Privacy Policy

Last updated: 2026-10-19 (version c1a14c85)

This Privacy Policy explains what personal data Gamoty collects, why, and how it's handled. It applies to the website at l2.smart123.ro and to the Gamoty Windows client.

1. Who we are

Gamoty is provided by Smart Things Electronics SRL, Intr. Nicolae Iorga nr. 62E, Chiajna, jud. Ilfov, 077040, Romania (Trade Register J23/2073/2016, VAT ID RO36084428), acting as data controller under Regulation (EU) 2016/679 ("GDPR"). Contact: [email protected].

2. What we collect

Account data

• Email address (used as login identifier and for transactional email)
• A password hash (we never store passwords in clear text)
• Account creation timestamp

Device data

• A random host key, device name, and public key for each PC you pair
• Local-network address of the PC (used to offer LAN direct-connect)
• The last timestamp we saw the device online
• One-way fingerprints of the PC's hardware and of its Windows installation (hashes, from which the identifiers themselves cannot be recovered), used to offer the free trial once per computer
• Optional: which other accounts you've shared access with

Billing data

• A Stripe customer ID and subscription ID tied to your account
• Subscription status, current period end, and quantity
• What you bought and when: purchases, subscriptions, payments and refunds (amounts, dates and Stripe references), and the time they gave each PC
• Your billing address and country, which you give on Stripe's payment page and Stripe holds for invoices and tax; if you pay by invoice, the bank transfer details Stripe gives you and the transfers it receives from you
• Which billing e-mails we sent you and when (confirmations, reminders, payment notices)
• When someone pays a subscription for your PC, or you pay one for someone else’s: who pays, for which PC. The payer sees the owner’s nickname (or e-mail address when they have none), the PC’s name, whether it has time and until when it is paid; the PC’s owner sees the payer’s nickname, or their e-mail address when they have none, and is told when the payer starts, renews or stops paying and when a renewal could not be taken — never an amount or anything about the payer’s card. Our e-mails about a subscription sent by e-mail name its sender the same way, including the invitation we send to an address with no account. An address you send a subscription to is kept until it is put on a PC, declined or cancelled, and 30 days at most when it is not: 30 days from sending while no account has it, and 30 days from when an account takes it.

We do not receive or store your card number. Card data is collected and stored by our payment processor, Stripe, Inc., under their own terms and privacy policy (stripe.com/privacy).

Operational logs

• Authentication events, pairing attempts, and administrative actions (for security auditing)
• Short-lived application logs from the Windows client, sent back for support and diagnostics
• HTTP access logs (IP, user agent, endpoint, response code) maintained by our reverse-proxy for security and abuse prevention

Streaming content

The video and input streams between your viewer and your PC go through a WebRTC connection that prefers direct / LAN paths and falls back to our TURN relay when necessary. We do not record these streams. Media relayed through TURN is end-to-end encrypted and is not retained.

3. Why we collect it (legal bases)

• Contract (Art. 6(1)(b) GDPR) — to provide the Service you subscribed to.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent abuse (including the free trial being taken more than once on the same computer), and debug problems.
• Legal obligation (Art. 6(1)(c)) — for invoicing and accounting records required by law.

4. Who we share with

• Stripe, Inc. — payment processing (PCI-DSS compliant).
• Zoho Corporation — delivery of our e-mails (account and billing e-mails): your e-mail address and the content of those e-mails.
• Our hosting provider — server infrastructure in the EU.
• No advertising networks, no data brokers, no third-party analytics on the dashboard.

5. How long we keep it

• Account and device data: for as long as your account is active. When you delete your account, what identifies you — your address, nickname, password, sessions, your PCs and their names, and your shares — is removed at once; the account remains only as an anonymous record the payment records below are tied to.
• The fingerprints of a computer that had a free trial or a grant of time: for as long as we offer a free trial, also after the account is deleted, because they are what stops a second trial on that computer. They are one-way hashes and identify nothing else.
• Invoices and payment records (purchases, subscriptions, payments, refunds): 10 years, which covers what accounting and VAT rules require of us. When you delete your account these records are kept pseudonymised: your address, nickname and password are removed, and what remains is tied to an account id and to your customer record at Stripe, which Stripe keeps under its own retention rules.
• A record of what happened to your subscriptions, time passes, free trial and referrals, and to the e-mails we are required to send you — when each was bought, started, placed on a PC, given, refunded, withdrawn from or ended, and why: 10 years, like the payment records, so that each of these can be shown later, to you as much as to anyone. It holds account and item ids, amounts and dates, and never your address, your PCs’ names or your computers’ fingerprints; it is kept, pseudonymised, after you delete your account, and you can ask us for a copy.
• Access logs: up to 90 days.
• Client application logs: up to 30 days.

6. Your rights

Under GDPR you can ask us to:

• confirm what data we hold about you and get a copy;
• correct data that's wrong or incomplete;
• delete your data (subject to legal retention obligations);
• restrict or object to certain processing;
• receive your data in a portable format;
• lodge a complaint with your national data-protection authority.

To exercise any of these rights, email [email protected]. We'll respond within 30 days.

7. Security

We use HTTPS everywhere, store password hashes with a modern KDF, sign authentication tokens with Ed25519, and pin the TLS certificate in our Windows client to prevent traffic interception. Access to the production database is restricted to a dedicated service account, and administrative actions are audit-logged.

No system is perfectly secure. If we discover a breach affecting your personal data, we'll notify you and the relevant authorities within the timeframes required by law.

8. Cookies

We use only strictly necessary cookies: session cookies for authentication and a CSRF token. We do not use analytics or advertising cookies.

9. International transfers

Our servers are located in the European Union. Stripe and Zoho may process data outside the EU under the Standard Contractual Clauses; see their privacy policies for details.

10. Children

Gamoty is not directed to children under 18. We don't knowingly collect data from children. If you believe a child has created an account, contact us and we'll delete it.

11. Changes

If we make material changes to this policy, we'll notify you by email or via the dashboard. The "Last updated" date at the top always reflects the current version.