Privacy Policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is: Jonas Geiger, Haupstraße 28 - 77781 Biberach, Germany (Baden-Württemberg).

Contact for all data protection questions: info@web-deck.com

2. Definitions

• Bot means the Discord bot Bobii. Website means the Bobii website including its dashboard. Service means the Bot and the Website together.
• Company (also "We", "Us", "Our") means the operator named above. You means the person using the Service, or the company or other legal entity on whose behalf it is used.
• Server means a Discord server. Personal Data is any information that relates to an identified or identifiable person.
• Usage Data means data that is collected automatically when the Service is used, for example an IP address or the time of a visit.

3. Data We process and why

3.1 When Bobii is on a Discord Server

If a Server administrator adds Bobii to a Server, the Bot processes data about that Server and its members so that temporary voice channels work. You do not have to register for this. The Bot processes:

• Discord IDs of Servers, channels and users, for example of the owner, the moderators and the whitelisted or blocked members of a temporary voice channel.
• Settings of temporary channels and members: channel name templates, sizes, delete delays, auto-delete times, enabled or disabled commands and the language of the Server.
• A record of the use of certain commands: which function was used, by whom, who or which channel it affected, and when.
• A log of the Bot: errors and actions of users (for example that a command or button was used, or that a temporary voice channel was created or deleted), each with the time and the Discord IDs of the Server, the channel and the user involved. Only the operator can read it, on a private page of the Website.
• Voice channel events (who joins or leaves which voice channel) and messages in the text chat of temporary voice channels. These are used only at that moment, to create and delete channels and to delete messages automatically. Bobii does not store the content of messages.

Legal basis: Art. 6(1)(f) GDPR, Our legitimate interest in providing the functions that the Server administrators have asked for. For administrators who set up Bobii, also Art. 6(1)(b) GDPR.

3.2 Signing in to the Website with Discord

To sign in, You are sent to Discord and allow Bobii to read Your basic account information (scope "identify") and the list of Your Servers (scope "guilds"). We receive:

• Your Discord user ID, username, display name and avatar.
• The list of Servers You are on, with name, icon and Your permissions there. We use it only to show You the Servers You manage and to check that You are allowed to change settings or buy Premium for them.

The access token that Discord gives Us is kept only in the memory of Our server until it expires. It is never stored in Our database and never sent to Your browser. Bobii never posts anything on Your behalf. Legal basis: Art. 6(1)(b) and (f) GDPR.

3.3 Server settings in the dashboard

Settings You change in the dashboard (creator channels, the Server language) are saved for the Server. If You ask the dashboard to set up a creator channel, We save a short request with the Server, Your Discord user ID, the status and the time, and the Bot carries it out. Legal basis: Art. 6(1)(b) GDPR.

3.4 Premium subscriptions and payment

Premium belongs to one Server. Payments are processed by Stripe. Stripe collects the payment details, Your email address, Your name and Your billing country in its own checkout and, for these purchases, acts as merchant of record and as a controller in its own right for payment, tax and fraud prevention purposes. We do not receive or store payment card data. We store:

• the Server ID, the billing interval (monthly or yearly), the status of the subscription, the end of the paid period and whether it has been cancelled,
• the Stripe customer ID and the Stripe subscription ID, and the times of creation and last change.

We also send Stripe the Server ID and Your Discord user ID as reference data of the purchase so that We can assign the subscription to the right Server. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (commercial and tax law obligations).

3.5 Direct messages to Bobii

If You send Bobii a direct message on Discord, Discord stores it like any other direct message. The operator can read and answer such messages on a private page of the Website that only the operator can open. For this We keep a list of conversations with: Your Discord user ID, the ID of the direct message channel, Your username, display name and avatar link, the time of the last message, a short preview of the last message (at most 200 characters) and whether the conversation has been read or You are typing. The full messages are fetched live from Discord when the operator opens a conversation and are not copied into Our database. Replies are sent through the Bobii bot account and are visible to You in Discord. Please do not send sensitive personal data in direct messages. Legal basis: Art. 6(1)(f) GDPR (answering enquiries) and, where Your enquiry concerns a contract, Art. 6(1)(b) GDPR.

3.6 Cookies and similar technologies

The Website uses only cookies that are strictly necessary to provide the functions You request, so no consent banner is needed:

• bobii_access_token: Your login token for the dashboard. It is deleted when You close the browser or sign out and is valid for 60 minutes at most.
• bobii_user: Your Discord name and avatar link, to show who is signed in. Deleted when You close the browser or sign out.
• bobii_oauth_state and bobii_login_intent: protect the login against forgery and remember whether You came from "Get Premium". Valid for 10 minutes.
• bobii_lang: the language You chose. Stored for up to one year.

