unless you have asked us to.

04The site assistant and AI processing

legion.sg carries a chat assistant that helps scope enquiries. You should know how it works before using it.

• Messages and images you send are transmitted to Anthropic PBC, the provider of the Claude AI model, which processes them to generate a reply. Under Anthropic's commercial API terms, material sent this way is not used to train its models.
• The assistant does not quote prices. It gathers information and passes it to us.
• A copy of the conversation, with any contact details you provided, is emailed to us as a new enquiry. Treat the chat as you would an email to our studio.
• A working copy of the conversation is held on our server and automatically deleted after two days.

If you would rather not use the assistant, the contact form and our email address do the same job.

05Who else sees your data

We do not sell personal data and we do not share it for anyone else's marketing. We do rely on a small number of service providers, who process data on our instructions:

• Anthropic PBC (United States) — processes chat messages to generate the assistant's replies.
• Cloudflare, Inc. (United States) — serves and protects the site, and provides the Turnstile check that stops automated form submissions.
• Google LLC (United States) — Google Tag Manager, used to measure site usage.
• Our web host (Singapore) — stores the site, its email and its server logs.

We may also disclose personal data where the law requires it, or where it is necessary to establish or defend a legal claim.

Several of these providers are outside Singapore. Where personal data is transferred overseas, we take reasonable steps to satisfy ourselves that it will be protected to a standard comparable to the PDPA.

06Cookies and similar technologies

We do not use cookies to track you across other websites, and we run no advertising pixels on legion.sg.

• Google Tag Manager loads on every page and may set analytics cookies that record visits in aggregate.
• Cloudflare Turnstile runs on the contact form to distinguish people from bots. It is designed to do this without profiling you.
• The chat assistant stores a session identifier in your browser so one conversation holds together. It is not linked to you unless you give contact details.

You can block or delete cookies in your browser settings. The site will still work, though the contact form may require an extra step.

07How long we keep it

• Chat transcripts on our server: automatically deleted after two days.
• Enquiries that do not become projects: kept while there is a realistic prospect of working together, then deleted.
• Project records, including quotations, invoices and correspondence: kept for as long as needed to perform the contract and to meet Singapore's accounting and tax record-keeping requirements.
• Server and security logs: kept briefly, on a rotating basis, for troubleshooting and abuse prevention.

When data is no longer needed for any legal or business purpose, we delete it or render it anonymous.

08Keeping it secure

The site is served only over HTTPS. Enquiries reach us as email to a studio address; server-side configuration and credentials are held outside the public web root and are not served to browsers. Access to project files and enquiry records is limited to the people at Legion who need them.

No system is perfectly secure, and we cannot guarantee the security of information sent to us over the internet. Please do not send sensitive personal data — identification numbers, financial details or health information — through the contact form or the chat assistant. We never ask for them there.

09Your rights

Under the PDPA you may:

• Ask what we hold about you and how it has been used or disclosed in the past year.
• Ask us to correct anything inaccurate or incomplete.
• Withdraw your consent to our use of your data, by giving us reasonable notice. We will tell you if withdrawing it means we can no longer work on your project.

Email [email protected] and we will respond within a reasonable time. We may need to confirm your identity first. Some requests carry exceptions under the PDPA — for example where records must be retained for tax purposes — and we will explain if one applies.

If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission.

10Children

legion.sg is aimed at businesses, agencies and institutions, and is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has sent us personal data, contact us and we will delete it.

11Changes to this notice

We may update this notice as the site or our practices change. The date at the top shows when it was last revised. Material changes will be reflected here; continuing to use the site after a change means you accept the revised notice.