Privacy Policy
Draft. This text describes how VV-Bot is designed to work. It has not yet been reviewed by a lawyer and some features it mentions are still being built. It will be reviewed and updated before the service opens to the public.
1. Who is responsible
VV-Bot is operated by the person named in the Impressum, which also gives the postal address. You can reach us at vyskmalic-contact@pm.me.
There are two different roles, and it matters which one applies to you:
- Server owners and staff who add VV-Bot to a Discord server decide what the bot does with their members' data. For that data the server owner is the controller and the operator named in the Impressum is the processor, acting on the owner's instructions through the bot's settings.
- For the data we need to run the website, sign you in, keep the service secure and prevent abuse, the operator named in the Impressum is the controller.
2. Who may use VV-Bot
You must be at least 13 years old, which is Discord's own minimum age, or older if the law where you live sets a higher minimum age for using online services. We do not knowingly collect data from children under 13. If you think a child has used the service, contact us and we will remove the data.
3. The data we hold
| Data | Why | How long |
|---|---|---|
| Dashboard sign-in: your Discord user id, username, avatar hash, and the list of Discord servers you are in (name, id, whether you own it, your permission bits) | To let you into the dashboard of servers you manage and to show you the right servers. | For the session only. A session ends after 2 hours without activity or 12 hours in total, or when you sign out. Expired sessions are deleted. |
| Discord access tokens | Used once, during sign-in, to read your id and server list. | Never stored. They are discarded as soon as sign-in completes and we ask Discord to revoke them. |
| Server data: Discord server id, name, owner id, settings, channel and role names and ids, which roles count as staff, command permission overrides, audit log of changes | To run the bot for that server and show it in the dashboard. | While the bot is in the server. If the bot is removed, 30 days (so a re-invite restores your settings), then deleted. Audit entries are kept 180 days by default. |
| Member data, depending on the features switched on: Discord user id, XP and levels, daily streaks, giveaway entries, reports and suggestions, staff notes, moderation cases with reasons | To provide the features the server owner turned on. | While the bot is in the server, or until the server owner or the member asks for deletion. Removed with the server data after the 30 day grace period. |
| Minecraft data: Minecraft username and UUID, whether the account is Java or Bedrock, the link to a Discord account, ranks, connection and status events | For account linking, rank sync, status and the chat bridge. | Link and rank data: with the server data. Connection and status events: 7 days. |
| Optional chat and message logs, if the server owner switches them on: message text, author, channel, time | Moderation search by staff. Off by default. | As set by the server owner, from 7 to 180 days (30 days by default). Content is encrypted with a key specific to that server. Deleting the server's data destroys the key. |
| Technical logs: IP address, time and requested page of requests to this website | Security, abuse prevention and fixing faults. | Short-lived. They are not used for profiling and are not shared except with the hosting providers listed below. |
| Ban records: the id of a banned Discord server or user and the reason | To stop a banned server or user from coming back. | Kept even after other data is deleted, because that is their purpose. The record holds only the id and the reason. |
We do not use analytics, advertising or tracking tools, and we do not load third-party scripts, fonts or embeds on this website. We do not have passwords: you sign in with Discord only.
4. Why we may use it (lawful bases)
- Providing the service you asked for (UK GDPR and GDPR Art. 6(1)(b)): signing in and running the bot for a server you manage.
- Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, fixing faults. We weigh this against your interests and rights, and keep the data to what is needed.
- Server owners' own basis: for members' data, the server owner decides the purpose and relies on their own lawful basis, usually legitimate interests in running their community. Server owners are asked to tell their members when logging is switched on.
- Legal obligation (Art. 6(1)(c)): where the law requires us to keep or disclose something.
5. Who we share data with
- Discord. The bot works through Discord, so data moves between us and Discord as you use it. Discord's own privacy policy applies to that.
- Infrastructure providers. The application runs on a hosting and managed database provider, behind a network proxy. At the time of writing these are Railway for hosting and database, and Cloudflare for the network proxy. We will update this list if it changes.
- The server owner and their staff can see the data of their own server in the dashboard. They cannot see another server's data.
- We do not sell personal data.
6. Transfers outside the UK and EEA
Our providers may process data in countries outside the UK and the European Economic Area, including the United States. Where that happens we rely on an adequacy decision or on standard contractual clauses (and the UK addendum or IDTA where relevant) in our providers' terms.
7. Your rights
Under the UK GDPR and the GDPR you can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. Where processing relies on consent you can withdraw it at any time.
- For member data in a Discord server, ask the server's owner or staff first: they are the controller. The bot is being built with commands for a member to delete their own data in a server, and for a server owner to export or delete all of the server's data.
- For sign-in and technical data, contact us using the details above. Signing out on the dashboard ends your session, and "Sign out everywhere" ends all of them.
You can complain to a supervisory authority, which is a data protection regulator. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU, it is the authority in the country where you live or work.
8. How we protect it
- Each Discord server's data is isolated in the database with row-level security, in addition to checks in the application.
- Dashboard access is re-checked against server-side state on every request. Session cookies hold only a random identifier.
- Optional log content is encrypted with per-server keys.
- Secrets such as the bot token are kept in the hosting environment and are never shown in the dashboard.
9. Changes
We will change this policy as the product changes. The date at the top shows the last update. Material changes will be announced on the website before they apply.
10. Contact
Email vyskmalic-contact@pm.me. For anything about a specific Discord server's members, start with that server's staff.