Privacy Policy

1. Data controller

The data controller is Derpinou, an individual publishing the Service in a personal capacity, reachable exclusively via the Service's official Discord support server (see the button at the bottom of this page).

Given the nature and limited volume of the processing carried out, no Data Protection Officer (DPO) has been appointed to date; the contact above handles all requests regarding your data.

2. Data we collect

Depending on how you use the Service, the following data may be processed:

• Discord identifiers: Discord ID, username, global display name and avatar, recorded as soon as the bot sees you interact on a Server or you log into the dashboard.
• Dashboard login: Discord access and refresh tokens (needed to act on your behalf against Discord's API), IP address and user-agent of each login, kept in a connection log for security purposes. Discord may also pass along your email address via the permission requested at login; the Service does not retain it.
• Moderation: messages or message metadata processed by the auto-moderation, anti-raid or highlighting (starboard) modules, messages saved by an Administrator, warnings and sanctions, to the extent needed for the modules enabled on the relevant Server.
• Activity and statistics: message counts, voice time, reactions, experience (XP) and level, daily per-Server or per-member statistics, attributed invites.
• History: username and nickname change history, an audit log of configuration changes made by Administrators.
• Payment (Premium): Stripe customer and subscription identifiers, subscription status and current period end date. Your payment card details are entered into and processed exclusively by Stripe; the Service never has access to them.
• Cookies: see Section 7 below.

3. Purposes and legal bases

This data is processed to:

• provide and operate the Service (moderation, statistics, personalization, dashboard) — performance of the contract for use of the Service;
• keep the Service secure and prevent abuse (anti-raid, connection log) — legitimate interest;
• manage Premium subscriptions and billing — performance of the contract;
• respond to requests made through support — performance of the contract or legitimate interest;
• comply with our legal obligations, where applicable (accounting, responding to competent authorities) — legal obligation.

No data is used for targeted advertising or sold to third parties for commercial purposes.

4. Who we share data with

Your data may be shared, strictly to the extent necessary:

• with Discord Inc., whose platform natively hosts the communications and which processes your data under its own privacy policy, independently of the Service;
• with Stripe, as our payment processor, for managing Premium subscriptions;
• with OVH SAS, our hosting provider located in France, which hosts the Service's technical infrastructure.

No other disclosure to third parties is made, except where legally required.

5. Transfers outside the European Union

Discord Inc. and Stripe, Inc. may process some data outside the European Union, in particular in the United States. These transfers rely on the appropriate safeguards put in place by those providers (European Commission standard contractual clauses or an equivalent mechanism). Please refer to their respective privacy policies for more detail.

6. Retention periods

Data associated with a Server is kept for as long as the Service remains installed on that Server, and is deleted when it is removed or when an Administrator requests a reset from the dashboard.

Account data (profile, connections, personal statistics) is kept for as long as your account remains active and is deleted or anonymized when you use the deletion options described in Section 8.

The audit log of configuration actions taken by an Administrator is kept as an accountability record for the Servers they administer, even after their own account is later deleted.

7. Cookies

The Service only uses cookies that are strictly necessary for it to function, which under CNIL guidance do not require prior consent:

• atom_session — keeps you logged into the dashboard (lifetime: 7 days);
• i18n_redirected — remembers your preferred display language;
• a display-preference cookie (light/dark theme).

The Service does not use any advertising, third-party analytics, or commercial tracking cookies.

8. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and port your data, to object to its processing, and to set directives on what happens to it after your death.

You can exercise several of these rights directly yourself:

• delete your account and almost all of your personal data, from Settings > Danger Zone in the dashboard;
• erase your activity (XP, statistics) across every Server, from the same page.

For any other request, or if you don't have dashboard access, contact us via our Discord support server; we will respond within one month at most.

You also have the right to lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés) — www.cnil.fr — or with the supervisory authority in your own EU member state.

9. Automated decisions

Some modules (anti-raid, auto-moderation, honeypot) may trigger automatic actions (warning, temporary or permanent removal) based on rules configured by the Administrator of the relevant Server, not by the Service's publisher.

These actions do not constitute a decision by the data controller producing legal effects concerning you within the meaning of Article 22 GDPR; they are part of that Server's own moderation, for which its Administrator remains responsible. You can dispute a moderation action with the Administrators of the relevant Server.

10. Minors

The Service is not intended for individuals who do not meet Discord's own age requirements for holding an account. We do not knowingly collect data about children below that minimum age.

11. Security

Reasonable technical and organizational measures are implemented to protect your data (HTTPS-encrypted connections, encrypted session cookies, restricted access to production data). As no system is infallible, we cannot guarantee absolute security.

12. Changes to this policy

This Privacy Policy may be updated from time to time; the last-updated date appears at the top of this page. Any material change will be announced through a reasonable means (support server, dashboard).