Privacy Policy

Who is responsible for your data

The data controller is Ondřej Jasenský, trading as ShadowGhost, a sole trader (OSVČ) registered in the Czech Republic under IČO 29553458, registered address Bezručova 4201, 430 03 Chomutov, Czech Republic.

Because the business is established in the European Union, the General Data Protection Regulation (GDPR) applies to how your data is handled, regardless of which country you're contacting me from.

For any question or request about your data, contact contact@shadowghost.eu.

What data I collect, and why

Project requests: your name, email, country, optional phone number, and, if you're ordering as a business, your company name, registration number, VAT number, and address. I use this to respond to your request and, if we go ahead, to deliver the work and issue an invoice. Providing your name, email, and country is needed to handle a request, without them I can't respond to it.

Phone support: a specialist business telephony provider handles calls to and from the published number and remains the source of the call history, recordings, voicemail, caller and recipient numbers, timing, duration, price, and line metadata. The protected dashboard retrieves those records for authorized support staff but does not copy the call history or audio. This website stores only an optional link between a provider call ID and an order, a support note, and staff availability. Calls are recorded for support quality, documenting what was agreed, and resolving complaints or legal claims. The caller is told before recording begins and may use email instead of the recorded line.

Order communication: messages exchanged through the order chat while a project is active, so we can talk about the work. To help me reply faster, I can ask an AI assistant, an OpenAI model accessed through Vercel's AI Gateway, to draft a suggested reply. This shares the chat history and relevant order details, such as your project description and current status, with that model. I always review and edit the draft myself before anything is sent, and nothing reaches you without a human reading it first.

Order tracking and documents: the private link you use to check on your order is stored on my servers in a hashed and encrypted form, never as plain text. Once delivery is confirmed, you can download an invoice and contract PDF built from your order details straight from the order status area of the contact form.

Reviews: if you choose to leave one after a project is delivered, your name, optional role or company, your review text, and a rating. Reviews are checked before they're published.

Occasional updates: if you tick the optional box on the request form, your name and email are added to a mailing list I use to occasionally share news, offers, or updates. This only happens with your explicit consent, and you can unsubscribe at any time using the link in any such email or by contacting me directly.

Push notifications: if you opt in, your browser creates a subscription identifier tied to your order, used only to notify you about updates to that order.

Poll voting: if you vote in a poll shown on the site, your browser stores a random voter token, not linked to your name or any other personal data, for up to five years, used only to stop the same poll being voted on twice.

Direct emails: if you email me directly, I keep the message thread to respond and keep a record of the conversation. Just like order chat, I can ask the same AI assistant to draft a suggested reply from that thread, which I always review and edit myself before anything is sent. This applies even if you've never submitted a request through this site.

Email delivery status: the email service I use reports back whether a message I sent was delivered, bounced, or marked as spam, so I can tell whether it reached you.

Cloud gaming: each user is identified only by a randomly generated identifier, with no name, account, or password on the cloud site. I store that identifier together with the games you can play, whether your access is currently paid, your next payment date and monthly hour allowance, and basic usage such as when your sessions ran, for how long, and, briefly, your place in the queue. If we agree on it, I also store an email address for your access, used only to send you your identifier, payment reminders, and notices that your access has been paused. Once you connect a PC, the small app installed on it also sends its hostname, operating system, graphics card and processor names, its own version number, live technical readings like processor, memory, and storage use, and which of the supported games it can find on that PC (only whether each game or its launcher is installed, never your files, accounts, or game data), purely to run the service and show you that PC's status. While a session is active, the app can start the game you chose on your PC and, for the length of that session, keeps that game in front and blocks the Windows key and Alt+Tab. The video and control connection between your browser and that PC travels as directly between them as your networks allow, is encrypted, and isn't stored or viewed by me.

Team profiles: the team section of the site shows a staff member's name, position, and, if they've provided a Discord ID, their public Discord profile picture. The picture is looked up from that ID through a third-party lookup service (japi.rest) and served through this site's own servers, so visitors' browsers never contact Discord or that service when viewing the page.

Dashboard activity: for team members with dashboard access, the dashboard records when they were last active. It is used only to avoid emailing a notification to someone who already has the dashboard open.

Company lookup: if you enter a Czech company registration number (IČO) on the request form, it's checked against ARES, the public business register run by the Czech Ministry of Finance, to fill in your company name and address for you.

Basic technical data: to keep the site and forms secure against bots and abuse, some technical request data is processed automatically and briefly through our own rate limiting and Vercel BotID (bot detection), not used to build a profile of you.

Why I'm allowed to process this data

To take steps towards, and perform, a contract with you, for project and order-related data.

To take steps at your request before a contract is made, including receiving and answering a non-binding enquiry. No data-processing consent is required for this.

Because you've given consent, for push notifications and the optional mailing list only. These choices are separate, optional, timestamped, and can be withdrawn at any time.

Because I have a legitimate interest in running and securing the business, for fraud prevention, abuse protection, and replying to general inquiries, balanced against your rights.

Because I have a legitimate interest in providing accountable telephone support, improving service quality, documenting what was agreed, and establishing or defending legal claims, for call metadata, support notes, and recordings. You may object to this processing and can always contact me by email instead.

