Personal information is data that can be used to identify you individually, such as:

• Email address
• Username and password
• Profile information (such as profile picture, display name, and bio)
• IP address and device information
• Payment information (if you subscribe to GANGIO Pro)

We also collect non-personal information that does not directly identify you, such as:

• Usage data (features used, time spent, etc.)
• Device and browser information
• Cookies and similar technologies

We collect information in several ways:

• Direct Collection: Information you provide when you register, create a profile, or use our services.
• Automated Collection: Information collected automatically through cookies, web beacons, and other tracking technologies.
• Third-Party Sources: Information we may receive from third-party services if you choose to link them to your GANGIO account.

We use the information we collect for various purposes, including:

• Providing, maintaining, and improving our services
• Processing transactions and managing your account
• Personalizing your experience
• Communicating with you about updates, features, and support
• Analyzing usage patterns to enhance our services
• Protecting our services and users from abuse and violations
• Complying with legal obligations

We may disclose your information in the following circumstances:

• With Your Consent: We may share information with third parties when you consent to such sharing.
• Service Providers: We may share information with third-party vendors and service providers who need access to your information to help us provide our services.
• Legal Requirements: We may disclose information if required to do so by law or in response to valid requests by public authorities.
• Business Transfers: If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
• Protection of Rights: We may disclose information to protect the rights, property, or safety of GANGIO, our users, or others.

We encourage you to help us protect your information by:

• Using strong, unique passwords
• Enabling two-factor authentication
• Being cautious about the information you share
• Logging out of your account when using shared devices

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of data processing
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

GANGIO implements end-to-end encryption (E2E) for all private communications:

• Private Messages: All direct messages are E2E encrypted using NaCl Secretbox
• Private Channels: Server channels marked as private are E2E encrypted
• Voice Calls: All voice communications are encrypted in transit and at rest
• File Sharing: Files shared in private channels are encrypted

We retain your personal data for the following periods:

• Account Data: Until account deletion or 7 years after last activity
• Messages: Until account deletion or 2 years after last activity
• Voice Chat Recordings: 30 days (if enabled) or until account deletion
• Analytics Data: 2 years or until consent withdrawal
• Logs: 90 days for security and debugging purposes
• Consent Records: 5 years after consent withdrawal for audit purposes

Your data may be transferred to and processed in countries outside your residence. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs): For transfers outside the EEA
• Adequacy Decisions: For transfers to countries with adequate data protection
• Data Processing Agreements: With all third-party processors
• Encryption: All data is encrypted in transit and at rest