Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how auth.ink ("auth.ink", "we", "us", or "our") collects, uses, stores, shares, and protects personal information when you access or use our websites, products, infrastructure, software, platforms, and services (collectively, the "Services").

This policy applies across the auth.ink ecosystem, including League Hosting, Roaming, protected.cx, Edge Transit, Core, FortuneDB, and other services operated by auth.ink.

Individual products may have additional privacy notices describing how their specific features process personal information. Those notices supplement this policy.

1. Who We Are

auth.ink is operated by Tamir Awad, an individual trading as auth.ink, registered in Israel as an exempt dealer (osek patur).

Operator: Tamir Awad, trading as auth.ink
Address: Carmel 100, Daliyat el-Carmel 3005600, Haifa District, Israel
Phone: +972 50 395 4400
Privacy contact: [email protected]

We are responsible for personal information that we collect and determine how to use.

Where we process personal information on behalf of another business or customer, the responsibilities may be different, as described below.

2. Our Role in Processing Personal Data

2.1 When We Are the Controller

auth.ink generally acts as the data controller for information relating to:

• Customer accounts, registration, and authentication.
• Purchases, payments, receipts, and transaction history.
• Customer support and communications.
• Fraud detection and identity verification.
• Security monitoring and abuse prevention.
• Operation and management of our products.
• Our own websites, applications, and business activities.

We determine why and how this information is processed.

2.2 When We Process Data for Customers

Certain Services allow customers to host websites, applications, game servers, databases, networks, and other workloads.

These customers may independently collect personal information from their own users.

In these situations, auth.ink may act as a data processor or service provider on the customer's behalf.

Examples include:

• Personal information stored on customer VPS instances and hosting services.
• Player data collected by customer-operated game servers.
• Information managed through reseller or white-label services.
• Customer websites and applications protected by our network security services.
• Databases and systems that we host or manage for business customers.

The customer is generally responsible for determining the purposes of that processing, providing applicable privacy notices, and establishing an appropriate legal basis.

We may also process some of the same information independently for our own network security, fraud prevention, legal compliance, and infrastructure protection purposes.

Where applicable law requires a separate data-processing agreement, the relevant parties may enter into one.

3. Personal Information We Collect

The information collected depends on the Service you use.

3.1 Account Information

We may collect:

• First and last name.
• Username and display name.
• Email address.
• Phone number.
• Account identifiers.
• Connected third-party account identifiers.
• Account preferences and settings.
• Authentication information, such as password hashes, authentication tokens, or verification records.
• Account creation, modification, and closure information.

Not every product collects every category.

3.2 Billing and Transaction Information

When you purchase a Service, we may process:

• Billing name and contact information.
• Purchased products and plans.
• Transaction amounts, currencies, and timestamps.
• Payment status and transaction identifiers.
• Payment-provider references.
• Receipt and accounting records.
• Refund, cancellation, and chargeback information.
• Payment-related fraud indicators.
• IP addresses and technical information associated with transactions.

Payment details may be processed directly by third-party payment processors or merchants of record.

We do not ordinarily receive or store complete payment-card credentials.

3.3 Technical and Usage Information

Depending on the Service, we may collect:

• IP addresses and connection ports.
• User agents and browser information.
• Operating-system and device information.
• Login timestamps and authentication events.
• Requested URLs, including query parameters on some systems.
• API requests and response information.
• Network traffic and usage statistics.
• Bandwidth, CPU, memory, storage, and other resource usage.
• Service configuration and operational logs.
• Security alerts and diagnostic information.
• Approximate geographic information derived from IP addresses.

Some information is collected automatically when you access a Service, even if you do not register an account.

3.4 Communications and Support

We may retain:

• Support tickets and messages.
• Email correspondence.
• Chat conversations.
• Attachments.
• Technical information submitted for troubleshooting.
• Customer feedback.
• Complaint and dispute records.
• Internal notes and actions related to support requests.

Communications made through external messaging platforms may also be processed and retained by those platforms.

3.5 Identity Verification

Where reasonably necessary for fraud prevention, account recovery, payment disputes, security, or legal compliance, we may request identity-verification information.

