Privacy notice
Version 2026-09-27.3Controller and contact
The controller for providing and administering PanKoLink is the sole trader ΠΑΝΩΡΙΑΣ ΧΡΗΣΤΟΣ (Anymath Digital), Greek tax number 150973012, IONIAS 16, 54453 THESSALONIKI, GREECE. For personal-data questions and rights: contact@pankolink.com or +30 6982691340. Organisations using the service for their own purposes remain responsible for the processing they determine. A separate processing agreement is required where the parties’ actual roles call for one.
Account, device and operation
We process an internal account ID and verified Auth0 identity, timestamps, plan entitlements, device number and public key, device name/account link and acceptance settings. Auth0 sign-in uses email or Google. The private device key is protected locally. Connection handling involves processing and temporarily storing session identifiers, permission and presence states, credential hashes and encrypted setup and signalling messages. We also process necessary network metadata. These are distinct from the screen, audio, video, chat and file content transmitted during a session. Purposes are fulfilling your requested function, recognising authorised devices and security. Bases are contract performance (GDPR Article 6(1)(b)) and, where no corresponding contract exists or for abuse prevention, the legitimate interest in safely operating and protecting the service and its users (6(1)(f)), subject to proportionality.
Local storage and choices
The app and file bridge store language, necessary settings and terms acceptance locally, including document version, integrity hash, language and acceptance time. This avoids repeated prompts and records your choice. The Windows receipt is protected within your user account; the browser uses local or session storage. You can delete local data, after which acceptance may be requested again. This necessary storage does not enable advertising tracking or optional analytics.
Private sessions and file bridge
Screen, audio, video, chat, directly transferred files, clipboard text transferred on an authorized controller’s action, and control commands are encrypted using WebRTC between participants. Cloudflare Realtime TURN may relay encrypted traffic when necessary without the relay decrypting its content. The connection function does not create stored chat histories, session recordings or files available for later download in our infrastructure. This does not exclude temporary technical copies needed for transmission or the processing and temporary storage of connection information and encrypted signalling messages described above. Participants and network providers may see network addresses, traffic timing and volume. Built-in recording requires participant approval and is stored locally on the recording participant’s device, not in the service. Technical approval does not replace the information, legal basis and permissions required for recording. Files others have received and local recordings remain under their control. This release does not include phone-to-computer remote control.
External WeTransfer service
The WeTransfer option opens the external website in your browser. Selecting the option alone does not upload files, create a transfer or send file content from PanKoLink to WeTransfer. If you continue there, the files and information you choose to submit are processed according to that external service’s functions, terms and privacy notice. As with any website visit, the external provider receives the technical data your browser sends for the visit. PanKoLink does not manage the storage, download links, expiry or deletion of those external transfers.
Optional analytics and local storage
Optional analytics are off by default and rely on your consent (6(1)(a)). They include a hashed installation ID, first/last use, app version, operating system and a limited list of feature/success events. They exclude file content and names, chat, keystrokes, images and audio. Disabling withdraws consent and requests removal of the installation and related events; it does not affect the lawfulness of earlier processing. The app stores settings and necessary credentials locally. Sign-in and infrastructure use necessary storage mechanisms. Public pages do not add advertising tracking. Necessary security processing is not presented as optional consent in exchange for access.
Notices, support and legal requests
When you contact us or report an incident, we process the information you supply, an available identifier or link, the incident time, explanation, good-faith statement, case reference, handling, reasons and notifications. We do not require a name or email for reports of child sexual abuse or exploitation. We do not request attachments containing suspected material. Bases are responding to the request, legitimate interests in safe operation and establishing or defending rights, and compliance with a specific legal duty (6(1)(c)) where applicable. Special-category data and criminal-offence information are subject to additional legal restrictions. Avoid unnecessary sensitive data. Receiving a report does not mean that we can access the content of a private session or files held by another service, or that we accept the allegation as fact. Restrictions are decided by a human, not solely by automated means.
Recipients and international processing
Recipients of session or direct-transfer content are the participants and recipients you select through the connection’s functions. Necessary operational data involve hosting and network providers (ChatGPT Sites and Cloudflare), Auth0 for sign-in, Google when you select Google sign-in, and Google/Cloudflare STUN services for connectivity. TURN relaying is described in the private-sessions section. Use of the external WeTransfer service is described separately above. Access to data we manage is limited to what is necessary for support, security or legal duties with appropriate restrictions. Real Stripe payments are not active. Depending on the service and its configuration, data may be processed outside the EEA. We do not claim exclusively Greek or EU storage. You can request specific recipient, processing-location and applicable transfer-safeguard information at contact@pankolink.com. Disclosure to authorities requires an applicable lawful basis and is limited to what is necessary.
Retention
Temporary session, connection-state and encrypted signalling-event records have short technical expiry periods depending on the function and are cleaned up from the infrastructure. Expiry of an invitation or session does not mean every technical deletion finishes at that exact time. Analytics events become eligible for cleanup after 90 days, and usage/billing events after 400 days where present. Accounts and linked devices are retained as needed for the service relationship; signing out or unlinking a device is not account erasure. Withdrawn device numbers remain reserved to prevent reassignment. Report records and strictly necessary details are retained as needed for review, notification, reconsideration or a specific legal claim/duty, and reviewed for deletion or minimisation. Any preservation of evidence available to us is limited to the particular case and lawful need; it does not entail general recording of private sessions. Retention of delivered files and local recordings depends on the device holder. Transfers you create in WeTransfer are subject to that external service’s retention periods and choices. These periods must not be confused with unverified provider backup or technical-log retention periods.
Rights and requests
Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent. Send requests to contact@pankolink.com. We verify identity only as necessary and do not unjustifiably demand an identity-document copy. We respond within the legal deadline, normally one month, and explain any permitted extension. Erasure may be limited by a legal retention duty or legal claims; we explain the reason and restrict processing accordingly. You may complain to the Hellenic Data Protection Authority (dpa.gr) or your competent supervisory authority. Where data are necessary for a particular function, that function cannot be provided without them; optional analytics are not a condition of use.