Privacy Policy

GCN.ONE — Encrypted File Transfer & Storage Service

Version: 1.5  |  Effective Date: 2026-07-28  |  Last Updated: 2026-07-28

This Privacy Policy explains how ORBCORE LTD (“Company”, “we”, “us”, “our”), registered at 3rd Floor Suite, 207 Regent Street, London W1B 3HH (England & Wales, company no. 07930383), collects, uses, stores, and protects your personal data when you use the GCN.ONE platform and related services (“Service”).

We have designed this document to satisfy the transparency requirements of the EU General Data Protection Regulation (GDPR) Articles 13 and 14, the UK GDPR and Data Protection Act 2018, and applicable US state privacy laws including the California Consumer Privacy Act (CCPA) as amended by the CPRA. It should be read alongside our Terms and Conditions.

If you have questions, contact our Data Protection Officer at privacy@gcn.one.

Table of Contents

1. Who We Are and How to Contact Us
2. The Fundamental Privacy Principle: Zero-Knowledge Architecture
3. What Personal Data We Collect and Why
4. Legal Bases for Processing (EU / UK GDPR)
5. How We Use Your Data
6. Cookies and Tracking Technologies
7. How Long We Keep Your Data
8. Who We Share Your Data With
9. International Data Transfers
10. Security
11. Your Rights — EU and UK Residents
12. Your Rights — California Residents (CCPA / CPRA)
13. Your Rights — Other US State Residents
14. Children’s Privacy
15. Law Enforcement and Government Requests
16. Third-Party Links and Services
17. Do Not Track Signals
18. Changes to This Privacy Policy
19. Supervisory Authorities
20. Glossary

---

1. Who We Are and How to Contact Us

1.1 Data Controller

For the purposes of the EU GDPR, UK GDPR, and US privacy laws, the data controller is:

ORBCORE LTD
3rd Floor Suite, 207 Regent Street, London W1B 3HH
Registered in England & Wales, company no. 07930383
VAT: not VAT-registered

1.2 Data Protection Officer (DPO)

We have appointed a Data Protection Officer as required under GDPR Article 37. You may contact our DPO directly for any privacy-related matter:

Contact: Data Protection contact (ORBCORE LTD)
Email: privacy@gcn.one
Postal address: 3rd Floor Suite, 207 Regent Street, London W1B 3HH

1.3 UK Representative

Not applicable: ORBCORE LTD is established in the United Kingdom, so no separate UK representative is required under UK GDPR Article 27.

1.4 EU Representative and Establishment

EU data subjects and authorities may contact us at privacy@gcn.one (data protection) and legal@gcn.one (legal and law-enforcement matters). ORBCORE LTD will designate an establishment, or appoint a legal representative, in an EU member state to receive and respond to European Production and Preservation Orders under Regulation (EU) 2023/1543 (“e-Evidence”) and, where required, a representative under Article 27 of the EU GDPR. This designation will be in place as required by the applicable statutory deadlines (including 18 August 2026 for e-Evidence), and the representative’s details will be published here once appointed.

1.5 General Contact

---

2. The Fundamental Privacy Principle: Zero-Knowledge Architecture

This section is essential to understanding what GCN.ONE can and cannot know about you.

2.1 We Cannot Read Your Files

GCN.ONE is built on a zero-knowledge encryption architecture. This means:

• All file content is encrypted on your device before being transmitted to our servers, using XSalsa20-Poly1305 authenticated symmetric encryption.
• The Content Encryption Key (CEK) — the key that can decrypt your file — is generated locally on your device and is never transmitted to or stored by us in plaintext.
• Key exchange and wrapping of the CEK for recipients is performed using X25519 elliptic-curve Diffie-Hellman (with an optional hybrid X25519 + ML-KEM-768 key format for post-quantum protection), ensuring that even during the key negotiation phase, we do not obtain a usable decryption key.
• Our servers store only the encrypted ciphertext. Without the CEK, this data is computationally indistinguishable from random noise.

