Privacy Policy

Last updated: 19 June 2026

network.io is operated from the United Kingdom. This notice explains what personal data we collect about you, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to all users of networkio.app and is issued under UK GDPR and the Data Protection Act 2018.

1. Who we are

network.io (“we”, “us”, “our”) is a web platform that allows Discord community servers to publish events publicly, collect RSVPs, and sell event tickets. The platform is available at networkio.app.

Data controller: The operator of network.io, contactable at stan.network.io@gmail.com.

We do not currently have a designated Data Protection Officer (DPO). All data protection queries should be directed to the email address above.

2. What personal data we collect

We collect the following categories of personal data, depending on how you use the platform:

Discord account data

Your Discord user ID, username, display name, and profile picture URL. Collected when you sign in via Discord OAuth.

Email address

The email address associated with your Discord account. You may also provide a separate notification email address if you want event reminders sent elsewhere.

RSVP and attendance data

Which events you RSVP'd to, the date and time of your RSVP, your RSVP status, and whether you were placed on a waitlist.

Comments and poll votes

Any comments you post on event pages and any poll votes you cast. These are associated with your account.

Server follows

Which partner servers you have chosen to follow on the platform.

Communication preferences

Your email opt-out status (whether you have unsubscribed from non-essential emails), and optional per-type preferences (weekly digest, event recaps, milestone notifications).

Age range (optional)

If you choose to provide it, a broad age band (e.g. 18–24, 25–34). This is entirely voluntary. We collect it so we can show age-appropriate content on partner servers that require it.

Technical and usage data

Server logs including your IP address, browser type, and pages visited. These are not linked to your account and are used only for security and performance monitoring. We do not use advertising pixels or cross-site trackers.

Payment data

If you purchase Founder, Lena, or a Guest Call Package, payment processing is handled entirely by our payment processor (Stripe). We do not see or store your card number. We receive only your purchase status, amount, and the customer/session identifier assigned by Stripe.

We do not store your Discord access token, refresh token, or any OAuth credential beyond what is needed to complete your sign-in. Tokens are used briefly during authentication and are never written to our database.

3. How we use your personal data

Authenticate you

We use your Discord account data to sign you in via Discord OAuth and to create or match your account in our database.

Record and display your RSVPs

Your name and RSVP status are shown to the partner server's owner so they know who is attending their event.

Send transactional emails

RSVP confirmations, event reminders (24 hours and 1 hour before an event), waitlist promotion notifications, and welcome emails when you first create an account.

Send marketing emails from partner servers

Partner servers may send event announcement "blasts" to their attendees. These are sent only to people who have RSVPd to the partner's events. You can unsubscribe at any time.

Deliver age-gated content

If you have set an age range and a partner server requires age verification, we use your age range to determine which content to display.

Display your profile

Your Discord display name and profile picture are shown on your public activity (e.g. RSVP lists visible to event organisers).

Operate and improve the platform

Anonymised usage statistics and server log data are used for performance monitoring, security, and product development.

Notify partner servers of new sign-ups

When you first create an account, your name and email are included in an internal notification sent to us via a Discord webhook. This is for operational purposes only and is not shared with any partner server.

We do not sell your personal data. We do not use your data for advertising or profiling for third-party commercial purposes.

4. Legal basis for processing

UK GDPR requires us to identify a lawful basis for each type of processing. Our processing activities and their legal bases are set out below.

Contract performance (Article 6(1)(b))

Processing your Discord account data, recording your RSVPs, sending RSVP confirmation emails, and delivering event reminders. These are necessary to provide the service you signed up for.

Consent (Article 6(1)(a))

Sending you non-essential email communications, including marketing blasts from partner servers. You give consent by RSVPing to a partner server’s event and can withdraw it at any time by clicking "Unsubscribe" in any email or by contacting us.

Legitimate interests (Article 6(1)(f))

Security monitoring, platform performance analytics (using anonymised data), fraud prevention, and sending you a welcome email when your account is first created. Our legitimate interest is to operate and protect a safe and functional platform. We have weighed these interests against your rights and concluded they do not override your fundamental freedoms.

Legal obligation (Article 6(1)(c))

Retaining records where required by applicable UK law (for example, financial records relating to paid subscriptions).

Where we rely on legitimate interests, you have the right to object to that processing. See Section 8 for how to exercise this right.

6. International transfers

Our primary database (Neon, eu-west-2) is located in the United Kingdom. However, some of the service providers listed in Section 5 are based outside the UK, which means your data may be transferred internationally:

Discord (United States)

Discord is a US company. When you authenticate via Discord OAuth, data is processed in the US. Transfers are covered by Discord’s Standard Contractual Clauses with its UK/EEA users.

Resend (United States)

Resend processes email on servers located in the US. Transfers are covered by Standard Contractual Clauses approved under the UK International Data Transfer Agreement (IDTA) framework.

Vercel (United States and global CDN)

Vercel’s infrastructure spans multiple regions. Request data may be processed in the US or another jurisdiction. Transfers are covered by Vercel’s Standard Contractual Clauses.

