1. Controller
The controller responsible for data processing within the meaning of Art. 4(7) GDPR is:
[Name / company missing][Street address missing]
[Postal code and city missing]
Germany
Email: [Email address missing]
The operators of the respective Discord servers share responsibility for the content on their servers (e.g. which modules are active and what appears in log channels). They decide which features of the bot are used on their server.
2. Overview
| Area | What data? | How long? |
|---|---|---|
| Website | Technically necessary connection data (IP address, time, requested page) | Only for the duration of the connection |
| Dashboard sign-in | Session cookie; with Discord login: list of your servers and your permissions on them | Until you sign out, at most 7 days |
| User account | Discord ID, name, profile picture link, sign-up date, last sign-in, number of sign-ins | Until you delete your account |
| Server settings | Server ID, selected channels and roles, texts, volume, custom banner images | Until the bot leaves the server |
| Music & verification | Discord ID, display name, input; verification codes | In memory only; codes for max. 5 minutes |
| Tickets | Creator, category, timestamps; on closing, the transcript (names, profile picture links, messages) | Until deleted by the server or on request |
| Logging | Events on the server (see 4.4) – written to the log channel on Discord | We do not store them; the server deletes them in its log channel |
| Backups | Roles, channels, permissions, server settings; IDs of members with special permissions | Until deleted by the server or on request |
| Notifications | Public channel names and posts of the linked accounts | List of posts already announced (max. 60 per source) |
| Premium | Subscription status per server (provided by Discord) | For as long as the subscription is active |
3. Website and dashboard
3.1 Serving the pages
When you visit this website, our server necessarily processes your IP address, the time of access and the requested address in order to deliver the page to you. The application itself does not store access logs. The legal basis is our legitimate interest in providing a functioning service (Art. 6(1)(f) GDPR).
3.2 No cookies, no tracking, no third-party content
The public pages do not set any cookies and do not use any analytics, tracking or advertising services. Fonts, scripts and images are loaded exclusively from our own server. On the home and status pages, your browser periodically fetches anonymous statistics (e.g. the number of servers) from our server.
3.3 Dashboard sign-in
To sign you in, we set a technically necessary session cookie (nvx.sid). It only contains a random identifier and is deleted when you sign out, or after 7 days at the latest. No consent is required for this (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).
If you sign in with Discord, Discord provides us with your Discord ID, your name, your profile picture and the list of your servers including your permissions on them (OAuth2 scopes identify and guilds). We use the server list only to show you the servers you are allowed to manage and keep it exclusively in your session. The legal basis is Art. 6(1)(b) GDPR.
User account: Your first sign-in with Discord creates a user account. For it we store your Discord ID, name, a link to your profile picture, the date you signed up, your last sign-in and the number of sign-ins. Name and picture are updated on each sign-in. We use this data to provide your account and to protect the dashboard against abuse (e.g. blocking accounts that violate our Acceptable Use Policy). You can delete your account at any time under Dashboard → My account; the data is then removed immediately. The legal basis is Art. 6(1)(b) and (f) GDPR.
After failed password sign-in attempts, the server keeps your IP address in memory for about one minute (to protect against attacks). The dashboard stores some display preferences (e.g. the server you selected last) in your browser's local storage; they never leave your device. In the signed-in area, profile and server images are loaded directly from Discord, which means Discord receives your IP address.
4. Use of the Discord bot
The bot does not read private messages and does not listen in voice channels – it is deafened there and only sends audio. Which of the following processing activities take place depends on which modules a server has enabled. The legal basis in each case is the provision of the feature requested by the server (Art. 6(1)(b) GDPR) or the server operator's legitimate interest in managing their community (Art. 6(1)(f) GDPR).
4.1 Basic data
Server ID, name, icon, member count, channels and roles of the servers the bot is on. When you use a command: your Discord ID, your display name and your input.
4.2 Welcome, verification and roles
When someone joins a server, the bot processes their name, profile picture and member number to create the welcome message and banner, and assigns the configured roles. The banner is generated in memory only and sent directly to Discord. Verification codes are kept in memory for no longer than 5 minutes.
4.3 Tickets
For open tickets, we store the creator ID, category, ticket number, timestamp and, where applicable, the staff member who claimed the ticket. When a ticket is closed, a transcript containing names, links to profile pictures, timestamps and message content is created as an HTML file, sent to the configured transcript channel and stored on our server.
4.4 Logging
If logging is enabled, the bot writes events to a log channel on the server, depending on the settings: joins/leaves, role and nickname changes, bans and timeouts, deleted and edited messages (including their content), channel and role changes, and voice channel moves. The bot determines who made a change from Discord's audit log. We do not store these entries ourselves; they reside on Discord in the respective server's log channel.
4.5 Backups
Backups contain roles, categories, channels, channel permissions and server settings. If an individual member has special permissions in a channel, their Discord ID is included in the backup. Messages are not backed up.
4.6 Notifications
For linked Twitch, Kick, YouTube, Bluesky or RSS sources, our server periodically retrieves their public data and keeps track of which posts have already been announced. The respective providers receive our server's IP address, not yours. Only publicly available information is processed.
4.7 Music
The queue and display names exist in memory only. When you play a link, our server retrieves the audio data from the respective provider, which receives our server's IP address.
4.8 Premium
Premium is purchased through Discord's app subscriptions. Payments are processed exclusively by Discord; we do not receive any payment data. Discord only tells us which server has a subscription and until when (Art. 6(1)(b) GDPR).
4.9 Discord
The bot runs on the Discord platform operated by Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. Discord processes your data under its own responsibility, including in the USA. For details, see Discord's Privacy Policy.
5. Recipients
We do not sell data and do not share it with third parties unless we are legally required to do so. Where we use a hosting provider to operate the server, it processes data solely on our behalf (Art. 28 GDPR).
6. Retention and deletion
When a server removes the bot, that server's settings are deleted automatically. Server administrators can delete backups and ticket transcripts in the dashboard or have them deleted on request. Messages in the log channel are deleted by the respective server itself on Discord.
7. Your rights
You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR).
To exercise these rights, contact us by email at [Email address missing]. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); an overview is available from the German Data Protection Conference (DSK).
8. No automated decision-making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. Verification merely checks whether a displayed code was entered correctly.
9. Changes
If the bot or this website changes, we will update this Privacy Policy accordingly. The version published here at any given time applies.