Privacy Policy
Last updated 27 September 2026
This policy explains what personal data Glored collects, why, who it is shared with and the choices you have. It covers www.glored.com and the emails we send.
Trading is not open yet: Glored does not take payments, so it holds no payment card or bank details. This policy will be updated before that changes.
Who is responsible
Glored is the controller of your personal data.
The company that will operate Glored is being registered. Until then, Glored is run by its founder. The company's name, registered address and registration number will be published on this page as soon as registration is complete.
Questions or requests about your data: privacy@glored.com.
What we collect and why
We only collect what the site needs to work. The legal basis is the reason the GDPR allows each use: contract means it is needed to provide the service you signed up for; legitimate interests means a reasonable need of ours that does not override your rights.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email address, display name, password (stored only as a salted scrypt hash), profile picture number, whether your email is confirmed, when you joined | To create and run your account and let you sign in | Contract | Until your account is deleted |
| Sign-in methods: for Google and Discord, the provider account ID and email; for Telegram, the account ID and name | To let you sign in with those services | Contract | Until you disconnect the method or delete your account |
| Sessions: a session identifier (stored only as a hash), when it started and when it was last used | To keep you signed in and let you see and end your sessions | Contract | Deleted when the session ends or after 7 days |
| Security records: a hash of your IP address for sign-in rate limits; single-use email link codes (stored only as hashes) | To protect accounts against guessing and abuse | Legitimate interests (security) | IP hashes for 15 minutes; link codes stop working after 1 hour (password reset) or 48 hours (email confirmation) |
| Onboarding answers: buyer or seller, games, categories and experience | To show you the right parts of Glored and tailor emails | Legitimate interests | Until you change them or delete your account |
| Seller application: shop name, shop address, description and country; review decisions and reasons | To review sellers and keep a record of decisions | Contract and legitimate interests (safety) | While your account exists |
| Listings: drafts, submitted versions, review decisions and reasons, stock counts | To publish listings after review | Contract | While your account exists; published listings can be archived by you |
| Emails we send: address, type of email and whether it was delivered (not the content) | To send account emails and know whether they arrived | Contract; legitimate interests for security alerts | While your account exists |
| Activity records: actions such as account created, sign-in method connected, onboarding saved and staff decisions | Security, accountability and handling disputes | Legitimate interests | While your account exists |
| Messages you send us by email | To answer you | Legitimate interests | As long as needed to handle your request |
We do not use analytics, advertising or tracking tools, and we do not sell personal data.
What other people can see
Once approved, your shop name, shop address and shop description are public, and your listings show your display name. Your email address, country and onboarding answers are never shown publicly. Staff can see account and seller details to review applications and listings.
Transfers outside Europe
Some providers above are based in the United States, and the site's server is there. Where the GDPR requires it, these transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses. You can ask us for details at privacy@glored.com.
Your rights
You can ask us to:
- give you a copy of your personal data, including in a format you can take elsewhere;
- correct data that is wrong;
- delete your account and personal data;
- restrict or object to how we use it, including anything based on legitimate interests.
On Your account you can download a copy of your data and delete your account yourself. Deleting removes your email address, display name, password, sign-in methods and sessions straight away, closes your shop and archives your listings. Staff review decisions and account activity records are kept, as they were written, for safety and to settle disputes; they do not include your email address or password.
For anything else, email privacy@glored.com from the address on your account. We reply within one month.
You can also complain to the data protection authority where you live or work.
Also on Your account: change how you use Glored, connect or remove sign-in methods, and sign out your other sessions.
How we protect it
Passwords, session identifiers and email link codes are stored only as one-way hashes. The site is served over HTTPS only. Email links work once and expire. Changing your password with a reset link signs out every session, and we email you when your password or sign-in methods change.
Age
Glored is for people aged 18 or over. We do not knowingly collect data from younger people; if you believe we have, contact us and we will delete it.
Changes to this policy
We will update this policy before collecting new kinds of data, including before trading opens. We will tell you about important changes by email, and the date at the top always shows the latest version.