This may include a government-issued identification document, photograph or selfie, proof of address, or proof of ownership of a payment method.

Verification documents are retained only for the relevant verification purpose and deleted when that purpose has been completed and the documents are no longer required.

Separate fraud, security, or transaction records may remain where necessary or legally required.

4. How We Use Personal Information

We use personal information for the following purposes:

We may combine information from different systems where reasonably necessary to detect abuse, prevent fraud, investigate incidents, or manage a customer's relationship with us.

We do not sell personal information.

5. Legal Basis for Processing

Our processing is governed primarily by the Israeli Protection of Privacy Law, 5741-1981, and applicable regulations.

Where the European Union General Data Protection Regulation (GDPR) or another privacy law applies, we rely on an appropriate legal basis for each relevant processing activity.

These may include:

Performance of a contract. Processing needed to create accounts, provide purchased Services, deliver products, provide support, and manage the customer relationship.

Legal obligations. Processing needed to comply with applicable accounting, tax, regulatory, and other legal requirements.

Legitimate interests. Where permitted by applicable law, processing reasonably necessary to prevent fraud, detect attacks, secure networks, investigate abuse, maintain infrastructure, and protect our business and customers, subject to the applicable balancing of interests and individual rights.

Consent. Where required by law, including certain optional processing or marketing activities.

Where we process personal data on behalf of another controller, the customer or other controller is generally responsible for establishing the appropriate legal basis for its processing activities.

5.1 Whether Providing Information Is Mandatory

Unless otherwise stated, you are generally not legally required to provide personal information merely because we request it.

However, certain information is necessary to create an account, complete a purchase, verify an identity, or provide a requested Service.

If you do not provide that information, we may be unable to provide the relevant feature or Service.

Some technical information, including IP addresses and security events, is automatically processed when a Service is accessed.

6. Product-Specific Data Processing

6.1 League Hosting

League Hosting provides game-server hosting, VPS hosting, Discord bot hosting, networking, and related infrastructure services.

In addition to general account and billing information, it may process:

• Server names, addresses, configurations, and resource limits.
• Console output and server logs.
• Files and databases stored by customers.
• Game-player usernames, IP addresses, and connection information.
• Backup information.
• Subuser accounts and permission assignments.
• API activity and administrative actions.
• Support messages and attachments.
• Service usage and billing history.

Customer-hosted files, databases, server logs, and application data generally remain under the control of the relevant customer.

AI-assisted support: Where an AI assistant is used, relevant customer messages and information accessed through assistant tools may be transmitted to an external AI-processing provider.

Depending on the customer's request and tools used, this can include server configuration, console output, files, technical logs, player names, IP addresses, and other information contained in the accessed material.

AI conversations and usage records may also be stored for support, troubleshooting, and operational purposes.

Support and operational communications: Some support conversations, ticket attachments, payment notifications, operational alerts, and transcripts are transmitted to restricted staff communication systems.

Certain payment-contact records may also be synchronized to a restricted repository operated through an external software-hosting service.

Retention in these systems may differ from retention in the main League Hosting application.

6.2 Roaming

Roaming provides travel eSIM services and VPN-related products.

For eSIM services, information may include:

• Destination country and purchased plan.
• eSIM identifiers and activation details.
• Data allowance and usage.
• Provisioning and activation status.
• Installation, activation, and expiration timestamps.
• Order history and delivery records.
• Information necessary to manage the eSIM lifecycle.

For VPN services, information may include:

• Selected country and exit point.
• Assigned tunnel and exit IP addresses.
• Connection timestamps.
• Cryptographic tunnel information.
• Data transferred in each direction.
• Subscription duration and usage limits.

We do not intentionally maintain browsing-history logs, DNS-query histories, or records of the content of successfully proxied VPN connections.

Temporary diagnostic records may contain the destination host and port where a connection fails.

The network providers carrying traffic may independently process information needed to provide connectivity and operate their networks.

Fraud prevention: Roaming may collect IP reputation information, browser and device characteristics, approximate IP-based location, transaction risk indicators, and account relationships.

