GTA HANGOUT / INFORMATION
Privacy policy
What we collect, why we use it, and the choices you have.
Last updated 5 November 2026
Adults-only community (18+)
You must be at least 18 to enter the forum, create an account or participate. Game images, videos and discussions may contain violence, strong language, sexual themes and other mature material. This is GTA Hangout’s community policy, not a claim that the website has an official game age rating. Legal and contact pages remain available to everyone.
Visitors confirm their age before entering, and new members must separately confirm at registration. These are self-declarations, not identity checks. If we learn that an account belongs to someone under 18, we will close it and assess removal or retention of associated data under our privacy policy. Contact us to report a concern or request review of an incorrect age-related restriction; do not send identity documents unless specifically requested through an appropriate process.
1. Who is responsible?
GTA Hangout is a personal, non-commercial fan community operated by Alexander Claes, Belgium, the controller responsible for personal data processed through gtahangout.com and forum.gtahangout.com. Contact me@alexanderclaes.com for privacy questions or requests. This policy covers both sites.
2. Information we process
- Visits: your IP address, requested URL, date/time, response status, referring page where supplied, and browser/device information may appear in server access or error logs.
- Accounts: username, email address, securely hashed password, optional nickname/avatar, registration and activity timestamps, preferences, login/session information and associated IP addresses.
- Participation: discussions, posts, edits, reactions, mentions, subscriptions, notifications and moderation reports or actions. Posts can contain whatever personal information you choose to include.
- Correspondence: your email address, message and supporting information when you contact us, report content or request help.
- Browser settings: session cookies and interface choices described in our Cookies & storage notice.
The homepage does not create an account or use advertising or analytics scripts. We do not sell personal data or use it for behavioural advertising. The installed forum statistics extension provides administrative forum statistics; it is not a third-party advertising tracker.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create accounts, authenticate users, publish requested posts, and provide subscriptions and account notifications | Performance of the forum service agreement with you (GDPR Article 6(1)(b)) |
| Protect accounts, prevent spam/abuse, moderate content, troubleshoot faults, maintain backups and handle ordinary enquiries | Legitimate interests in running a safe, reliable community (Article 6(1)(f)), balanced against your rights |
| Generate occasional owner-requested AI replies to public discussions | Legitimate interests in providing relevant assistance to an existing public conversation (Article 6(1)(f)); you may object as explained below |
| Comply with valid legal requests, statutory duties and privacy rights | Legal obligation (Article 6(1)(c)) where applicable |
| Any future optional tracking or separate use requiring consent | Consent (Article 6(1)(a)) obtained before that use; no such tracking is currently enabled |
Account details are necessary to register and authenticate you. You can browse public pages without registering. Optional profile information is not required. Refusing necessary account information means we cannot provide an account.
4. What other people can see
Public usernames, avatars, posts, discussions, reactions, profile activity and some membership/activity information can be viewed by visitors and search engines. Do not post information you want to keep private. Email addresses, password hashes, session credentials and associated IP addresses are not ordinarily displayed publicly; authorised administration and service providers may process them where needed.
Deleting something from the forum cannot guarantee its removal from screenshots, quotations, search-engine caches or copies independently made by other people.
5. Service providers and international processing
- DigitalOcean: hosts our VPS. The selected server region is Amsterdam, the Netherlands. Provider administration, support and subprocessors may involve other countries. See DigitalOcean’s data-processing terms.
- Proton Mail: handles service email and correspondence, using a local Proton Bridge connection for forum delivery. Your own email provider also handles messages sent to you. See Proton’s privacy information.
- OpenAI: processes selected discussion content when the owner requests an AI answer. See the next section.
We may disclose information where necessary to comply with a valid legal obligation, protect rights, or investigate abuse. Hosting in the Netherlands does not mean all supplier processing stays in the EEA. Where a transfer requires safeguards, the applicable provider arrangements may include standard contractual clauses or another legally recognised transfer mechanism. You can contact us for information about the safeguards relevant to your data.
6. AI-generated answers
Only the forum owner can request a CodexBot answer. The worker sends the discussion title and relevant post excerpts to the OpenAI API and may use web research. It labels authors as human or bot rather than intentionally sending account email addresses, password hashes or session tokens. Any personal information written inside the post text can nevertheless be included.
AI replies are published as automated replies. The feature is not used to make account bans or other decisions with legal or similarly significant effects. It is not configured to process hidden, unapproved, locked or private discussions. Please avoid including sensitive information in public posts.
OpenAI states that API inputs and outputs are not used for model training by default unless the customer opts in. Its standard abuse-monitoring retention can be up to 30 days, with exceptions and additional retention depending on the API features and configuration. We do not promise zero retention. See OpenAI’s data controls. Web research can involve external search services and public websites.
To object to processing of your personal data for this feature, email us with your username and the relevant post URLs. We will assess the objection before further processing where required. This does not automatically erase previously published replies or provider records; those are assessed under the applicable deletion rules.
7. How long we keep information
- Account data: for the life of the account and afterward only where needed to resolve a request, investigate abuse, comply with law or establish/defend a claim.
- Posts and discussions: while they serve the community conversation, unless removed or anonymised following moderation or a justified request. Account closure and removal of public posts are assessed separately.
- Access/error logs: Nginx uses daily rotation and keeps up to 14 rotated log files plus the current file. This is a file-count policy, not a guarantee that every entry disappears after exactly 14 calendar days.
- Application errors, moderation correspondence and AI job records: while needed to troubleshoot, deal with the matter, prevent duplicate automated replies or retain necessary evidence. These do not all have an automatic fixed deletion timer.
- Routine backups: the latest 14 scheduled backup archives are retained. Separate recovery snapshots taken for maintenance may remain while necessary for recovery or investigation. They are not public or used as active profiles. Relevant deletion restrictions must be reapplied if a backup is restored.
- Browser storage: as described in the storage notice; persistent settings remain until cleared or replaced.
Longer preservation may be necessary for an active dispute, legal obligation or security incident; access is restricted to that purpose. Ask us about the retention and deletion of a particular record.
8. Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction, data portability, or object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. We do not use solely automated decisions with legal or similarly significant effects.
Email me@alexanderclaes.com, preferably from your account’s email address, with your username and request. Never send your password. We may request proportionate information to verify identity. We normally respond within one month; lawful extensions may apply for complex requests, and we will explain them.
You may complain to the Belgian Data Protection Authority or the supervisory authority competent for you. You do not have to contact us first.
9. Security, children and external content
We use HTTPS, password hashing and restricted administrative access. No internet service can guarantee complete security. Contact us promptly if you suspect a compromise. The forum is for adults aged 18 and over. If you believe a child’s information has been provided without legally required permission, contact us.
User-posted external images, links or media may connect your browser to another provider. That provider receives connection information and applies its own privacy rules. We cannot control those third-party services.
10. Changes
We will update this page when our practices change and draw attention to material changes where appropriate. New uses requiring consent will not be authorised simply by updating this notice.