PRIVACY POLICY FOR GIGALINKED

1. Introduction

This Privacy Policy explains how GigaLinked collects, uses and protects personal information when you visit gigalinked.com, use our client portal and hosting services, connect an external account, or contact support. Read it alongside our Terms of Service. It is a notice about our processing, not a request for blanket consent.

GigaLinked, based in Northern Ireland, is the controller of the account, billing, website and support information described here. Our Data Protection Officer is Conor Murphy. Contact [email protected] and address your request to the Data Protection Officer, or telephone +44 73598 30634.

Our client portal and billing platform are operated by GigaLinked using our custom system. Where you host other people’s information on your node, you remain responsible for deciding how that information is used; this notice concerns our relationship with you and operation of our services.

2. Data We Collect

Account and contact information: your name, username, email address, verification status, contact and billing details, account preferences, avatar and service configuration. Passwords are stored as hashes, not readable passwords.

Orders and billing: products, billing periods, invoices, payments and payment references, credits, discounts, service status and renewal history. Card payments use hosted payment processing; we do not store full card numbers or card security codes in our billing database.

Security and activity: IP addresses, including your last sign-in IP, session and request information, relevant browser information, account changes, staff actions and abuse or IP-ban records. These records help protect accounts and investigate misuse.

Support: ticket messages and attachments, emails, Discord identifiers and display names, request and call times, assigned staff, call participants, ratings and support-call recordings. If a Discord identity is linked to a customer account, authorised staff can see the associated customer and services during support.

Connected accounts: when you choose an available provider such as Discord, Steam, Google or Apple, we receive the provider identifier and the profile information supplied by that provider, which may include a display name, avatar and email address. We receive authorised access credentials where continuing access is needed; we do not receive your password for that provider. If you connect Cloudflare for a custom panel domain, we process the authorised account and domain information and the credentials needed to configure it.

We obtain information from you, from your use of our website and services, from the providers you choose to connect and from payment confirmations. Details needed to identify your account, fulfil an order or secure access are required for those functions. Optional social connections and profile details are not required to use ordinary email-and-password access.

3. How We Use Your Data

We use account and billing information to create and verify your account, provide the services you order, generate invoices, record payments, manage renewals and respond to support requests. Account verification is required before placing orders or opening a personal panel.

We send operational emails such as verification links, invoices and payment confirmations, renewal reminders, service-status notices and account-connection notifications. These are service messages, separate from optional marketing. Any marketing that requires your consent is optional and can be stopped by contacting [email protected] or using the available unsubscribe option.

Our billing system uses invoice due dates, payment status and service status to generate renewal invoices and reminders, suspend unpaid services and request cancellation after five days of suspension for non-payment. Verification and security checks can also restrict access. If you believe a restriction or billing action is wrong, contact support for staff review.

Authorised staff can access customer records and use controlled, temporary customer-access sessions to investigate problems and assist with account management. Staff actions are recorded for accountability.

Linking Discord authorises the requested Discord connection, including joining the GigaLinked server and synchronising eligible account badges and roles. We store access and refresh credentials encrypted for continuing access. Staff can review server membership; adding an absent member back requires staff to confirm permission and record a reason. Disconnect Discord in your client account or revoke GigaLinked in Discord’s authorised-app settings to end that authorisation. Leaving the server does not itself revoke the external application permission.

Discord voice support records calls for staff review and support follow-up. Call records identify the requester, participating staff, timings and any rating. The waiting room uses generated speech: announcement text, which may include your Discord display name and queue information, is sent to ElevenLabs to create spoken messages. The speech-generation integration sends announcement text, not your support-call recording. You can use a written support ticket instead of voice support.

We also use relevant records to detect abuse, secure infrastructure, resolve complaints and meet legal accounting and disclosure obligations.

4. Legal Basis for Processing

Contract: information necessary to create and manage your account, fulfil your orders, administer payments and provide the support and optional connected features you request.

Legal obligations: information that must be processed or retained to meet applicable tax, accounting, regulatory or lawful disclosure duties.

Legitimate interests: proportionate account and infrastructure security, abuse prevention, staff-access auditing, support quality review and dispute handling. These interests are balanced against your rights and expectations; you may object to this processing as explained below.

Consent: optional marketing, non-essential cookies where consent is required, and any other processing for which we specifically ask for consent. Authorising an external account grants the permissions shown by that provider; it does not give blanket consent to unrelated processing. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

5. Cookies and Similar Technologies

The client portal uses cookies and related browser storage for essential functions such as keeping you signed in, securing account connections and preserving preferences. Restricting these may prevent sign-in or interrupt an order.

Non-essential analytics or marketing technologies require consent where applicable. Payment and connected-account providers may use their own cookies when you visit or authorise their services; consult their privacy and cookie notices. You can manage browser storage through your browser settings.