This information may be used to detect fraudulent purchases, chargeback abuse, duplicate accounts, or other suspicious activity.

6.3 protected.cx

protected.cx provides DDoS mitigation, network traffic filtering, website protection, and related security services.

To operate these Services, we necessarily process network traffic and related technical information.

Depending on the protection features enabled, this may include:

• Source and destination IP addresses.
• Network ports and protocols.
• Connection and packet metadata.
• Traffic volume and timing.
• Packet characteristics and, where necessary, packet contents.
• Attack indicators and filtering decisions.
• Protocol-validation results.
• Blocked and permitted traffic statistics.
• Geographic information derived from IP addresses.
• Security rules, bans, and blackhole events.
• Customer configuration and API activity.

For protected game services, we may process live player identifiers, usernames, source IP addresses, connection information, and related session data.

For protected websites, we may process:

• Visitor IP addresses.
• Requested paths and HTTP methods.
• Browser and user-agent information.
• Protocol and TLS characteristics.
• Request timing and response information.
• Security-challenge results.
• Technical signals needed to distinguish automated or malicious traffic from legitimate visitors.

Some challenges may examine browser behavior, timing, proof-of-work results, or interaction with an on-screen challenge.

Packet inspection and captures: Our filtering infrastructure may inspect network packets and may maintain temporary rolling packet captures that include portions of traffic payloads.

Additional packet captures or attack evidence may be preserved for incident investigation, debugging, security research, abuse handling, or legal purposes.

Traffic and attack information may also be processed by our upstream network provider as part of providing network connectivity and large-scale attack mitigation.

6.4 Edge Transit and Network Services

Edge Transit and related services provide IP connectivity, routing, and network infrastructure.

We may process:

• Customer network and node identifiers.
• Public IP assignments and routing configuration.
• Underlying server and endpoint IP addresses.
• Network-interface identifiers and MAC addresses.
• Tunnel public keys.
• Virtual-machine identifiers.
• Firewall and routing rules.
• Bandwidth and traffic counters.
• Network events and diagnostic information.

This information is used to establish connectivity, manage routing, protect infrastructure, detect abuse, and troubleshoot technical problems.

Some traffic is processed through third-party upstream networks and infrastructure providers.

6.5 Core, FortuneDB, and Legacy Services

Core and FortuneDB are legacy auth.ink products. Existing Shield deployments may also remain operational.

Depending on the feature used, these systems may process:

• Account identifiers and authentication information.
• Connected server identifiers and configuration.
• Server agent heartbeats and status information.
• System and application logs.
• Technical diagnostics.
• Workflows and logic configurations.
• API keys and other credentials submitted for particular functions.
• Information submitted or generated through customer-managed integrations.

Some legacy data and system logs may remain stored for extended periods.

Where a customer enables a feature that requires access to a credential, secret, or plaintext value, that information may be processed by the relevant execution system as necessary to perform the requested operation.

We do not represent that every legacy feature provides end-to-end encryption or that we are technically unable to access all data processed by those features.

6.6 Consulting, Managed Services, and Customer Projects

Where we provide consulting, managed infrastructure, development, or other services for business customers, we may process information required to complete the agreed work.

This can include technical configurations, contact details, system logs, account information, operational records, and personal information that the customer authorizes us to access.

Where the customer determines the purpose and manner of processing its own users' data, we generally process that information on the customer's behalf.

6.7 Game Security and Anti-Cheat Features

Where game-security or anti-cheat functionality is operated or tested, technical information may be processed to detect suspicious gameplay or other prohibited activity.

This may include player identifiers, IP addresses, connection data, gameplay actions, timing information, protocol information, and suspected violation records.

The information may be used to investigate suspicious activity, generate alerts, or support enforcement by the relevant game-server operator.

7. Website, System, and Email Logs

Our websites and infrastructure generate operational logs.

Depending on the system, logs may include:

• IP addresses.
• Timestamps.
• Requested URLs, paths, and query parameters.
• HTTP methods and response codes.
• Browser user agents.
• Referrer information.
• Login and authentication events.
• Service errors.
• Security alerts.
• Mail sender and recipient information.
• Network and system diagnostics.