We do not use analytics, advertising or tracking cookies and We do not load third-party fonts or tracking scripts. The Website shows Your Discord avatar and Server icons directly from Discord's servers (cdn.discordapp.com). When Your browser loads them, Discord receives Your IP address.

3.7 Technical data (server logs)

When You visit the Website or use the dashboard, Our servers at netcup, located in the European Union, process technical data such as Your IP address, the time of the request, the requested address and Your browser type. This is used for security and for stable operation and is stored only temporarily. Legal basis: Art. 6(1)(f) GDPR.

4. Who receives Your data

• Discord Inc. (USA), the platform on which Bobii runs. Discord processes Your data as an independent controller under its own Privacy Policy.
• Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) for payments, tax and fraud prevention.
• netcup GmbH (Karlsruhe, Germany), Our hosting provider, which processes data on Our behalf to run the Service on servers located in the European Union. A data processing agreement pursuant to Art. 28 GDPR has been concluded with netcup.
• Authorities, courts or other parties where We are legally obliged or have a legitimate interest in enforcing legal claims.

We do not sell Personal Data and We do not use it for advertising.

5. Transfers outside the EU/EEA

Discord and Stripe are also established in the USA. Where Personal Data is transferred there, it happens on the basis of the EU-US Data Privacy Framework and/or Standard Contractual Clauses as provided by these companies. We take the steps reasonably necessary to make sure that Your data is treated securely and in accordance with this Privacy Policy.

6. How long We keep Your data

We delete data that is no longer needed automatically. A cleanup runs shortly after every start of the Bot and then every six hours, so no data stays behind.

• Server data (settings, channels, command records, saved member settings and set-up requests of a Server) is deleted as soon as Bobii is removed from the Server. If Bobii was removed while the Bot was not running, the cleanup notices it after the next start and deletes the data, after Discord has confirmed that Bobii is no longer on the Server.
• Data of channels that no longer exist on Discord (creator channels, temporary channels and everything that belongs to them) is deleted, and so are the saved settings and command records of a member who has left a Server, including entries in which that member was the target (for example whitelisted). Blocks are the exception: a block stays in place when the blocked member has left the Server, and is deleted when the member who set the block has left or lifts the block.
• Set-up requests from the dashboard are deleted after 7 days.
• The log of the Bot (errors and actions of users) is deleted after 7 days.
• Subscription records are kept while a subscription runs. 30 days after a subscription has ended they are deleted, and a purchase that was never completed is deleted after one day. Receipts and invoices are kept by Stripe according to its legal obligations.
• The interface design of a Server (Premium: texts, colors and icons of the buttons, and turned off commands) is kept for 30 days after Premium has ended and is then deleted, as are the icons the Server uploaded for it. If Bobii is removed from the Server, they are deleted right away.
• The list of direct message conversations is deleted 90 days after the last message of a conversation. The operator can also delete a conversation at any time. The messages themselves are stored by Discord and are not affected.
• Generated images that are no longer needed are deleted as well.
• The login token is valid for 60 minutes. Cookies are kept as described in section 3.6.
• Data held by Discord and Stripe is kept according to their own policies.

The Company will also retain Personal Data to the extent necessary to comply with legal obligations, resolve disputes and enforce Our agreements. You can also ask Us at any time to delete Your data earlier.

7. Your rights

You have the following rights under the GDPR:

• access to Your Personal Data and a copy of it (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing that is based on Our legitimate interests (Art. 21), and withdrawal of a consent You gave, with effect for the future (Art. 7(3)).

To use these rights, contact Us at info@web-deck.com. We may ask You to prove that the Discord account is Yours. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg or the authority at Your place of residence.

We do not carry out automated decision-making or profiling that produces legal effects for You.

8. Children's privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. Discord sets its own minimum age. The dashboard and Premium are for adults, see the Terms and Conditions. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from a child without the required consent, We take steps to remove that information.

9. Security

The security of Your Personal Data is important to Us. We use commercially reasonable technical and organisational measures to protect it, but no method of transmission over the Internet or of electronic storage is 100% secure and We cannot guarantee absolute security.

10. Links to other websites

Our Service may contain links to other websites that are not operated by Us, for example Discord and Stripe. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when We add features that process data in a new way. We will notify You of changes by posting the new Privacy Policy on this page and, for material changes, by a prominent notice on the Website before the change becomes effective. The "Last updated" date at the top shows the current version. Changes to this Privacy Policy are effective when they are posted on this page.

12. Contact

If You have any questions about this Privacy Policy, You can contact Us by email: info@web-deck.com