PRIVACY POLICY (GGID.EU)

Effective Date: October 16, 2026 | Last Updated: October 16, 2026

1. INTRODUCTION AND DATA CONTROLLER INFORMATION

1.1. Introduction

Welcome to the Privacy Policy of ggid.eu (including our subdomain beta.ggid.eu, our verification portals, Discord bot, AI OCR filters, and AI Chatbot, collectively the "Service"). We are committed to protecting your privacy, securing your personal data, and remaining completely transparent about how our anti-raid, anti-VPN, and anti-alt account security technologies work.

1.2. Data Controller (Správce osobních údajů)

For the purposes of the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Czech Act No. 110/2019 Coll., on Personal Data Processing, the Data Controller is the independent administration team / private individual operator(s) operating ggid.eu from the Czech Republic (European Union) (hereinafter "Controller", "we", "us", or "our"). As the Service is operated by natural person(s) outside of a registered commercial company structure, no corporate registration number (IČO) applies; however, we strictly adhere to all obligations imposed on data controllers under EU and Czech data protection law.

1.3. Dedicated Contact Points:

Privacy, GDPR, CCPA & Data Subject Requests: data@ggid.eu
Urgent Legal, Abuse & Security Escalations: important@ggid.eu
General & Technical Support: support@ggid.eu

2. WHAT DATA WE COLLECT AND WHY (DETAILED BREAKDOWN)

Because ggid.eu is a cybersecurity and community protection utility designed to stop bot raids, scam bots, VPN abuse, and ban-evading alternate accounts ("Alt Accounts") on Discord, we collect specific technical and identity categories of data when you interact with our Service:

2.1. Network & IP Intelligence Data (Anti-VPN, Anti-Proxy & Anti-Alt)

When you access our website or complete a Discord verification challenge, we collect and analyze:

IP Addresses (IPv4 and IPv6): Used to detect whether multiple Discord accounts are verifying from the exact same network connection (Anti-Alt Detection) and to protect against coordinated bot raids.
Network Routing & ASN Metadata: Autonomous System Number (ASN), Internet Service Provider (ISP) name, country/region geolocation (at the network level, not precise GPS), and connection flags indicating whether the IP belongs to a known VPN provider, proxy server, Tor exit node, residential proxy, or hosting/datacenter facility.

2.2. Browser Telemetry & Device Fingerprinting (Anti-Alt Evasion Prevention)

To prevent malicious users from bypassing our Anti-Alt Detection by switching IP addresses or using proxies, our verification portal collects browser and environment attributes to compute a cryptographic device/browser fingerprint hash, including:

HTTP Headers & User-Agent String: Browser make and version, operating system, and device architecture.
Display & Hardware Telemetry: Screen resolution, available screen dimensions, color depth, pixel ratio, hardware concurrency (CPU logical core count), and device memory indicators.
Browser Environment Signals: System timezone, configured browser languages, installed system fonts, WebGL vendor/renderer strings, Canvas/Audio context rendering hashes, touch support status, and cookie/localStorage capability.
Privacy Safeguard: Where possible, raw telemetry attributes are converted into one-way cryptographic hashes (such as salted SHA-256 signatures) so we can detect if Device A is being used to verify both Discord Account 1 and Discord Account 2 without exposing raw device profiles to third parties.

2.3. Discord Identity & Guild Data (via Discord OAuth2 & REST API)

When you authenticate via Discord OAuth2 to verify in a server or log into our dashboard, we receive strictly the scopes requested on the Discord authorization screen:

Basic Identity (`identify` scope): Your unique Discord User ID (Snowflake), username, global display name, avatar hash, account creation date (derived from the Snowflake ID), and public user flags.
Server Membership (`guilds` / `guilds.join` if applicable): The Discord Guild ID (Server ID) where you are verifying, your join timestamp, and assigned verification roles.

2.4. AI Chatbot Interaction Data & Security Logs

When you interact with the AI Chatbot on our website:

Standard Processing: We process the text prompts/questions you submit and session context to provide automated support answers.
Suspicious Activity Logging: To protect our AI infrastructure from abuse, prompt injection, scraping, and malicious probing, chat transcripts, timestamps, associated IP addresses, User-Agent strings, and session identifiers are automatically flagged, logged, and retained if suspicious, abusive, or anomalous activity is detected.