Some logged URLs may contain temporary identifiers or authentication-related parameters.

Our email infrastructure may also process message headers, delivery information, security events, spam indicators, and message content where needed for email delivery or filtering.

Email and spam-security systems may communicate with external reputation or filtering services, including through IP-address lookups or technical message indicators.

Logs are used for service operation, diagnostics, fraud prevention, security, and abuse investigation.

Their retention depends on the relevant system.

8. Cookies and Browser Storage

Our websites and applications use cookies, local storage, and similar technologies for operational purposes.

These may include:

• Authentication and login sessions.
• Security and anti-abuse controls.
• Website challenge and clearance tokens.
• Account and service preferences.
• Theme preferences.
• Remembering selected settings.
• Maintaining application functionality.

Some features may use session storage or local storage instead of cookies.

Analytics and Advertising

auth.ink does not currently use analytics or advertising tracking cookies across its Services.

We do not currently use third-party analytics services or advertising trackers for website visitor profiling.

Technical logs, security monitoring, operational statistics, and traffic analysis used to operate or protect the Services are separate from advertising analytics.

Third-party infrastructure and security providers may process technical information necessary to deliver or protect websites.

You can manage cookies and browser storage through your browser settings. Blocking essential storage may prevent certain features from functioning.

9. Automated Decisions and Security Enforcement

Some Services use automated systems to detect security threats, fraud, or abuse.

These systems may:

• Identify suspicious network traffic.
• Block malicious requests.
• Challenge website visitors.
• Apply network rate limits.
• Temporarily blackhole IP addresses.
• Restrict accounts or services.
• Flag transactions for additional verification.
• Identify suspected fraud or policy violations.

Decisions may be based on information such as traffic behavior, connection patterns, IP reputation, transaction characteristics, technical indicators, and security rules.

An automated decision can result in temporary or permanent restriction of a Service.

If you believe an automated decision affecting your account or Service is incorrect, you may contact support or [email protected] to request human review.

We may withhold specific detection methods or security indicators where disclosing them would materially undermine security or fraud-prevention controls.

Where applicable law provides additional rights concerning automated decisions, those rights apply.

10. Marketing and Communications

We send operational communications necessary for our Services, including:

• Receipts and payment confirmations.
• Account verification messages.
• Security alerts.
• Maintenance notices.
• Service-status information.
• Support replies.
• Billing and suspension notices.

These are service-related communications.

We may also send promotional communications where permitted by applicable law, including under a valid existing-customer exception or where the required consent has been obtained.

Marketing emails include an unsubscribe mechanism.

You may opt out of marketing communications at any time using the unsubscribe mechanism or by contacting us.

Unsubscribing from marketing does not prevent us from sending necessary service, billing, legal, or security notifications.

11. Sharing Personal Information

We do not sell personal information.

We may share personal information with third parties where reasonably necessary to provide Services, operate our business, or comply with legal obligations.

The categories of recipients include:

Payment and accounting providers: To process transactions, issue receipts, maintain accounting records, and handle refunds or payment disputes.

Hosting and infrastructure providers: To store data, operate servers, provide network connectivity, maintain systems, and deliver Services.

Network and security providers: To deliver DDoS mitigation, route network traffic, protect websites, provide connectivity, and detect attacks.

Connectivity and telecommunications providers: To provision eSIM services, provide mobile connectivity, manage usage, and deliver related services.

Email and communications providers: To deliver email, send notifications, provide customer support, and maintain staff communication systems.

AI-processing providers: Where AI-based assistance is used, to process customer requests and information retrieved by authorized assistant features.

Fraud-prevention and reputation providers: To assess IP addresses, detect payment fraud, investigate suspicious activity, and protect network reputation.

Software-hosting and operational service providers: For development operations, system management, internal records, and certain restricted operational data.

Professional advisers: Where reasonably necessary for accounting, legal advice, financial matters, or business operations.

Public authorities and law enforcement: Where disclosure is required by a valid legal obligation or otherwise permitted by applicable law for reporting serious unlawful activity or protecting rights and safety.