Because the law requires it, for the minimum accounting and tax records Czech law requires me to keep.

Who your data is shared with

Your data is only shared with the service providers that help run this business, and never sold or given to advertisers. These are Vercel (hosting, analytics, and bot protection), Supabase (database hosting, including the short-lived counters used for rate limiting), Resend (sending emails, and hosting the optional mailing list mentioned above if you opt in), OpenAI, accessed through Vercel's AI Gateway, for the AI-assisted reply drafting mentioned above, and, only while a cloud gaming session is being set up, public STUN servers operated by Google and Cloudflare, which help your browser and your PC find the most direct route to each other. When they can't reach each other directly, the stream is passed between them through Cloudflare's relay (TURN) service, which only forwards the encrypted data and cannot view it. These services can see the public network addresses involved, not your identity, and this is a standard part of setting up this kind of connection.

The cloud gaming app on your PC also downloads a free, open-source video encoder (FFmpeg) once, directly from its publisher's download host (gyan.dev), so that host sees that PC's public network address when it does.

A specialist EU business telephony provider supplies the telephone line, routing, voicemail, call history, SMS delivery, and recordings. It receives the numbers, audio, message delivery data, and technical details needed to connect and administer communications. Depending on the activity, it acts as a processor under my settings or as an independent controller for its own security, billing, and legal records.

Provider roles depend on the service and the plan actually in use. Hosting, database, email-delivery, and AI suppliers generally process service data on my documented instructions under their applicable data-processing terms and may use subprocessors. Providers can act as independent controllers for their own account, security, abuse-prevention, billing, and legally required records. Their current privacy notices and DPAs govern those separate activities.

If I ever bring on staff or translators to help run the business, they may get limited dashboard access to the order and message details needed to help you, never full database or payment access, and they're bound to keep it confidential.

Some of these providers may process data outside the European Economic Area. Where that happens, it's covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long I keep your data

Once a project is delivered and confirmed, free-text details like the project description, notes, and contract text, along with the chat history, are automatically deleted about 24 hours later.

Basic order records needed for accounting and tax purposes, such as your name, the price, and payment status, are kept for as long as Czech tax law requires.

If you've opted in to occasional updates, your name and email stay on that mailing list until you unsubscribe or ask me to remove them.

Requests that never go ahead are cleared the same way after 12 months, and any push notification subscription tied to an order is deleted together with it.

Direct email conversations are reviewed after 24 months without activity and then deleted or minimized unless they're still needed for an active relationship, accounting, a complaint, or a legal claim. Published reviews stay on the site until you withdraw permission or ask me to remove them.

Telephone history, voicemail, and recordings are retained in the telephony account only for as long as needed for customer support, service-quality review, complaints, or legal claims, according to the account retention settings. They are then deleted or anonymized. The website does not make a second copy. Any order link or internal note attached to a call is removed when no longer needed for those purposes or when the related order is deleted, unless a legal obligation requires longer retention.

Cloud gaming access records are kept while your access is active, and deleted when it ends or when you ask me to, apart from payment records I have to keep for accounting and tax purposes. When you disconnect a PC, the details stored about it are deleted together with it.

You can ask me to delete other data sooner, and I will, unless I'm legally required to keep it.

Your rights

Under GDPR you can ask for access to your data, correction, deletion, or restriction where the legal conditions apply. You may object to processing based on legitimate interest. Where processing is automated and based on consent or a contract, you may also have the right to receive data you provided in a portable format. I do not make decisions about you using solely automated processing or profiling. A person reviews every AI-drafted reply before it is sent.

You can also withdraw consent at any time where processing is based on consent, without affecting anything done before that.

If you think your data hasn't been handled properly, you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or your own country's data protection authority if you're elsewhere in the EU.

Cookies and analytics

This site uses Vercel Analytics and Speed Insights for aggregate traffic and performance measurement. They are configured without analytics cookies and are not used for advertising or cross-site tracking. Limited technical request data is processed for this measurement on the basis of my legitimate interest in maintaining and improving the site. If the configuration changes to require consent, a consent choice will be shown before that storage or access occurs.

This site also sets a basic functional cookie to remember your language preference, and voting in a poll sets a single functional cookie so the same poll can't be voted on twice. Neither identifies you personally or is used for tracking or advertising.

The owner/staff sign-in page (dashboard) sets one security cookie that keeps you signed in. It's strictly necessary for logging into the admin area, an ordinary site visitor never receives it, and it isn't used for tracking or advertising.

The cloud gaming site keeps you signed in with one strictly necessary session and doesn't use analytics or advertising cookies. Like the dashboard cookie, it is never sent to an ordinary visitor of this site.

You can also install this site as an app on your device. That uses a small amount of local browser storage, a service worker cache, to let your order status load faster and work offline, not to track you across other sites.

Your browser's local storage is also used to remember your theme choice, whether you've dismissed the language and install-app prompts, and, after you submit a request, the private link to your order so the site can take you back to it. This stays on your device and isn't sent anywhere else.

Changes to this policy

I may update this policy as the site or the way I handle data changes. Meaningful changes will be reflected here with an updated date at the top.