Privacy policy

This policy says what data we process, why, on what legal basis and for how long. We have kept it as short as it can be without leaving anything out.

As of: 5 September 2026

Diese Seite ist noch nicht ausgefüllt

In apps/web/src/lib/legal.ts stehen noch Platzhalter. Trag dort Name, Anschrift und E-Mail-Adresse ein — alle Rechtsseiten und jeder Preishinweis auf der Website ziehen sich die Angaben von dort. Solange das nicht passiert ist, darf die Seite nicht online gehen.

About this translation

This is a convenience translation. The contractual relationship is governed by German law, and the German version of this text is the legally binding one. Where the two versions differ, the German version prevails. You will find it linked in the footer of every page.

One point of vocabulary: the GDPR is called „DSGVO“ in German law. Where this text cites an article of the GDPR, the German version cites the same article of the DSGVO — they are the same regulation.

Controller

The controller for the data processing on this website is:

PLATZHALTER — dein voller Name
PLATZHALTER — Straße und Hausnummer
PLATZHALTER PLATZHALTER — Ort
Deutschland
Email: PLATZHALTER — deine E-Mail-Adresse

First things first: we do not read along in your channels

In your ordinary channels, the bot does not see the content of your messages. What it sees there are events: that someone joined, reacted to a message or ran a command. There is exactly one exception, and it only concerns servers that use the ticket module: in a ticket channel — a channel the bot created itself for a support request, visible only to you and your team — it stores the messages so that a transcript can be produced when the ticket is closed. More on that below under “Ticket transcripts”.

What data we process

Data	Purpose	Legal basis
Discord user ID, username, avatar, email address	Signing in to the dashboard, linking bookings to an account	Art. 6 (1)(b) GDPR (contract)
Server ID, server name, member count, module settings	Running the bot on your server	Art. 6 (1)(b) GDPR (contract)
Content you create yourself (embeds, forms, polls, rules)	Providing the modules you booked	Art. 6 (1)(b) GDPR (contract)
Messages in ticket channels (sender, time, text, attachment file names)	Transcript of a support ticket	Art. 6 (1)(b) GDPR (contract)
Star rating of a ticket together with an optional comment	Feedback on support quality	Art. 6 (1)(f) GDPR (legitimate interest)
Change log: who changed which setting, and when	Traceability, abuse prevention, support	Art. 6 (1)(f) GDPR (legitimate interest)
Which servers you have opened in the dashboard	Support — so that we know which servers a request is about	Art. 6 (1)(f) GDPR (legitimate interest)
Payment data	Processing the payment	Art. 6 (1)(b) GDPR — processed exclusively at Stripe, see below
Server log files at the hosting provider (IP address, time, page requested)	Operation and security of the website	Art. 6 (1)(f) GDPR (legitimate interest)
Page views: a five-minute time window and the path requested — no IP, no identifier, no recognition	Seeing whether and when the website is used	Art. 6 (1)(f) GDPR (legitimate interest)

Counting visits

We count how often a page is requested. Exactly two things are stored: the five-minute window the request fell into, and the path of the page — for addresses that contain a server ID, only the shape of the address, not the ID itself.

No IP address is stored, no cookie is set and no identifier is issued. Two requests therefore cannot be attributed to the same person. We see requests, not visitors — and that is all we want to see.

No third-party service is involved; the counting runs on the same server as the website. The rows are deleted after 180 days.

Ticket transcripts

A ticket channel is a channel the bot creates for a support request, visible only to the person asking and the server's team. Only there does the bot store message content, and only so that a transcript exists when the ticket is closed — as a record for you, and as a file for the person who asked.

What is stored is the sender, the time, the text and the file names of attachments. We do not store the attachments themselves. How long a transcript is kept is set by each server; the default is 90 days, and “do not store at all” is one of the options.

Outside ticket channels none of this is stored — no text, no excerpt, no analysis.

Ratings

After a ticket is closed, the bot sends a direct message asking for a score from one to five and an optional sentence. Taking part is voluntary, possible once per ticket, and the request expires after three days. A server can switch the feature off entirely and can have ratings published anonymously.

Which servers belong to you

When you open a server's area in the dashboard, we record that your account administers that server, together with the time. Nothing more: no member lists, and nothing about which other servers you are on.

The purpose is support. Without this link we would have to ask which server a request is about every single time — and we could not check whether the person asking is entitled to it at all.

You may object to this processing under Art. 21 GDPR. The link is then deleted; the dashboard keeps working.

Signing in with Discord

Signing in runs through Discord's OAuth2 flow. Discord passes us your user ID, your username, your avatar, your email address and the list of servers on which you hold administrative rights. We never receive a password. Discord's own processing is governed by Discord's privacy policy.

Cookies

We set exactly one cookie: the session cookie that keeps you signed in after login. It is technically necessary, contains no advertising identifiers and is not passed to third parties. That is also why there is no consent banner here — there would be nothing to consent to. We use no tracking, no analytics tools and no advertising networks.

Who receives your data

Stripe Payments Europe, Ltd. (Ireland) handles the payments. You enter card and bank details directly with them; we never see them. Stripe only reports back whether a payment succeeded and up to which date a period has been paid for. A transfer to the US parent company is possible in that process and is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework.
Discord Inc. — without Discord there is no service. Everything the bot does on your server goes through their API.
Our hosting provider, which runs the website and the database, on the basis of a data processing agreement under Art. 28 GDPR.

Beyond that we pass on no data. We never sell it — not to advertisers and not to anyone else.

How long we store data

A server's settings and content: for as long as the bot is on the server, then 90 days — so that an accidental kick does not destroy everything.
Account data: until you ask for deletion.
Change logs: 12 months.
Ticket transcripts: for as long as the server in question sets — 90 days by default, two years at most.
The link between a user and a server: for as long as the bot is on the server, then 90 days.
Invoices and accounting records: 10 years, because German commercial and tax law requires it (§ 147 AO, the German Fiscal Code). We cannot shorten this period, not even on request.

Your rights

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21 GDPR).

An email to PLATZHALTER — deine E-Mail-Adresse is enough. In the dashboard you can also export and delete a server's data yourself.

If you believe something is not being done properly, you can lodge a complaint with a data protection supervisory authority — either the authority for your own federal state or region, or the one responsible for our place of business.

Encryption

The site is served over HTTPS only. Everything that travels between your browser and us is encrypted.