In practical terms: we are technically incapable of reading, scanning, analysing, or disclosing the content of any file you upload, transfer, or receive through GCN.ONE. This is not a policy choice — it is an architectural constraint.

2.2 What This Means for Your Privacy

Because we cannot access file content:

• We do not scan files for advertising, profiling, or analytics purposes.
• We cannot fulfil law enforcement requests for file content — we have nothing to hand over. See Section 15.
• We cannot recover files for you if you lose the transfer link or key.
• We do not use your file content to train AI models, improve our algorithms, or for any purpose other than encrypted transit and temporary storage pending TTL expiry.

2.3 What We Do Process

We do process metadata associated with your use of the Service — for example, the fact that a transfer occurred, its file size, its TTL setting, and certain technical identifiers. This metadata is described in detail in Section 3. Metadata does not reveal the content of your files.

2.4 Your Responsibility for File Content

We are the data controller for account data and metadata, as described in Section 1.1. We are not the controller of any personal data contained inside the files you send — we cannot see it, cannot decrypt it, and have no means of knowing whether it exists.

Where you transmit files containing personal data of other people, you determine the purposes and means of that processing and are the controller of it. You are responsible for having a lawful basis to share that data with your chosen recipient, for meeting any notice or consent obligations owed to the people concerned, and for the accuracy of the recipient address or link you use. Business and Enterprise customers may enter into a GDPR Article 28 Data Processing Agreement with us, through their account settings once their business details have been verified, covering the account data and metadata we process on their behalf; that agreement does not, and cannot, extend to file content we are unable to access. See also Section 8.6 of our Terms and Conditions.

---

3. What Personal Data We Collect and Why

We collect different categories of personal data depending on how you use the Service.

3.1 Data You Provide Directly

Note on passwords: We never store your password in readable form. Passwords are hashed using Argon2id, a memory-hard one-way algorithm (RFC 9106), with a per-user salt. We cannot recover your password.

Note on payment card data: Full card numbers, CVV codes, and expiry dates are processed exclusively by our PCI-DSS certified payment processor and are never transmitted to or stored on GCN.ONE servers.

3.2 Data We Collect Automatically

3.3 Data We Do Not Collect

We explicitly do not collect the following:

• File content — encrypted by design; inaccessible to us.
• File names — unless explicitly provided in a transfer label field (optional, encrypted at rest).
• Full payment card numbers, CVV, or expiry dates — handled entirely by our payment processor.
• Government-issued ID or biometric data — we do not perform identity verification at present; any future deployment will be privacy-preserving by design (e.g., eID wallet integration without raw ID storage).
• Location data beyond IP geolocation — we do not use GPS or device location APIs.
• Social media profile data — we do not offer social login and do not integrate with social media platforms.
• Special category / sensitive personal data — we have no legitimate purpose to collect health, racial, religious, political, biometric, or sexual orientation data through the Service.

3.4 Anonymised and Aggregated Data

We produce anonymised and aggregated statistics from usage data (e.g., “total transfers per day”, “average file size by plan tier”) for internal analytics and capacity planning. Anonymised data does not constitute personal data and is not subject to data subject rights requests.

---

4. Legal Bases for Processing (EU / UK GDPR)

The GDPR and UK GDPR require us to have a lawful basis for processing your personal data. We rely on the following bases:

4.1 Legitimate Interests Assessment

Where we rely on legitimate interests, we have conducted a balancing test confirming that our interests do not override your rights and freedoms, taking into account: (a) the nature of the data processed (metadata only, not file content); (b) the reasonable expectations of users of a security-focused service; and (c) the safeguards we apply. You may request a copy of our legitimate interests assessment by contacting privacy@gcn.one.

4.2 Withdrawing Consent

Where processing is based on consent (Article 6(1)(a)), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for marketing emails, use the unsubscribe link in any marketing email or contact privacy@gcn.one. To withdraw cookie consent, use the cookie settings panel in the website footer.