Third-party providers may independently act as controllers of information that they process for their own legally permitted purposes.

Their own privacy notices may apply to those processing activities.

12. International Data Processing

auth.ink operates from Israel, but personal information may be stored, transmitted, or processed outside Israel.

Depending on the product and the provider involved, this may include Germany, the United States, and other countries.

Examples include international cloud infrastructure, payment services, communication systems, AI-processing services, software-hosting systems, and telecommunications providers.

Not every Service stores or transfers the same categories of information.

International transfers are subject to the applicable legal requirements, including the Israeli rules governing the transfer of personal information abroad and relevant GDPR requirements where applicable.

Where required, transfers must rely on an applicable legal transfer mechanism or safeguard.

You may contact [email protected] for information about the transfer arrangements applicable to your personal information.

13. Data Retention

We retain personal information for as long as reasonably necessary for the purposes for which it is processed, subject to applicable legal requirements.

Retention differs by product, system, and type of information.

13.1 Account Information

Account information may remain stored while your account exists.

After account closure, certain information may remain where necessary for legal compliance, fraud prevention, security, accounting, disputes, or maintaining the integrity of our systems.

13.2 Transactions and Accounting

Transaction and accounting records are retained for the periods required by applicable law and, where justified, for the handling of disputes, audits, or legal claims.

Closing an account does not automatically remove transaction records.

13.3 Technical and Security Logs

Technical logs may be automatically rotated or overwritten according to the relevant system's configuration.

Some logs are retained only briefly, while other operational, security, audit, or abuse records may be retained for longer periods.

Records associated with ongoing security incidents, fraud investigations, disputes, or legal matters may be preserved for as long as reasonably necessary.

13.4 Support and Communication Records

Support tickets, email correspondence, staff communication records, transcripts, and related attachments may remain stored after a ticket is closed or a Service has ended.

Some external communication platforms retain messages independently of our primary application databases.

13.5 Network and Attack Data

Network statistics, website challenge logs, and traffic records have different retention schedules.

Some information is stored temporarily and automatically overwritten.

Certain security records, attack evidence, manually preserved packet captures, audit logs, and related information may remain stored for extended periods where necessary for security, investigations, or legal purposes.

13.6 Backups

Backups containing personal information are subject to internal retention and automatic rotation or deletion schedules.

The schedules may differ between Services and backup systems.

We do not guarantee that information deleted from an active system will disappear immediately from every backup. Remaining copies are removed as the applicable backup retention cycle completes, subject to any legal preservation requirement.

13.7 Identity Verification

Identity-verification documents are deleted after the relevant verification purpose has been completed and the documents are no longer needed.

Separate records required for fraud prevention, legal compliance, or financial disputes may remain.

13.8 Deletion Reviews

We may delete, de-identify, or aggregate information when it is no longer necessary.

Where applicable law requires information to be deleted earlier, we will comply with that requirement.

14. Account Closure and Data Deletion

You may request account closure or deletion of eligible personal information by contacting [email protected].

Some products may also provide account-deletion functionality through their own account settings.

14.1 What Happens When an Account Is Closed

Depending on the Service, we may:

• Disable the account.
• Revoke active sessions and access credentials.
• Remove or replace identifying account information.
• Delete information no longer needed.
• Retain certain records needed for bookkeeping, security, legal obligations, or system integrity.

Account closure does not necessarily result in the deletion of every associated record.

14.2 Information We May Need to Keep

Certain records may remain identifiable where necessary, including:

• Transaction records.
• Billing names and contact information.
• Accounting records.
• Fraud and chargeback evidence.
• Security and abuse records.
• Records needed for legal claims or compliance.

We may partially de-identify an account while retaining a record linking historical transactions or security events to an identifiable person.

Such information remains personal information where it can still be linked to an identifiable individual.

14.3 Customer-Hosted Information

If your personal information is stored by one of our hosting customers or other customer-controlled Services, that customer may be responsible for responding to your request.

We may direct you to the relevant controller or assist that controller where appropriate.

15. Your Privacy Rights

Depending on the law applicable to you, you may have rights concerning your personal information.

