Privacy: the bot and the dashboard

Who is responsible

For the data of a Discord server, the administrator of that server is the controller; JP Metamods B.V. processes it on their behalf so the bot can do what the administrator switched on. For your dashboard account and for billing, JP Metamods B.V. is the controller. Contact: info@jpmetamods.com.

What the dashboard processes

• When you sign in with Discord: your Discord user id, username and avatar, and the list of servers you administer, to show you your servers. One session cookie keeps you signed in.
• When you choose a paid plan: your Discord user id and the Stripe customer id, so your subscription is tied to you. Payment details are entered at Stripe and never reach our servers.

What the bot processes in a server

• Server, channel and role ids, and the settings the administrator chooses.
• Member ids and names, with the timestamps and counts a switched-on feature needs: verification results, warnings, XP and levels, invites, tickets, giveaway entries, shop purchases.
• Message content only where a feature requires it: AutoMod reads messages to apply the rules and stores an excerpt in the moderation log when a rule acts; ticket channels are kept as a transcript when a ticket closes; the message log stores edited and deleted messages when that log is on. Content is not stored beyond those features.
• Secrets an administrator enters (a custom bot token, a game server key) are stored encrypted and used only for that feature.
• The invite links of a server and their use counts, when invite tracking is on.

Why, and on what basis

To provide the bot and the dashboard (performance of the agreement with the server administrator), to bill paid plans (performance of the agreement with the customer, and legal obligations), and to keep the service secure and working (legitimate interest). We do not use the data for advertising, profiling or training models, and we do not sell it.

Who receives data

• Discord Inc. (USA), the platform the bot runs on, under Discord’s own privacy policy: every message the bot posts and every action it takes goes through Discord.
• Stripe Payments Europe, Ltd. (Ireland), for payments, invoices and VAT, under Stripe’s data processing agreement.
• Contabo GmbH (Germany), which hosts our servers in the European Union, under a data processing agreement.
• Google, when a member uses flag translation: the message text is sent to Google Translate to translate it.

How long

We keep a server’s data as long as the bot is in that server. When the bot is removed or a plan ends, we delete it within 30 days, unless a legal obligation (invoices: 7 years) requires longer. Ticket transcripts are kept as long as the administrator keeps them in the log channel; the copy sent to the member is theirs. Dashboard sessions end when you sign out.

Your rights

You can ask to see, correct or delete the data we hold about you, or object to a processing, by writing to info@jpmetamods.com. A server administrator can delete a member’s data from the dashboard (XP, warnings) or by removing the bot. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Data is stored on servers in the European Union, encrypted in transit, with secrets encrypted at rest; access is limited to the people who operate the service. The bot itself never holds Administrator in a server: it runs with a written list of permissions.