---

5. How We Use Your Data

5.1 Providing the Service

We use your personal data to:

• Authenticate you and maintain secure sessions.
• Process file transfers, enforce TTL settings, and deliver transfer links.
• Enforce plan limits (file size, bandwidth, number of transfers).
• Process payments and issue receipts and tax invoices.
• Send transactional notifications (e.g., successful transfer, TTL expiry warning, payment confirmation, security alerts).

5.2 Security and Abuse Prevention

We use IP addresses, device fingerprints, and usage metadata to:

• Detect and block automated abuse, credential stuffing, and DDoS traffic.
• Identify transfers that may violate our Acceptable Use Policy based on metadata signals (not content scanning).
• Enforce rate limits and bandwidth caps.
• Block IP ranges associated with malicious activity or datacenter hosting providers (as a passive anti-abuse measure).
• Investigate security incidents and respond to abuse reports.

5.3 Legal and Regulatory Compliance

We use your data to comply with:

• Tax and VAT obligations in applicable jurisdictions.
• Lawful orders from courts or competent authorities for metadata disclosure.
• Anti-money-laundering (AML) and counter-terrorism financing (CTF) obligations, if applicable to Business/Enterprise accounts.
• CSAM reporting obligations to NCMEC, IWF, and competent national authorities, where applicable (note: we cannot detect CSAM from encrypted content, but we act on credible reports and detected metadata signals).

5.4 Service Improvement

We use anonymised and aggregated data — never individual-level personal data — to:

• Monitor Service performance and reliability.
• Plan infrastructure capacity.
• Analyse usage patterns at an aggregate level to improve features.

We do not use your personal data to train machine learning models.

5.5 Marketing

With your explicit consent only, we may send you:

• Product updates and new feature announcements.
• Promotional offers for plan upgrades.
• Security advisories and best-practice guidance.

You may unsubscribe at any time via the link in any marketing email, or by contacting privacy@gcn.one. Unsubscribing from marketing does not affect transactional communications required to deliver the Service.

---

6. Cookies and Tracking Technologies

6.1 What Are Cookies

Cookies are small text files stored on your device by your browser. We also use related technologies including local storage tokens and server-side session identifiers.

6.2 Cookies We Use

We do not use:

• Third-party advertising cookies.
• Social media tracking pixels.
• Cross-site fingerprinting or supercookies.
• Google Analytics, Facebook Pixel, or similar third-party analytics SDKs.

6.3 Consent Mechanism

For Users in the EU and UK, we present a cookie consent banner on first visit. Non-essential cookies (functional, analytics) are not set until you provide consent. We record the timestamp and version of your consent.

6.4 Managing Your Cookie Preferences

• Cookie settings panel: Accessible via the “Cookie Settings” link in the website footer at any time.
• Browser settings: Most browsers allow you to block, delete, or restrict cookies. See your browser’s help documentation.
• Opt-out of analytics: Even where consent is given, you may opt out of analytics cookies at any time via the cookie settings panel.

Disabling strictly necessary cookies will prevent the Service from functioning correctly.

---

7. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected or as required by law.

7.1 Criteria for Determining Retention Periods

When determining retention periods we consider: (a) the purpose for which the data was collected and whether that purpose has been fulfilled; (b) legal, tax, and audit obligations; (c) our ability to defend legal claims within applicable limitation periods; and (d) GDPR Article 5(1)(e) storage limitation principle.

7.2 Secure Deletion

Upon expiry of a retention period, personal data is securely deleted or irreversibly anonymised. For structured databases, deletion is performed at the record level. For encrypted blob storage, the associated encryption key is destroyed and the ciphertext is overwritten in accordance with our data deletion procedures. Deletion is suspended for data subject to a legal preservation hold (see §15.9).

---

8. Who We Share Your Data With

We do not sell your personal data. We do not share personal data with advertising networks. We share data only as follows:

8.1 Sub-processors and Service Providers

We use third-party sub-processors who process personal data strictly on our behalf and under our documented instructions, subject to Data Processing Agreements (DPAs) meeting GDPR Article 28 requirements.

