Privacy Policy

Who we are#

LonexOne is run by LonexLabs, based in England. This policy explains what personal information LonexOne collects, why, who it's shared with and what your rights are.

If you have a question or want to use any of your rights, email [email protected].

Our two roles#

For LonexOne accounts and billing, we're the controller. This covers your sign-in, your account and what community owners pay us. We decide how this information is used.

For a community's own data, the community is the controller and we're its processor. This covers its roster, records, applications, game data, website and so on. The community's owner and staff decide what is collected and how it's used, and we store and process it for them under our terms.

So if your question is about what a community holds on you, ask that community first. We'll help them answer it.

What we collect#

your Discord user ID, username, display name and avatar, or your Google account ID, name and email address
your email address, if Discord or Google shares it with us
the communities you belong to, and the roles and departments you have in them

When a community pays us#

the owner's name, email address and billing details, and the invoices and payments on the account
card details are collected and held by Stripe. We never see or store your full card number.

When you use a community#

Communities use LonexOne to record things like:

applications you submit, and the answers you give
your roster entry, rank, callsign, department, shifts, leave, training records, certifications and disciplinary notes
in-character characters, records, reports and calls in the CAD
support tickets, reports, appeals, suggestions and messages
anything you post on a community's website

From game servers#

If a community runs the LonexOne FiveM resource, its servers send us:

your player name and the identifiers FiveM provides, such as your Rockstar licence, Discord ID and Steam ID
the hardware tokens FiveM provides, which communities use to enforce bans
your in-game position while you're on duty, for the live map
when you join and leave, time on duty, and game events the community chooses to log

From Discord servers#

If a community connects its Discord server, our bot can see that server's members and their roles. This lets the community sync roles and post logs. For training sessions, it can also record who was in a voice channel and for how long, to take attendance.

Automatically#

your IP address, browser type and the pages you request, in our server logs
the date and time you sign in, and security events on your account
the IP address on some actions, in a community's audit log, so its staff can investigate misuse

How we use it#

We use your information to:

sign you in and keep your account secure
run the features your community uses
charge community owners and keep our accounts
reply when you contact us
prevent abuse, fix problems and keep LonexOne running well
tell community owners about changes to the service or their account

We don't sell your personal information. We don't use it for advertising, and we don't use it to train AI models.

Our legal reasons#

Under UK GDPR we must have a lawful basis for using your information:

Contract: to provide the account and service you or your community signed up for.
Legitimate interests: to keep LonexOne secure, prevent abuse, improve the service and support communities. We balance these against your rights.
Legal obligation: to keep billing records and respond to lawful requests.
Consent: where we ask for it. You can withdraw it at any time.

For a community's data, the community decides its own lawful basis.

We use these providers to run LonexOne. They only process your information on our instructions:

Stripe: payments and invoices
Discord: sign-in, the bot, and messages and logs sent to Discord servers
Google: sign-in, if you choose it
Cloudflare: network security, caching and custom domains
Our hosting provider: servers and backups
Our email provider: sending account and community emails
Anthropic: when someone uses an AI feature, such as the CAD narrative helper, the text they submit is sent to Anthropic to produce a reply
Tebex: only for communities that connect their Tebex store, to show purchases and packages

Within a community, the people that community gives access to can see your information there. For example, department supervisors can see their roster. Communities can also publish some information on their public website.

We may also share information:

if the law requires it
to protect people from harm or LonexOne from fraud or abuse
as part of a sale or merger of LonexLabs, in which case we'd tell you first

International transfers#

Some of our providers, such as Stripe, Discord, Google, Cloudflare and Anthropic, process information outside the UK, mainly in the United States. Where this happens, we rely on UK adequacy regulations or the UK's approved contract clauses to protect it.

How long we keep it#

Account information: kept while your account is open. It's deleted when you close your account, except where we need to keep it for a reason below.
Community data: kept while the community is active. If a community is closed, its data is deleted after the 30-day export window in our terms.
Game event logs: kept for the period each community sets, then deleted automatically.
Server status samples: deleted after 30 days.
Billing records: kept for 6 years, because UK tax law requires it.
Server logs: kept for a short time for security and fixing problems.
Backups: deleted data is removed from backups as they expire.

Cookies#

LonexOne sets only the cookies it needs to work:

a session cookie that keeps you signed in
a security cookie that protects forms from cross-site request forgery

We don't use advertising or tracking cookies, so we don't show a cookie banner.

A community's website may include content from other services, such as embedded videos or its Tebex store. Those services may set their own cookies.

Your rights#

Under UK GDPR, you can ask us to:

give you a copy of your information
correct information that's wrong
delete your information
limit how we use it, or object to how we use it
give you your information in a format you can take elsewhere

Email [email protected] from the address on your account. We'll reply within one month. We may need to check it's you before we act.

For information a community holds, contact that community. If they don't respond, contact us and we'll help.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We'd like the chance to put it right first, though.

Children#

LonexOne isn't for anyone under 13. If we find out that a child under 13 has an account, we'll delete it. If you think this has happened, tell us.

Security#

We protect your information with encrypted connections, access controls and regular backups. Community data is kept separate between communities. No system is perfectly secure. If a breach puts your rights at risk, we'll tell you and the regulator as the law requires.

Changes to this policy#

When we change this policy, we'll update the date at the top. If a change matters, we'll also tell community owners by email or in the control panel.