Privacy Policy

Abhijot Singh under the brand name "GGX Labs" is the operator and publisher of ggxlabs.in and the GGX Labs online services described on the platform. Our primary privacy and data-processing contact is [email protected].

Where an invoice, order confirmation, service agreement, or other commercial document identifies a specific contracting entity, that document controls for the relevant transaction.

We process personal data in accordance with the laws that are applicable to the relevant processing activity and user. For processing to which Indian law applies, this includes the Digital Personal Data Protection Act, 2023 and applicable rules and notifications made under it.

GGX Labs uses a minimum service age of 13. That service-eligibility rule does not change the legal definition of “child” in any jurisdiction. In India, for example, a child is an individual who has not completed 18 years of age.

• Account data: email address, account/session identifier, authentication provider, role, and security settings.
• Security and session data: IP address, approximate location, browser/device information, user-agent, session timestamps, request metadata, and abuse/security indicators.
• Order and service data: name, email, phone number, selected service, website type, requirements, reference website, currency, quoted amount, payment status, and transaction identifiers.
• Refund data: order ID, refund reason, contact details, payment reference/proof, verification information, and refund status.
• Tool data: lookup inputs and usage information necessary to provide diagnostics, domain, DNS, IP, security-header, infrastructure, or related services.
• Support data: information voluntarily provided through contact, refund, service, or support workflows. Service-specific credentials or access information, when genuinely necessary for delivery, should be provided only through an approved secure mechanism and not through ordinary support or refund messages.
• Privacy-choice data: consent category selections, consent version, and timestamp stored in the browser for optional technologies.

• Provide, authenticate, secure, maintain, and improve services.
• Manage accounts, sessions, security controls, and customer access.
• Process orders, payments, invoices, refunds, support requests, and service delivery.
• Prevent fraud, abuse, account takeover, malicious automation, and security incidents.
• Operate infrastructure, diagnose failures, monitor reliability, and investigate incidents.
• Measure website usage through optional analytics where enabled.
• Comply with legal, tax, accounting, dispute-resolution, and enforcement obligations.

Optional analytics on the current main site is consent-gated: the analytics script is not loaded until the visitor enables analytics.

See the Cookie Policy for the current consent mechanism and technology categories.

Analytics may process pages viewed, traffic source, approximate location, browser/device characteristics, and interactions. Google processes information under its own terms and privacy documentation.

The current main-site ad component layer does not intentionally activate third-party advertising scripts. Legacy Monetag compatibility exports are disabled. If advertising is re-enabled, GGX Labs will review the provider, update the applicable privacy disclosures, and apply the site's advertising-consent controls where required.

Other third parties may support hosting, CDN delivery, authentication, security verification, payments, email, monitoring, analytics, or other platform functions. They receive information relevant to the function they provide or as otherwise permitted by law.

In jurisdictions where targeted advertising disclosures are treated as sale or sharing, applicable controls and rights will be provided as required.

Account, payment, refund, support, analytics, and security data may have different retention periods. When an authenticated user starts account deletion, the account is first deactivated and all active GGX Labs sessions are invalidated. The account remains recoverable for 30 days through the account-reactivation process. If the account is not reactivated during that period, GGX Labs permanently removes the user account and private account data within its control through the applicable deletion workflow. Forge order records and API financial records are not deleted solely because the account is deleted. These records may be retained in protected or de-identified form for payment verification, refunds, accounting, reconciliation, fraud prevention, dispute handling, service records, or other legitimate retention purposes. Forge customer-identifying fields are anonymised, and private Forge delivery artifacts controlled by GGX Labs are scheduled for deletion as part of the permanent cleanup. API financial records such as orders, subscription history, purchased-credit ledgers, and related payment records are moved out of the deleted account's active namespace into a restricted financial-retention record so that a future account using the same email address does not inherit the previous account's financial history or credit balance. Operational API credentials, active sessions, pending authentication records, connected-account credentials/tokens, and other private account-scoped data are removed or de-identified as applicable. The current operational-log lifecycle archives records after 15 days and retains archived log copies for up to 90 days, subject to the archive job and provider availability. Source logs are configured for deletion after successful archive verification. Archived or other backup copies may persist until their scheduled expiry where immediate record-level deletion is not technically practicable; such copies are access-restricted and are not restored except as needed for disaster recovery, security, legal, or operational purposes. Some security records may be retained in protected or anonymised form for fraud, abuse, incident-response, or legal purposes.

No online system can be guaranteed completely secure. Never submit passwords, OTPs, recovery codes, CVVs, or full payment credentials through support or refund workflows.

Authenticated users can start account deletion from Account Settings. The workflow first deactivates the account for a 30-day recovery period and signs the user out across active sessions. Permanent cleanup then removes the user account and private account-scoped data under GGX Labs control. Forge orders and API financial records are retained rather than deleted; identifying fields are anonymised or detached from the active account as applicable. Operational API credentials, session records, pending authentication records, and connected-account credentials/tokens are removed. Connected providers and payment processors may independently retain records under their own terms, policies, or legal obligations.

We may verify identity before disclosing, correcting, or deleting personal data. Where a request is governed by GDPR or a substantially similar law, GGX Labs will handle it within the applicable statutory period; under GDPR, requests are generally addressed without undue delay and within one month, subject to permitted extensions. Other jurisdictions may impose different deadlines. Where a request concerns information that must be retained by law or is held by an independent third-party provider, GGX Labs may instead explain the applicable retention or redirect the requester to the relevant provider where appropriate.

GGX Labs operates internationally and does not assume that one country's privacy rules apply to every user or processing activity. Where a jurisdiction-specific right or mechanism applies, GGX Labs will use the applicable legal standard rather than treating this public baseline as a waiver of local rights.

GGX Labs does not currently describe itself as selling or sharing personal information for cross-context behavioral advertising. If that changes and a jurisdiction such as California requires opt-out controls, the applicable “Your Privacy Choices” or equivalent mechanism will be provided and integrated with the relevant processing. Applicable opt-out preference signals will be handled where the law requires.

GGX Labs permits use of its services by individuals aged 13 or older. Individuals under 13 are not permitted to create or use a GGX Labs account or otherwise use account-based services.

For India-facing processing, a child currently means a person who has not completed 18 years of age under the DPDP framework. Therefore, users aged 13 through 17 may still receive child-specific protections under applicable Indian data-protection requirements. The signup flow requires a self-confirmation of the minimum service age, but that confirmation is not itself verifiable parental or lawful-guardian consent. Where applicable law requires additional consent, verification, or restrictions before processing, GGX Labs may require those steps or restrict the relevant use until the requirement is satisfied.

GGX Labs does not intentionally target children with behavioural tracking or targeted advertising. Where child-specific consent, age assurance, or other safeguards become legally required for a processing activity, GGX Labs may require those steps before that processing occurs. A parent, guardian, or user who believes child data was processed improperly can contact the privacy address above for review.