If you allow optional website analytics, we record public page visits, approximate country supplied by Cloudflare, referring search engines or sites, campaign source and labels, first landing page, and node plan and basket activity. A random browser-session identifier is stored only after consent; the server stores a protected hash, not your raw IP address or account details. Full referral URLs, search queries and advertising click identifiers are not saved. Analytics records are retained for 90 days. You can refuse or withdraw consent using Privacy choices, and we respect supported Do Not Track and Global Privacy Control signals. Campaign labels should never contain personal information.

6. Data Sharing and Transfers

We share information only as needed with providers that support the features you use: hosting and infrastructure providers; payment processing through Stripe and the payment method selected at checkout; our email-delivery provider; Discord for community and support functions; the social sign-in provider you select; Cloudflare for authorised domain configuration and relevant network services; and ElevenLabs for support announcement speech.

Providers may process information under their own privacy notices where they act independently. Connected services receive the information needed to perform the requested function, rather than unrestricted access to your client account. We may also share relevant information with professional advisers or authorities when required by law.

Hosting locations and external providers may involve processing outside the UK or EEA. Transfers must comply with applicable data protection requirements, using an applicable adequacy arrangement or appropriate contractual safeguards where required. Contact the Data Protection Officer for information about the destination and safeguards relevant to the services you use and how to obtain a copy. This notice does not claim that all information stays in the UK.

7. Data Retention

We keep account, billing and service records for as long as needed to operate the account, meet applicable financial-record obligations and handle disputes. Cancelling a service does not immediately erase its invoices, payment history or customer record.

Security and staff-audit records are retained according to their need for investigation, protection against repeated abuse and accountability. Support messages and call history are retained according to support follow-up and complaint-handling needs. When assessing retention, we consider whether the account or matter remains open, whether a dispute is unresolved and whether a legal duty requires preservation.

At publication, support-call recordings have no fixed automatic expiry configured. They remain until removed or a retention period is applied; this does not remove your right to request a review or deletion where applicable. Call history is separate from the audio, and deletion of a recording does not itself delete that history.

Verification links expire after 24 hours. The email worker periodically removes expired verification records after a further seven days and sent or cancelled delivery-queue records after 90 days. These housekeeping rules do not delete the underlying account, invoice or support record.

Disconnecting a connected account stops its continuing authorisation within our system. Relevant historical security and connection-event records may remain where needed for the purposes above. Contact the Data Protection Officer to ask about retention or request deletion of information that is no longer needed.

8. Data Security

We use access controls, protected connections and other technical and organisational measures appropriate to the data and its use. Account passwords are hashed. Supported continuing-access credentials, including Discord and configured integration secrets, are encrypted in storage. This does not mean every field in our database is individually encrypted.

Support recordings are kept outside the public website files, and playback requires authorised staff access. No system can guarantee absolute security. Where a personal-data breach occurs, we assess it and make notifications to the relevant authority and affected individuals when legally required.

9. Your Rights

Depending on the circumstances and applicable law, you may request access, correction, erasure, restriction of processing or a portable copy of eligible information. You may withdraw consent at any time where processing relies on consent.

Right to object: you may object to processing based on legitimate interests, including relevant security or support-review processing, on grounds relating to your situation. You may object to direct marketing at any time.

Send requests to [email protected] for the attention of the Data Protection Officer. We may need proportionate information to confirm your identity. We respond without undue delay, normally within one month, and explain any lawful extension or other applicable change to that timeframe.

If an automated billing or access restriction appears incorrect, ask staff to review it and provide the relevant account or invoice reference. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

10. Links to Other Websites

10.1.1 Our website or services may contain links to third-party sites with their own privacy practices. We are not responsible for the privacy policies or content on those external sites.
10.1.2 We encourage you to review the third-party site’s privacy statement whenever you navigate away from our platform.

11. Children’s Privacy

11.1.1 While our TOS sets the minimum user age at 15, we do not knowingly collect personal data from children under this age without verifiable parental consent. If you believe we have inadvertently collected data from a minor, please contact us at [email protected], and we will take steps to delete it.

12. Updates to This Policy

We may update this notice when our services, processing or legal requirements change. The publication date and version identify the current notice. Significant changes will be highlighted by email or a prominent website notice as appropriate. A notice update does not replace any separate consent that a new purpose may require.

13. Contacting Us

Data Protection Officer: Conor Murphy. Email [email protected] and address your message to the Data Protection Officer. Telephone: +44 73598 30634. Use these details for privacy questions, retention requests or to exercise your rights.

14. Complaints

Please contact us if you have a concern about how we handle your information. You also have the right to complain to the Information Commissioner’s Office in the UK: https://ico.org.uk/make-a-complaint/. You do not have to give up any other rights to raise a concern with us.

15. About This Notice

This notice explains our use of personal information. It does not waive your data protection rights or make continued use of the website consent to every type of processing. Where consent is required, it is requested separately for the relevant purpose.