Privacy Policy

1. What Data We Collect

We collect only the minimum data necessary to provide the service:

• Account data: When you register, we collect your name, username, and email address.
• Password: Stored as a one-way bcrypt hash — we cannot read your password.
• Subscription data: If you subscribe, we store your plan type, subscription status, and start/end dates. Payment processing is handled entirely by Viva Wallet — we do not store card numbers or payment details.
• Usage data: Pages visited, filters applied, features used, and session timestamps. This data is used to improve the platform and is not tied to advertising profiles.
• Technical data: Your IP address (for rate limiting and security), browser type, and device type collected automatically via server logs.
• Communications: If you contact us via the contact form, we store your name, email, and message content to respond to your enquiry.

2. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Contract (Art. 6(1)(b)): Processing necessary to provide the GoalCodex service you have signed up for, including account management and subscription handling.
• Legitimate interests (Art. 6(1)(f)): Security logging, rate limiting, fraud prevention, and aggregate server-side usage statistics to improve the platform.
• Legal obligation (Art. 6(1)(c)): Retention of financial records as required by Greek and EU tax law.
• Consent (Art. 6(1)(a) GDPR and Art. 4(5) of Greek Law 3471/2006): Optional communications, and the optional analytics and advertising cookies described in Section 5 (Google Analytics and Google Ads, and Google AdSense if and when we enable it). We set these only after you accept them in our cookie banner. You may withdraw consent at any time with the “Cookie settings” link in the footer, without affecting processing that took place before.

3. How We Use Your Data

• To create and manage your GoalCodex account
• To process and manage your subscription via Viva Wallet
• To send transactional emails (email verification, password reset, subscription confirmations)
• To respond to support enquiries submitted via the contact form
• To detect and prevent abuse, fraud, and unauthorised access
• To improve platform features based on aggregate, anonymised usage patterns

We do not sell your personal data, and we do not give it to third parties for their own marketing. The only advertising-related data collection on GoalCodex happens through the optional Google cookies described in Sections 4 and 5, and only if you accept them.

4. Third-Party Services

We use a limited number of third-party services to operate the platform:

• Viva Wallet — payment processing for subscriptions. Your payment details are entered directly on Viva's PCI DSS-compliant systems. We receive only confirmation of successful payment and a subscription identifier.
• Zoho Mail — transactional email delivery (verification emails, password resets, receipts). Email addresses are transmitted to Zoho solely for the purpose of sending these messages.
• Google Analytics (GA4) — measures how the site is used: pages viewed, approximate location, device and browser type, and the referring site. It runs only if you accept analytics cookies, and IP anonymisation is enabled. You can also opt out with the Google Analytics opt-out browser add-on.
• Google Ads (conversion measurement) — lets us see whether visits that began with one of our Google Ads campaigns lead to a sign-up or a subscription. It runs only if you accept advertising cookies. We send Google the conversion event (for example “account created” or “subscription purchased”, with its value), not your name, email address or payment details.
• Google AdSense — advertising service. We may display ads served by Google AdSense to visitors who are not subscribers. As of the date of this policy AdSense is not yet active on GoalCodex; the AdSense cookies in Section 5 apply only from the day we enable it, and only if you consent. When it serves ads, Google acts as an independent controller under its own privacy policy.
• DigitalOcean — our hosting provider. Servers are located in the European Union (Amsterdam). DigitalOcean processes server logs as a data processor acting on our behalf.

Google Analytics, Google Ads and Google AdSense are provided by Google Ireland Limited for users in the EEA and Switzerland, and by Google LLC (USA) elsewhere. Google may process data in the United States and other countries; these transfers rely on the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.

5. Cookies, Browser Storage and Advertising

GoalCodex uses cookies and similar technologies (small files and entries stored in your browser). Strictly necessary items are always active because the service cannot work without them. Everything else is optional: Google Analytics and Google Ads cookies are set only after you click “Accept” in our cookie banner, and nothing is loaded from Google before that. You can change your choice at any time with the “Cookie settings” link in the footer of every page.

Strictly necessary (always active)

• PHPSESSID — GoalCodex, cookie. Keeps you signed in and protects our forms. Deleted when you close your browser; the server also ends a session after 60 minutes of inactivity.
• gcx_consent_v1 — GoalCodex, browser storage. Remembers your cookie choice for up to 12 months, after which we ask again.
• Session storage — GoalCodex, browser tab storage holding entries such as a country filter or a search term you just entered. Used only to carry your selection from one page to the next; cleared when you close the tab.

Analytics (optional, with your consent)

• _ga — Google Analytics, cookie, 2 years. Distinguishes visitors so that we can count them.
• _ga_MCQ92SYF45 — Google Analytics, cookie, 2 years. Keeps the state of a visit (a session).

Advertising measurement (optional, with your consent)

• _gcl_au — Google Ads conversion linker, cookie, 90 days. Lets us see whether a visit that began with one of our Google Ads campaigns leads to a sign-up or subscription.
• _gcl_aw / _gcl_dc — Google Ads, cookies, 90 days. Set only if you arrive through a click on one of our Google ads.
• _gcl_ls — Google Ads, browser storage. Supports the same conversion measurement.

Google AdSense (optional, with your consent — only if and when we enable it)

• __gads / __gpi — Google advertising cookies (and related ones), up to 13 months. Used to deliver and measure ads, limit how often you see the same ad and prevent fraud. In the EEA, the UK and Switzerland, personalised advertising is used only with your consent.

Advertising on GoalCodex

Visitors without an account and Free accounts see promotional banners. Today these are our own banners promoting the Fan and Pro plans; they do not use cookies and do not share data with anyone. We may also display ads served by Google AdSense; as of the date of this policy that is not active, and the AdSense cookies above apply only from the day we enable it. Fan and Pro members and administrators never see ads.

Your choices

• Use the “Cookie settings” link in the footer to accept or decline the optional cookies at any time. Declining after accepting deletes the Google cookies from your browser.
• You can also block or delete cookies in your browser settings. Blocking the strictly necessary cookie will prevent you from signing in.
• Google’s own tools: the Google Analytics opt-out add-on, Google Ad Settings, how Google uses information from sites that use its services, and Your Online Choices.

6. Data Retention

• Account data: Retained for as long as your account is active. If you delete your account, personal data is removed within 30 days, except where retention is required by law.
• Financial records: Subscription and payment records are retained for 10 years as required by Greek tax law.
• Server logs: IP-level access logs are retained for up to 90 days for security purposes, then deleted.
• Contact form messages: Retained for up to 12 months, then deleted unless ongoing correspondence requires longer retention.
• Analytics data: Held in Google Analytics for up to 14 months, then deleted automatically. Cookie lifetimes are listed in Section 5.

7. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction: Request that we limit how we use your data while a dispute is resolved.
• Right to data portability: Receive your personal data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing. For cookies, use the “Cookie settings” link in the footer.

To exercise any of these rights, contact us at info@goalcodex.com. We will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

8. Data Security

All data is transmitted over HTTPS (TLS). Passwords are hashed using bcrypt and are never stored in plain text. Access to the production database is restricted to authorised personnel via SSH key authentication. We apply the principle of least privilege: each part of the system accesses only the data it needs. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the HDPA within 72 hours as required by GDPR Article 33.

9. Children's Privacy

GoalCodex is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has registered without parental consent, please contact us and we will delete the account promptly.

10. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email. Continued use of GoalCodex after a policy update constitutes acceptance of the revised terms.

11. Contact

For any privacy-related questions or to exercise your data rights, contact us at info@goalcodex.com or use the contact form. We aim to respond to all requests within 5 business days.