Stripe (United States)

Stripe processes billing data in the US. Transfers are governed by Standard Contractual Clauses as part of Stripe’s data processing agreement.

You can request a copy of the relevant safeguards by contacting us at stan.network.io@gmail.com.

7. How long we keep your data

Account data

Kept for as long as your account is active. If you delete your account, your personal data (name, email, Discord ID, profile picture, age range, notification email, preferences) is removed within 30 days.

RSVP and attendance records

Kept for as long as your account exists and deleted when you delete your account. Aggregate, anonymised event statistics (e.g. total RSVPs per event) may be retained indefinitely as they cannot identify you.

Comments and poll votes

Deleted when you delete your account or if you delete the comment yourself.

Server follows

Deleted when you delete your account.

Email communication records

Resend retains delivery logs (email address, send time, status) for up to 30 days. We do not retain copies of email content on our own systems beyond what is needed to send them.

Security and server logs

IP addresses and request logs are retained for up to 90 days for security monitoring and then automatically purged.

Billing and subscription records

Subscription identifiers and status records are retained for 7 years to comply with UK financial record-keeping obligations.

8. Your rights under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access

You can request a copy of all the personal data we hold about you (a Subject Access Request). We will respond within one calendar month.

Right to rectification

You can ask us to correct any personal data that is inaccurate or incomplete.

Right to erasure (“right to be forgotten”)

You can ask us to delete your personal data. You can delete your account at any time from your account settings, which triggers full deletion of your personal data within 30 days.

Right to restrict processing

You can ask us to stop using your data in certain ways (e.g. while you contest its accuracy) without requiring full deletion.

Right to data portability

Where processing is based on contract or consent and carried out by automated means, you can request a copy of your data in a structured, commonly used, machine-readable format (JSON or CSV).

Right to object

You can object to processing based on our legitimate interests or for direct marketing purposes at any time. Where you object to direct marketing, we will stop immediately. Where you object to legitimate-interests processing, we will stop unless we have compelling legitimate grounds that override your interests.

Right to withdraw consent

Where processing is based on your consent (e.g. marketing emails from partner servers), you can withdraw consent at any time by clicking “Unsubscribe” in any email or by contacting us. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Right not to be subject to solely automated decisions

You have the right not to be subject to a decision made solely by automated processing (including profiling) that produces legal or similarly significant effects on you. We do not make any such decisions — see Section 9.

How to exercise your rights: Email us at stan.network.io@gmail.com with the subject line “Data Subject Request”. We will verify your identity and respond within one calendar month. In complex cases we may extend this by two additional months and will notify you.

Right to complain to the ICO: If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.

ICO helpline: 0303 123 1113 (Mon–Fri, 9am–5pm)
Online reporting: ico.org.uk/make-a-complaint

9. Automated decision-making and profiling

We do not carry out any automated decision-making that produces legal or similarly significant effects on you. We do not build profiles of individual users for advertising or scoring purposes. The only automated processes we use are technical in nature (e.g. sending a reminder email a set number of hours before an event you have RSVPd to) and do not constitute profiling under UK GDPR.

10. Cookies

network.io uses the following cookies. We do not use advertising cookies, third-party tracking pixels, or analytics cookies that identify individual users.

Session cookie (next-auth.session-token)

A cryptographically signed JWT that keeps you logged in. Set by NextAuth.js. It contains your user ID and session information. It expires when you sign out or after 30 days of inactivity. This cookie is strictly necessary for the platform to function — you cannot be signed in without it.

CSRF cookie (next-auth.csrf-token)

A token that protects form submissions against cross-site request forgery attacks. Strictly necessary for security. Set and consumed automatically by NextAuth.js.

Callback URL cookie (next-auth.callback-url)

Stores the page you were on before you signed in so we can return you to the right place after authentication. Session-scoped (deleted when your browser tab closes).

Because we use only strictly necessary cookies, we are not required by law to show a cookie consent banner — and we don’t. If we ever add non-essential cookies in future, we will update this section and implement appropriate consent mechanisms.

11. Children's privacy

network.io is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. Discord itself requires users to be at least 13 years old — by signing in with Discord you confirm you meet this minimum age.

If you are a parent or guardian and believe your child under 13 has created an account, please contact us immediately at stan.network.io@gmail.com and we will delete the account and all associated data.

12. Changes to this policy

We may update this Privacy Policy from time to time as the platform evolves or legal requirements change. If we make material changes — changes that affect the legal basis for processing, the types of data we collect, or your rights — we will notify you by email (where we hold your address) and by placing a prominent notice on the platform at least 14 days before the changes take effect.

The “Last updated” date at the top of this page always reflects the current version. Previous versions are available on request.

13. Contact us

For any privacy question, data subject request, or complaint, contact us at:

network.io — Data Controller
Email: stan.network.io@gmail.com
Subject line: Data Subject Request or Privacy Query
Response time: within one calendar month

If you are not satisfied with our response you may escalate to the Information Commissioner’s Office (ico.org.uk).