2.5. AI OCR Image Filter Data (Discord Server Moderation)

In Discord servers where the AI OCR Image Filter is enabled:

Image Inspection: Images posted in monitored channels are scanned in real time using Optical Character Recognition (OCR) to extract embedded text and evaluate it against known scam patterns (for example, fake cryptocurrency giveaways, phishing domains, malicious QR codes).
Ephemeral Nature: Benign images are analyzed transiently in memory and are not permanently stored in a database. If an image is flagged as a scam/raid attempt, metadata regarding the violation (message ID, channel ID, user ID, extracted text snippet, and timestamp) may be logged in the server's moderation audit log.

2.6. Payment & Billing Metadata (Pro Tiers via Tebex)

When a Server Owner purchases a Pro/Premium tier:

Payments are processed externally by Tebex Limited acting as the Merchant of Record.
We only receive transaction confirmation webhooks containing the transaction ID, subscription tier, payment status, Guild ID, Discord User ID of the purchaser, and basic invoicing status. We never have access to your full credit card number, CVV, or bank login details.

3. LEGAL BASES FOR PROCESSING (EU GDPR ARTICLE 6)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data under the following legal bases specified in Article 6(1) of the GDPR:

3.1. Legitimate Interests, Art. 6(1)(f) GDPR (Cybersecurity, Fraud Prevention & Network Security):

Recital 47 and Recital 49 of the GDPR explicitly recognize that processing personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security (such as preventing unauthorized access, stopping malicious code distribution, stopping DDoS attacks, and preventing fraudulent/abusive multi-account ban evasion) constitutes a compelling legitimate interest. We rely on Art. 6(1)(f) GDPR for IP intelligence checks, Cloudflare Turnstile validation, anti-VPN/anti-alt browser fingerprinting during verification, AI OCR anti-scam scanning, and logging suspicious AI Chatbot activity.

3.2. Performance of a Contract / Pre-Contractual Steps, Art. 6(1)(b) GDPR:

Processing your Discord User ID, Guild ID, and verification status to assign your verification role on Discord, provide dashboard functionality to Server Administrators, and deliver Pro Tier features that you have requested or purchased.

3.3. Consent, Art. 6(1)(a) GDPR (and ePrivacy Directive):

When you actively authorize the Discord OAuth2 prompt and initiate verification on our portal, or when optional non-essential preferences/cookies are used. You may withdraw your consent at any time (for example, by revoking Discord OAuth2 access and submitting an erasure request to data@ggid.eu).

3.4. Compliance with Legal Obligations, Art. 6(1)(c) GDPR:

Retaining transaction records for tax/accounting compliance or responding to lawful binding requests from law enforcement or data protection supervisory authorities.

4. THIRD-PARTY PROCESSORS AND DATA SHARING

We never sell, rent, or trade your personal data to data brokers, advertisers, or unauthorized third parties. We only share data with trusted third-party service providers (Processors) strictly necessary to operate the Service:

4.1. Cloudflare, Inc. (USA / EU Edge)

Role: Cloudflare Turnstile managed challenge validation, Web Application Firewall (WAF), CDN, DDoS mitigation, and Cloudflare Workers AI fallback.
Data Processed: IP address, HTTP request headers, TLS fingerprint, and challenge telemetry to distinguish humans from automated bots without intrusive CAPTCHAs.

4.2. Discord Inc. (USA)

Role: Discord OAuth2 authentication and REST API role assignment / moderation execution.
Data Processed: OAuth2 tokens, Discord User IDs, Guild IDs, and API requests to assign verification roles or execute anti-raid actions.

4.3. Tebex Limited (UK / EU)

Role: PCI-DSS compliant checkout processor and Merchant of Record for premium guild tiers.
Data Processed: Billing details, payment instrument data, email address, IP address for fraud screening, and Discord User/Guild IDs linked to the purchase.

4.4. IPinfo, LLC (ipinfo.io - USA)

Role: Real-time IP address threat intelligence, ASN resolution, and commercial VPN/datacenter/proxy classification.
Data Processed: Public IPv4/IPv6 address and technical connection attributes for immediate threat score calculation. Transferred under standard contractual safeguards (SCCs / DPF).

4.5. NVIDIA Corporation (USA)

Role: Cloud neural inference provider (NVIDIA NIM) for the on-site automated AI support assistant.
Data Processed: User-submitted support chat messages, conversational context, and session telemetry to generate answers and protect the AI endpoint from prompt-injection exploits.

