Privacy Policy
This policy explains how IPTV Gold ("IPTV Gold", "we") processes personal data when you visit https://gold-iptv.store, create an account, buy a plan or contact us. We process personal data in line with the EU General Data Protection Regulation (GDPR) where it applies and Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data.
1. Who is responsible
The data controller is IPTV Gold. For any privacy question or request, contact support@iptvgold.example.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, password (stored only as an Argon2id hash), language | Create and secure your account, sign you in | Contract |
| Two-factor authentication secret and backup codes (encrypted) | Protect your account when you turn on 2FA | Contract, legitimate interest in security |
| Plan, subscription status, invoices, Stripe customer ID | Provide the Service, billing, accounting | Contract, legal obligation |
| IPTV login details and device names/MAC addresses you save | Activate the Service on your devices | Contract |
| Support messages, contact and trial requests | Answer you and keep a record of the conversation | Contract, legitimate interest |
| Reviews you choose to publish (display name, country, text, rating) | Show genuine customer feedback | Consent (you can withdraw it any time) |
| IP address, browser type, security events (sign-ins, failed attempts, lockouts) | Protect accounts, prevent fraud and abuse, rate limiting | Legitimate interest in security |
| Analytics data, only if you accept analytics cookies | Understand how the site is used to improve it | Consent |
We do not sell your personal data and we do not use it for advertising profiles. We never receive your full card number: card payments are handled by Stripe.
3. Who we share data with
We use carefully selected service providers ("processors") who act on our instructions:
- Stripe (payments and invoices) — United States / Ireland
- Vercel (website hosting) — United States / EU
- Our database provider (data storage) — EU region where available
- Resend (transactional email) — United States
- Cloudflare (Turnstile bot protection) — global network
- Upstash (rate limiting, if enabled) — EU region where available
- Google (sign-in with Google if you choose it; Google Analytics only with your consent)
- Plausible Analytics (cookieless, aggregate statistics, if enabled) — EU
Some providers are located outside Morocco and the European Economic Area. Where data is transferred, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses or equivalent safeguards, and on the authorisations required under Law 09-08. We may also disclose data where required by law or to protect our rights and users.
4. How long we keep data
- Account data: for as long as your account is open. When you delete your account we delete or anonymise your personal data within 30 days.
- Billing records and invoices: 10 years, as required by accounting law.
- Support tickets and trial requests: 2 years after the last message.
- Security logs: 180 days.
- Analytics: up to 14 months (Google Analytics) or aggregate only (Plausible).
5. Your rights
Depending on where you live you have the right to access your data, correct it, delete it, object to or restrict certain processing, receive a copy in a portable format and withdraw consent at any time (without affecting earlier processing). You can update most details and delete your account yourself from your dashboard. For other requests write to support@iptvgold.example; we reply within one month.
You also have the right to complain to a supervisory authority: in Morocco, the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP); in the EU, your local data protection authority.
6. Security
We protect data with HTTPS everywhere, strict security headers, Argon2id password hashing, optional two-factor authentication, encryption of IPTV login secrets at rest (AES-256-GCM), account lockout after repeated failed sign-ins, rate limiting, role-based access for staff and logging of security events. No system is perfectly secure; if a breach affects you we will inform you and the authorities as the law requires.
7. Cookies
We use only strictly necessary cookies unless you accept analytics cookies. Details are in our Cookie Policy, and you can change your choice any time with the "Cookie settings" link in the footer.
8. Children
The Service is not intended for anyone under 18 and we do not knowingly collect their data.
9. Changes
We will post any update on this page with a new date and tell you by email about significant changes.