Certain third parties appear in how the Service is built or delivered but are not sub-processors, because no personal data reaches them: MaxMind GeoLite2 (the IP-to-city database is downloaded to our servers and queried locally — your IP address is never transmitted to MaxMind), our SMTP email relay (self-operated on our own domain and infrastructure, not a third-party email service), and the OpenTimestamps public calendars used to anchor our audit log (only a 32-byte hash of a Merkle root crosses the wire — no identifiers, filenames or content). Our infrastructure and hosting is operated on servers located within the European Union.

The current list is published at gcn.one/Pages/SubProcessors and is the same list that forms Annex 2 of our Article 28 Data Processing Agreement. You may also request it by contacting privacy@gcn.one. We will notify you of any additions to our sub-processor list that may materially affect your privacy rights, where required by law.

8.2 Legal Obligations and Law Enforcement

We may disclose personal data to courts, regulators, law enforcement agencies, or other governmental bodies:

• Where required by a valid and lawful legal order, court order, or binding regulatory demand.
• To enforce our Terms and Conditions or protect our legal rights.
• To prevent or detect crime, fraud, or imminent harm to a person’s safety.

We will only disclose metadata (see Section 2.3). We cannot provide file content because we do not possess the decryption keys. This applies equally to European Production and Preservation Orders under Regulation (EU) 2023/1543 (“e-Evidence”). See Section 15 for our full law enforcement response policy.

Where permitted by law, we will notify you of any request for your personal data before complying, so that you may seek appropriate legal protection.

8.3 Business Transfers

If the Company undergoes a merger, acquisition, asset sale, or corporate restructuring, your personal data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify affected Users before data is transferred and the new controller assumes responsibility.

8.4 Professional Advisers

We share data with our lawyers, accountants, auditors, and insurers where necessary, under confidentiality obligations.

8.5 Aggregated / Anonymised Data

We may share aggregate, anonymised statistics (e.g., “X million transfers completed in Q1”) publicly or with partners. Such data does not identify you and is not personal data.

---

9. International Data Transfers

9.1 Where We Store Your Data

Personal data and transfer metadata are stored on infrastructure located in:
Primary location: European Union (Germany — data centres in Falkenstein and Nuremberg)

We do not routinely transfer personal data outside the EU/EEA or UK. Where transfers to third countries are necessary (e.g., some sub-processors), we use the mechanisms described below.

9.2 EU/EEA Transfer Mechanisms

Transfers of EU/EEA residents’ personal data to countries not covered by an adequacy decision are protected by:

• Standard Contractual Clauses (SCCs) — using the modular SCCs approved by the European Commission in Decision 2021/914/EU; and
• Transfer Impact Assessments (TIAs) conducted for each third-country transfer to assess the legal environment and supplementary safeguards required.

A copy of the applicable SCCs is available on request at privacy@gcn.one.

9.3 UK Transfer Mechanisms

Transfers of UK residents’ personal data to third countries are governed by:

• UK International Data Transfer Agreement (IDTA) issued by the ICO; or
• UK Addendum to the EU SCCs (where applicable).

9.4 US-Based Sub-processors

Where we use US-based sub-processors, we rely on SCCs supplemented by TIAs. We have assessed the legal framework in the United States and applied supplementary technical measures (including end-to-end encryption) where necessary.

9.5 No Transfer of File Content

Because file content is encrypted client-side, the ciphertext stored on our infrastructure is not meaningfully “transferred” in terms of data protection risk — it is computationally inaccessible without the CEK, which never leaves your device.

---

10. Security

10.1 Technical Measures

We implement the following technical security measures:

10.2 Organisational Measures

• Access to personal data is restricted to personnel who need it to perform their role.
• All personnel with access to personal data are trained on data protection obligations and bound by confidentiality agreements.
• We conduct periodic security assessments and penetration testing.
• We maintain an incident response plan as required by GDPR Article 32.

10.3 No Absolute Security Guarantee

Whilst we implement industry-standard security measures, no internet service can guarantee absolute security. In the event of a data breach, we will notify affected Users and relevant supervisory authorities in accordance with GDPR Article 33/34 (within 72 hours of becoming aware), UK GDPR, and applicable US state breach notification laws.