4.6. Strict Confidentiality: What Discord Server Administrators Can (and Cannot) See

CONFIDENTIALITY GUARANTEE: When you verify in a Discord server using ggid.eu, our API and dashboard DO NOT expose your raw IP address, home location, or raw browser telemetry to the Discord Server Owner or Moderators.
Raw IP addresses and full telemetry signatures are retained strictly within our private internal infrastructure for core platform security, automated ban-evasion detection, and staff abuse investigations.
Discord Server Administrators only receive restricted security indicators necessary for community moderation:
Verification Status (Passed / Failed);
Risk Flag (VPN Detected, Alt Account Match Detected, New Account);
The Discord User ID / tag of the linked alternate account within their server scope;
Action timestamps and event types.

5. INTERNATIONAL DATA TRANSFERS (EU TO US)

Our primary operations are managed from the Czech Republic (EU). However, certain third-party processors (such as Cloudflare, Inc., Discord Inc., IPinfo, LLC, and NVIDIA Corporation) are headquartered in the United States. When personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through:

The EU-U.S. Data Privacy Framework (DPF) adequacy decisions adopted by the European Commission under Article 45 GDPR (where the processor is DPF-certified); and/or
Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR, supplemented by end-to-end encryption in transit (TLS 1.3) and strict data minimization.

6. DATA RETENTION PERIODS

We retain personal data only for as long as necessary to fulfill the security and operational purposes outlined in this Privacy Policy:

Verification & Anti-Alt Fingerprints / Hashed IP Associations: Retained for the duration of your membership in protected Discord servers or up to 12 months from your last verification event to maintain effective anti-ban-evasion protection, unless you submit a valid erasure request via data@ggid.eu.
Cloudflare & Web Server Access Logs: Typically rotated and deleted automatically within 7 to 30 days.
AI Chatbot Logs: Standard ephemeral sessions are cleared shortly after session termination; flagged suspicious or abusive chat logs are retained for up to 6 to 12 months for security analysis, abuse prevention, and blocklist maintenance.
AI OCR Image Scans: Processed ephemerally in real-time memory; violation audit metadata is retained according to the server's moderation log lifecycle or until the server removes the bot.
Billing & Transaction Metadata (Tebex): Retained for the statutory period required by applicable tax and accounting regulations (up to 5 to 10 years where applicable).

7. YOUR RIGHTS UNDER EU GDPR AND CZECH LAW

If you are in the European Union / EEA (or globally, as we extend core privacy rights to all users), you have the following statutory rights under Articles 15 to 22 of the GDPR:

Right of Access (Art. 15 GDPR): Request confirmation of whether we process your personal data and receive a copy of the data linked to your Discord User ID.
Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request the deletion of your personal data from our verification databases.
Right to Restriction of Processing (Art. 18 GDPR): Request that we restrict processing of your data under specific statutory conditions.
Right to Data Portability (Art. 20 GDPR): Receive the data you provided to us in a structured, commonly used, machine-readable format (such as JSON).
Right to Object (Art. 21 GDPR) & Automated Decision-Making (Art. 22 GDPR): Object to processing based on legitimate interests (Art. 6(1)(f)) or request human review if you believe our automated VPN/Alt-Account Radar flagged you in error (false positive).
Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with the Czech data protection authority:
Úřad pro ochranu osobních údajů (ÚOOÚ, Office for Personal Data Protection)
Address: Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
Official Portal: uoou.gov.cz
Or with the supervisory authority in the EU Member State of your habitual residence.

8. UNITED STATES PRIVACY RIGHTS & AGE OF CONSENT (EU / CZ / US)

8.1. Categories of Personal Information Collected (Past 12 Months):

Identifiers: Discord User ID, username, IP address, cryptographic device/browser hashes.
Internet or Electronic Network Activity: Verification request headers, User-Agent, interaction with our website and AI Chatbot.
Geolocation Data: Coarse country/region-level IP network location (never precise GPS).
Inferences: Security risk scores (VPN usage probability, alt-account correlation).

8.2. No Sale or Sharing for Cross-Context Behavioral Advertising:

We DO NOT "sell" or "share" (as defined under the CCPA/CPRA) your personal information to third parties for monetary consideration or cross-context behavioral advertising. We do not display third-party behavioral ads.

8.3. Your US State Privacy Rights (CCPA / CPRA, VCDPA, CPA):

Right to Know & Access: Request disclosure of the categories and specific pieces of personal information collected.
Right to Delete: Request deletion of personal information, subject to statutory cybersecurity and fraud-prevention exceptions (such as California Civil Code § 1798.105(d)(2) regarding security incident detection and protection against malicious, deceptive, fraudulent, or illegal activity).
Right to Correct: Request correction of inaccurate personal information.
Right to Non-Discrimination: We will never discriminate against you in pricing or service quality for exercising your privacy rights.