These may include:

• Requesting access to personal information held about you.
• Requesting correction of information that is inaccurate, incomplete, unclear, or outdated.
• Requesting deletion where the law provides that right.
• Requesting restriction of processing in applicable circumstances.
• Objecting to certain processing, including direct marketing.
• Requesting data portability where applicable.
• Withdrawing consent where processing relies on consent.
• Requesting human review of certain automated decisions where applicable law provides that right.

Not all rights apply to every processing activity or jurisdiction.

15.1 Submitting a Request

Send privacy requests to:

[email protected]

We may ask for information reasonably necessary to verify your identity before fulfilling a request.

This protects against unauthorized access to another person's information.

We will respond within the timeframe required by applicable law.

15.2 When Requests May Be Limited

We may refuse, restrict, or partially fulfill a request where permitted or required by law, including where:

• We cannot reasonably verify the requester.
• Information must be retained for legal or accounting obligations.
• Disclosure would expose another person's information.
• A request would compromise security or fraud-prevention methods.
• Information is required for an ongoing legal claim or investigation.
• Another legally recognized exception applies.

Where required by law, we will explain the reason for the refusal or limitation.

15.3 Complaints

You may raise concerns directly with us at [email protected].

You may also contact the Israeli Privacy Protection Authority or another competent data-protection supervisory authority where applicable law gives you that right.

16. Information Security

We use technical and organizational measures intended to protect personal information against unauthorized access, disclosure, alteration, destruction, and other security risks.

Depending on the relevant Service, these measures may include:

• Authentication and access controls.
• Encrypted network connections.
• Restrictions on administrative access.
• Network filtering and DDoS protection.
• Security monitoring and logging.
• Abuse and intrusion detection.
• Account and credential security controls.
• Backup and recovery procedures.

Security measures differ between systems and Services.

We do not guarantee that every system uses the same security measures or that all information is encrypted at rest.

No system can be guaranteed completely secure.

Despite reasonable security efforts, unauthorized access, technical failures, human error, or other security incidents may occur.

17. Personal Data Breaches

If we identify and confirm a personal-data breach, we will investigate the incident and take appropriate steps to contain and address it.

We will notify affected users of confirmed personal-data breaches involving their information, including incidents for which individual notification is not otherwise mandatory, where we can reasonably identify and contact those affected.

Notifications will be provided as soon as reasonably practicable after the incident has been sufficiently assessed, subject to applicable legal restrictions and any need to avoid compromising an active investigation or security response.

Where required by law, we will notify the relevant supervisory authority.

Notifications may include information about the nature of the incident, the information affected, measures taken, and steps users may take to protect themselves.

18. Children's Privacy

auth.ink generally permits use of applicable Services by people aged 13 or older, subject to the eligibility requirements in our Terms of Service.

Individual products may require a higher age.

Where parental or guardian permission is legally required, the relevant permission must be obtained.

If we determine that an account was created or information was provided by a person below the applicable minimum age without required permission, we may restrict or close the account and delete information where appropriate and legally permitted.

Some Services process data about visitors or end users of customer-operated websites, networks, and game servers. This can include minors who do not directly hold an auth.ink account.

Where we process that information on behalf of a customer, the customer is generally responsible for satisfying the applicable requirements relating to its own users.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The current version will be published on our website with its last updated date.

We do not routinely provide individual notifications of changes to this policy.

Where applicable law requires additional notice, information, or consent, we will comply with those requirements.

20. Governing Framework

This Privacy Policy is intended to describe our data-processing practices under the Israeli Protection of Privacy Law, 5741-1981, and applicable regulations.

Other laws, including the GDPR, may apply to particular processing activities depending on the circumstances.

Nothing in this policy removes or restricts privacy rights that applicable law does not permit us to exclude.

21. Contact

For privacy questions, data access requests, corrections, deletion requests, or other privacy matters:

Email: [email protected]

Operator: Tamir Awad, trading as auth.ink
Address: Carmel 100, Daliyat el-Carmel 3005600, Haifa District, Israel
Phone: +972 50 395 4400
Website: auth.ink