10.4 Your Role in Security

You are responsible for:

• Keeping your account credentials confidential.
• Sharing transfer links only with intended recipients.
• Ensuring that the device you use to upload files is free from malware.
• Downloading transferred files within the TTL window — we cannot recover files after TTL expiry.

---

11. Your Rights — EU and UK Residents

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the GDPR and UK GDPR:

11.1 Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data together with information about how it is processed (including purposes, categories, recipients, retention periods, and source). We will provide this within one month, extendable by two further months for complex requests.

11.2 Right to Rectification (Art. 16 GDPR)

You have the right to have inaccurate personal data corrected without undue delay. For account data, you may correct most information directly through your account settings. For other corrections, contact privacy@gcn.one.

11.3 Right to Erasure (Art. 17 GDPR — “Right to be Forgotten”)

You have the right to request deletion of your personal data where:

• It is no longer necessary for the purposes for which it was collected;
• You withdraw consent and there is no other lawful basis;
• You object to processing and there are no overriding legitimate grounds;
• The data has been unlawfully processed; or
• Deletion is required by EU or Member State law.

Exceptions apply where retention is necessary for legal compliance, the establishment, exercise, or defence of legal claims, or other grounds under Article 17(3) — including data subject to a legal preservation hold (see §15.9).

11.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request that we restrict processing in the following circumstances:

• You contest the accuracy of the data (restriction applies during verification);
• Processing is unlawful but you prefer restriction over erasure;
• We no longer need the data but you need it for legal claims;
• You have objected to processing pending verification of our legitimate grounds.

11.5 Right to Data Portability (Art. 20 GDPR)

Where processing is based on contract or consent and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) and to transmit that data to another controller. We will provide a data export within one month of your request.

11.6 Right to Object (Art. 21 GDPR)

You have the right to object at any time to processing based on legitimate interests (Article 6(1)(f)), including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims.

You have an absolute right to object to processing for direct marketing purposes (including profiling for marketing). We will honour such objections immediately.

11.7 Rights Related to Automated Decision-Making (Art. 22 GDPR)

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. If this changes, we will update this Policy and provide appropriate rights.

11.8 Right to Withdraw Consent (Art. 7(3) GDPR)

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent for marketing, use the unsubscribe link or contact privacy@gcn.one. To withdraw cookie consent, use the cookie settings panel.

11.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. See Section 19 for contact details. We encourage you to contact us at privacy@gcn.one first so we may try to resolve your concern directly.

11.10 How to Exercise Your EU/UK Rights

Submit your request to:

• Email: privacy@gcn.one
• Online form: https://gcn.one/Pages/Privacy

We will verify your identity (to protect against fraudulent requests) and respond within one month. We will not charge a fee for reasonable requests. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, providing written reasons.

---

12. Your Rights — California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) as amended by the California Privacy Rights Act (CPRA):

12.1 Right to Know (§ 1798.110 / 1798.115)

You have the right to request that we disclose:

• The categories of personal information we have collected about you.
• The categories of sources from which personal information is collected.
• The business or commercial purpose for collecting or sharing personal information.
• The categories of third parties with whom we share personal information.
• The specific pieces of personal information we have collected about you.

12.2 Right to Delete (§ 1798.105)

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., legal obligations, security, fraud prevention).

12.3 Right to Correct (§ 1798.106 — CPRA)

You have the right to request correction of inaccurate personal information we maintain about you.

12.4 Right to Opt Out of Sale or Sharing (§ 1798.120)

We do not sell your personal information to third parties for monetary consideration.

We do not share your personal information for cross-context behavioural advertising.

A “Do Not Sell or Share My Personal Information” link is available at https://gcn.one/Pages/Privacy for completeness, though we have no sale or sharing activity to opt out of.

12.5 Right to Limit Use of Sensitive Personal Information (§ 1798.121 — CPRA)

We collect no sensitive personal information (as defined by the CPRA — including SSN, financial account credentials, precise geolocation, health data, racial/ethnic origin, sexual orientation, or contents of personal communications) except for payment data processed by our PCI-DSS certified processor. You may request that we limit the use of sensitive personal information to purposes necessary to deliver the Service by contacting privacy@gcn.one.

