This notice explains how the GCNA platform handles personal data for the services described in the GCNA Platform Terms: purchase processing, provisioning, billing and invoicing of business communication, directory, identity management, MCP, business AI privacy and other business network services.
GCNA stands for Global Communication Network Alliance: an alliance of trusted service providers acting on the platform of the same name. The platform's operator is responsible for the data described here (section 7).
| Data | Why | Legal basis |
|---|---|---|
| Organization and user accounts: names, business email, roles, verified email, second factor (for a passkey, only its public key) | Sign-in, administration and account security | Contract, Art. 6(1)(b); for employees of a customer, the customer's legitimate interest, Art. 6(1)(f) |
| Purchase, subscription, billing and invoicing data: company, billing address, tax ID, ordered services, prices, invoices, payment status | Process purchases, bill subscriptions, issue invoices | Contract, Art. 6(1)(b); retention of invoices, Art. 6(1)(c) |
| Payment details | Collect payments | Handled by the payment provider; GCNA does not store card numbers |
| Provisioning data: provisioned services, phone systems, extensions, phone numbers, licence keys, user assignments | Set up and run the services a customer ordered | Contract, Art. 6(1)(b) |
| Communication metadata: who communicated with whom, when, how long, through which service | Connect calls and messages, bill usage, investigate faults and misuse | Contract, Art. 6(1)(b); misuse, Art. 6(1)(f) |
| Communication content in transit: voice, video, messages, files and data | Deliver it to the other participants | Contract, Art. 6(1)(b). GCNA does not record or store content in transit |
| Stored content (call agenda, results, recording, summary, messages, files), encrypted in the participants' browsers, and its wrapped keys | Store it for the participants; GCNA cannot read it | Contract, Art. 6(1)(b) |
| Directory data: profiles, contact cards, invitations, connections, contact-detail updates | Let business contacts find, invite and stay connected with each other | Contract, Art. 6(1)(b); invitations to people without an account, Art. 6(1)(f) |
| Requests to MCP and AI services and their results | Carry out the request on the user's behalf. Requests go only to the provider the user or their organization chose for that service, which is named before first use; GCNA does not use their content for its own purposes | Contract, Art. 6(1)(b) |
| Support requests | Answer and solve them | Contract, Art. 6(1)(b) |
| Sending limits, sign-in records and security events | Prevent misuse and protect accounts | Art. 6(1)(f) |
GCNA is controller for accounts, business cards, invitations, connections, billing and security records. For the communication services a customer runs for its own users (phone systems, messaging, file transfer, MCP and AI requests), GCNA acts as the customer's processor under a data processing agreement (Art. 28 GDPR).
We do not sell data, show advertising, build advertising profiles or train models on your data. We cannot read stored content: it is encrypted in the participants' browsers before it reaches us, and the keys never reach GCNA unencrypted.
Public MCP server. AI assistants can query GCNA's public MCP server at https://gcn-alliance.com/mcp for information about GCNA's apps, plans and prices. It needs no account and asks for no personal data. It does not log requests or their content. To prevent misuse it counts requests per IP address, in memory only, for 60 seconds (Art. 6(1)(f)). What you type into an AI assistant is processed by that assistant's provider under its own privacy terms; GCNA receives only the tool request the assistant sends.
| Data | Kept |
|---|---|
| Unaccepted invitation and its encrypted content | 30 days, then deleted |
| Accounts, profile, connections | Until the account is closed; erased 30 days after closure |
| Invoices and billing records | 10 years from the end of the year they were issued, as tax law requires; then deleted |
| Call records (who, when, how long) | On the customer's phone system for the current and the previous month, for the customer to download; then permanently deleted, without any backup. Keeping them longer is the customer's responsibility |
| Encrypted stored content | Until a participant deletes it, at most 2 years after the call; then deleted |
| Sending limits | One hour |
| MCP server request counters (per IP address) | 60 seconds, in memory only |
| Security events | 400 days |
| Backups | None. GCNA does not back up phone systems, call records or other customer data; backups are the customer's responsibility |
You can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interest, by writing to legal@centrafox.com. We verify your identity without asking for passwords or codes, and answer within one month. You may complain to a data protection supervisory authority. Erasure at GCNA does not remove copies already held by your connections, for example in their Odoo contacts or mailboxes.
If you received an invitation and do not want further ones, reply to the sender or write to us; we then block further invitations to your address.
Signing in to the platform uses a necessary session cookie. We use no tracking or advertising cookies.
The GCNA platform is operated by CENTRAFOX CONSULTING LLC, 1209 Mountain Road Pl NE, Albuquerque, NM 87110, United States, the controller for this notice. Privacy contact: legal@centrafox.com.
EU representative (Art. 27 GDPR): innovisr.team UG (haftungsbeschränkt), Hebbelstr. 16, 14469 Potsdam, Germany, mh@innovisr.team. No data protection officer is designated, because GCNA does not monitor people on a large scale or process special categories of data.