8.4. Age of Digital Consent & Children's Privacy (EU / Czech Republic / COPPA):

Czech Republic & European Union: Pursuant to Section 7 of Czech Act No. 110/2019 Coll. on Personal Data Processing and Article 8 of the GDPR, the age of digital consent for information society services is 15 years old (or 16 in certain EU Member States). If you are under 15 years of age in the Czech Republic or the EU, you may only use our Service if verifiable consent has been granted or authorized by the holder of parental responsibility for you.
United States (COPPA): In accordance with the Children's Online Privacy Protection Act (COPPA) and Discord's minimum age requirements, our Service is strictly intended for individuals aged 13 and older. We do not knowingly collect personal information from children under 13 years of age. If we learn that personal data of a child under 13 has been collected without parental consent, we will delete it immediately upon notice at data@ggid.eu.

9. HOW TO SUBMIT A DATA REQUEST (ACCESS, EXPORT, OR DELETION)

9.1. How to Contact Us:

Send an email to data@ggid.eu with the subject line "Data Access Request" or "Data Deletion Request".

9.2. Identity Verification Requirement:

Because our records are indexed by Discord User ID, and to prevent malicious actors from deleting or accessing someone else's data, we must verify that you own the Discord account in question. Please include:

Your 17-to-19 digit Discord User ID (Snowflake) and current Discord username; and
Be prepared to confirm ownership (for example, by sending a confirmation check or one-time verification token from your Discord account if requested by our privacy team).

9.3. Response Timeframe:

In accordance with Article 12(3) GDPR and the CCPA, we will respond to all verifiable requests within thirty (30) days (extendable by up to an additional 30 to 60 days only for complex requests, with prior notice to you).

9.4. Consequences of Data Deletion on Discord Verification Status:

Upon completing a valid erasure request, we will purge your verification history, browser telemetry hashes, and associated logs from our active databases. If you request erasure while remaining in a Discord server that mandates continuous ggid.eu verification, your verified role in that server may be revoked, or you may be required to verify again. Where a user has engaged in severe platform abuse (such as DDoS attacks or automated raid botting), we reserve the right under Article 17(3)(b)/(e) GDPR and Cal. Civ. Code § 1798.105(d)(2) to retain a minimal, non-reversible cryptographic blacklist identifier solely to prevent repeat attacks against our infrastructure.

10. COOKIES, LOCAL STORAGE, AND CLOUDFLARE TURNSTILE

10.1. Strictly Necessary Technical Storage Only:

We do not use intrusive third-party advertising trackers, Facebook pixels, or behavioral profiling cookies.

10.2. Legal Exemption for Security Tokens:

Under Section 89(3) of the Czech Electronic Communications Act (Act No. 127/2005 Coll.) and Article 5(3) of the EU ePrivacy Directive, strictly necessary technical cookies and local storage tokens required to transmit communications, maintain your active Discord OAuth2 login session, store your security challenge token, and run Cloudflare Turnstile bot mitigation do not require prior marketing opt-in consent, as the security verification portal cannot function without them.

11. DATA SECURITY MEASURES

We implement appropriate technical and organizational security measures pursuant to Article 32 GDPR to protect your data against unauthorized access, alteration, disclosure, or destruction:

Encryption in Transit and at Rest: All communications between your browser, our servers, Discord, and Cloudflare are encrypted via HTTPS / TLS 1.2 & TLS 1.3. Sensitive database fields are encrypted or cryptographically hashed with AES-256-GCM / SHA-256.
Cryptographic Hashing & Salting: Device fingerprint parameters and comparison signatures are hashed so they serve only as correlation tokens rather than readable profiles.
Strict Access Controls: Access to backend infrastructure and flagged security logs is strictly restricted to core system administrators using multi-factor authentication (MFA) and SSH key authentication.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect technological improvements, new features, or evolving legal requirements. Whenever we make changes, we will update the "Last Updated" date at the top of this policy. Material changes will be announced via our website or Discord support community.

13. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please reach out to us at:

Data Protection, Privacy & GDPR/CCPA Requests: data@ggid.eu
Legal, Abuse & Urgent Security Notices: important@ggid.eu
General & Customer Support: support@ggid.eu
Operating Jurisdiction: Czech Republic (European Union)