12.6 Right to Non-Discrimination (§ 1798.125)

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you the Service, charge different prices, provide a different quality of service, or suggest you will receive inferior service as a result of exercising your rights.

12.7 Right to Know About Financial Incentives (§ 1798.125)

We do not offer financial incentives in exchange for the collection, retention, or sale of personal information.

12.8 CCPA Categories of Personal Information Collected

12.9 How to Submit California Rights Requests

• Email: privacy@gcn.one
• Online form: https://gcn.one/Pages/Privacy

We will acknowledge your request within 10 Business Days and respond within 45 days. We may extend by an additional 45 days for complex or numerous requests with written notice.

Authorised agents: You may designate an authorised agent to submit requests on your behalf. We will require: (a) written authorisation signed by you; or (b) proof of power of attorney. We may still verify your identity directly.

---

13. Your Rights — Other US State Residents

We recognise and honour privacy rights for residents of US states with enacted privacy legislation:

To exercise rights under any applicable US state privacy law, submit your request to privacy@gcn.one identifying your state of residence. We will respond within the timeframe required by your state’s law (typically 45 days, extendable by 45 days with notice).

We do not sell personal data and do not process personal data for targeted advertising — you do not need to opt out of activities we do not engage in.

---

14. Children’s Privacy

14.1 Age Restriction

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

14.2 COPPA (US — Under 13)

In compliance with the Children’s Online Privacy Protection Act (15 U.S.C. § 6501 et seq., “COPPA”), we do not knowingly collect personal information from children under 13 years of age. If we discover that we have inadvertently collected personal information from a child under 13, we will delete it promptly.

Parents or guardians who believe their child under 13 has provided personal information to GCN.ONE should contact privacy@gcn.one immediately with the subject line “COPPA — Minor Data Request.”

14.3 EU/UK — Age of Digital Consent

Under GDPR Article 8, the age of digital consent varies by EU Member State (minimum 13, up to 16). However, because use of the Service requires the ability to enter a legally binding contract, we apply a uniform minimum age of 18 across all jurisdictions regardless of the applicable digital consent age.

14.4 Age Verification

We do not currently deploy formal age verification technology. Our primary age barrier is the requirement for a payment instrument for paid tiers, which minors generally cannot hold. Anonymous and free-tier access does not require an account or payment. We reserve the right to implement additional age assurance mechanisms in future.

---

15. Law Enforcement and Government Requests

15.1 Our Position

GCN.ONE is architecturally designed so that we cannot access the content of any file stored on our Service. This is not a policy stance — it is a technical fact arising from our zero-knowledge encryption design (see Section 2).

15.2 What We Can and Cannot Provide

15.3 Requirements for Compliance

We require that any request from a law enforcement or government authority:

• (a) Is submitted through appropriate legal channels (e.g., court order, production order, mutual legal assistance treaty (MLAT) process);
• (b) Is directed to legal@gcn.one with the subject line “Law Enforcement Request — GCN.ONE”;
• (c) Specifies the data requested with sufficient particularity;
• (d) Is accompanied by appropriate legal authorisation valid in the jurisdiction governing these Terms.

Informal requests, requests submitted via non-official channels, or requests lacking proper legal authorisation will not be acted upon.

15.4 User Notification

Where legally permitted and where time allows, we will notify affected Users of law enforcement requests for their data before complying, so they may seek legal protection. We will not notify Users if prohibited from doing so by the terms of a court order or applicable law (e.g., gag orders).

15.5 Transparency Reporting

We intend to publish periodic transparency reports disclosing the number and nature of government data requests received. The first report will cover 2026.

15.6 CSAM Mandatory Reporting

Notwithstanding our zero-knowledge architecture, if we receive credible reports or metadata signals indicating the presence of child sexual abuse material (CSAM), we are obliged by law to report to:

• NCMEC CyberTipline (US)
• Internet Watch Foundation (UK/EU)
• Relevant national law enforcement authority

We will immediately suspend any account associated with a credible CSAM report.

15.7 European Production and Preservation Orders (e-Evidence)

Under Regulation (EU) 2023/1543 (the “e-Evidence Regulation”), competent authorities in EU member states may issue European Production Orders and European Preservation Orders directly to service providers for stored data. We will respond to valid orders through our designated EU establishment or legal representative (see Section 1.4) within the applicable statutory deadlines. Consistent with Section 15.2, we can produce only the metadata and encrypted (ciphertext) data in our possession; we cannot produce plaintext file content, as we do not hold the decryption keys.

15.8 No Content Scanning

We do not and cannot scan, filter, hash-match, or otherwise inspect the content of files, and we perform no client-side scanning on your device. We do not rely on the voluntary detection framework permitted by the EU interim “Chat Control” derogation (Regulation (EU) 2021/1232). No current legal obligation requires us to scan content, including under the proposed EU Child Sexual Abuse Regulation (“CSAR”), which remains under negotiation; should any future legal obligation require detection incompatible with our zero-knowledge design, we will inform affected Users. Detection of prohibited content remains reactive — based on user reports and metadata signals, as described in Section 15.6 and our Terms and Conditions.

15.9 Preservation Orders and Legal Holds

Separately from requests to produce data, an authority may order us to preserve data — to stop it being deleted while an investigation or proceeding runs. Where we receive a valid preservation order (for example a European Preservation Order under Regulation (EU) 2023/1543, an order of the courts of England and Wales, or a request under 18 U.S.C. § 2703(f)), we may suspend automatic TTL deletion and retain the encrypted ciphertext, wrapped key material, and metadata identified in the order beyond our normal retention periods, including after you delete a transfer or close your account.

A hold changes what we keep and for how long. It does not change what we can read: preserved file content stays encrypted, and we hold no key that would decrypt it. Preserved data is segregated, used only to comply with the order, and deleted when the order lapses or is withdrawn.

Where an order prohibits us from disclosing it, we cannot tell you that a hold is in place, and the Service may continue to show the affected data as deleted. Section 15.4 governs notification where disclosure is permitted. The lawful basis is Art. 6(1)(c) and/or Art. 6(1)(f) GDPR; the erasure exception is Art. 17(3)(b) and (e). See also Section 7.6 of our Terms and Conditions.

---

16. Third-Party Links and Services

Our website and Service may contain links to third-party websites or services (e.g., documentation, payment processors, browser extension stores). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with GCN.ONE. We are not responsible for the privacy practices of third parties.

---

17. Do Not Track Signals

Some browsers transmit “Do Not Track” (DNT) signals to websites. Because we do not engage in cross-site behavioural tracking or third-party advertising, we do not treat DNT signals differently from other requests — our privacy-by-design architecture already exceeds the protections DNT signals are intended to elicit. For Users in jurisdictions where the Global Privacy Control (GPC) signal has legal effect (e.g., California under CPRA), we treat a GPC signal as an opt-out of the sale or sharing of personal information — though as noted above, we do not sell or share personal data for advertising.

---

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Sending an email to your registered address (for Subscribers) at least 30 days before the change takes effect; and
• Posting a prominent notice on our website.

The “Last Updated” date at the top of this document reflects the date of the most recent revision. For non-material changes (e.g., clarifications, typographical corrections), we will update the document without separate notice but will update the revision date.

If you do not agree with a material update to this Privacy Policy, you should discontinue use of the Service and close your account. Continued use of the Service after the effective date of updated Terms constitutes acceptance.

Previous versions of this Privacy Policy are archived at https://gcn.one/Pages/Privacy.

---

19. Supervisory Authorities

You have the right to lodge a complaint with the supervisory authority responsible for data protection in your jurisdiction. Contact details for key authorities:

We encourage you to contact us at privacy@gcn.one before lodging a complaint so that we may attempt to resolve your concern directly.

---

20. Glossary

---

© 2026 ORBCORE LTD. All rights reserved.