Privacy policy

1Controller

Allocation of roles: We are the controller within the meaning of the GDPR for processing in connection with the bot and the dashboard. Server administrators who use the bot on their Discord server decide on the configuration on their own responsibility (e.g. which channels, roles and members are affected) and are responsible for informing their members.

2What data we process

2.1Discord bot

When the bot is used on a server, we process the following data. Which modules are active is decided by the server's leadership; data for a module is only created when it is switched on.

• Server data: server ID, server name and icon, member count, ID of the server owner, channel and role IDs used in the configuration.
• User data: Discord user IDs of members who interact with the bot or are recorded in a module. We do not store display names, usernames or avatars of members but retrieve them from Discord when needed. A name is only stored for people who make changes in the dashboard (in the change log), request beta access or apply through the applications module.
• Time clock: times of clocking in and out, duration, status (e.g. ended automatically), reminders and corrections by managers including the reason.
• Absences: period, the reason you enter (free text), status, reviewing person. Please do not include sensitive information (e.g. health data) in the reason that you do not want to share with managers and – depending on the configuration – all members.
• Musters: dates, expected members and their response (attending, absent, late).
• Sanctions: affected member, type of sanction, reason (free text), issuing person, duration and status.
• Applications: display name when submitting, your answers to the leadership's questionnaire (free text), status, deciding person and their note. If the panel is on another server, we additionally store through which server you applied. Only the leadership you are applying to sees the answers. Please do not provide information beyond what the questionnaire asks for.
• Ranks: history of rank changes (from, to, reason, changing person, time). The bot reads the current rank from your roles.
• Trainings: sign-ups for sessions and records of passed trainings with date, validity, examining person and note.
• Duty roster: sign-ups for shifts and – if the time clock is active – whether you were clocked in during the shift.
• Storage: items and stock as well as every booking with the booking person, quantity and reason (free text).
• Treasury: income and expenses with the booking person, amount and reason (free text); for payouts, the shares per member calculated from duty time.
• Dispatch: incidents with the details entered (title, location, description, reporting person as free text), units with their members and status, and an incident log of who did what and when.
• Polls: question and answers, who started or ended the poll and, for each member who voted, the answers chosen. For anonymous polls, we also store the vote with the user ID – this is the only way to allow changing a vote and to prevent voting twice – but we do not show anyone who voted for what, not even the server's leadership.
• Team lists: assignment of members to roles, as it is visible on the server anyway.
• Welcome: when a member joins or leaves, the bot sends the configured message and assigns roles; nothing about the member is stored in the process.
• Logs: changes to settings and administrative actions (who changed what and when) as well as technical logs for troubleshooting (without message content). We also count how often the bot is used in which Discord language – only as a total per language and period, without reference to individual people.

2.2Message content

In two cases the bot reads messages that members write in a channel – and only in channels that the server's leadership has expressly set up for this:

• Booking in the log channel (Storage, Treasury): a message such as “+ 5000 sale” is evaluated as a booking. The booking (amount or quantity and reason) is stored, not the message itself.
• Patrol chat: messages from a linked channel are passed on with display name, avatar and attachments to the linked channels of other servers (see 4.4). We do not store the content. So that edits and deletions also arrive there, we remember for 7 days which forwarded message belongs to which original one – only the message IDs.

The bot does not evaluate any other messages on the server.

2.3Web dashboard (sign-in with Discord)

Sign-in is done through Discord (OAuth2). In the process we receive your Discord ID, your username, your email address, your avatar and the list of your servers with your permissions, in order to check which servers you may manage. For this we store a session cookie and the access tokens issued by Discord.

2.4Paid services

For subscriptions through our website, we process order and contract data (booked service, price, term, invoices, status) and the customer ID assigned to you by Stripe. Payment data (e.g. card number, IBAN) is processed exclusively by Stripe; we have no access to it. For invoicing, we may need your name, address and – for businesses – the VAT ID.

For purchases in the Discord App Store, Discord processes the payment. From Discord we only receive the entitlement: which product applies to which server from when until when, and the ID of the purchasing account.

Project packages: If someone books a project package, we store the project name, the Discord ID of the person who booked it (they manage the package), the join code and the subscription and customer ID at Stripe. For every attached server, we store who attached it.

Discounts: When a discount code or a sale is redeemed, we store with the paid booking which discount was used, the Discord ID of the booking person, the server or project, list price and saving, and the ID of the Stripe session. This lets us check limits such as “once per account” and evaluate how often a discount is used.

Free trial and gift codes: When someone starts the free Premium trial, we store the server, the Discord ID of the person who started it, and the start and end of the trial. This ensures every server and every account can only try it once. When a gift code is redeemed, we store the code, the server, the Discord ID of the redeeming person and the credited days – so that a code only applies once per server.

Premium Plus (own bot): When a server sets up an own bot, we store the bot token of its Discord application in encrypted form (AES-256), together with the IDs of the application and the bot account, its name and profile picture, and the Discord ID of the person who set it up. We use the token only to run the service for this server under the application; it appears neither in the dashboard nor in logs. The own bot processes the same data on the server as 5Bot (sections 2.1 and 2.2).

2.5Server logs

When the dashboard is accessed, the IP address, time, page accessed, browser and operating system are processed in server logs for technical reasons. This data serves security and error analysis and is deleted after 14 days at the latest.

2.6Messages to server owners

When someone adds the bot to a server, we send the server owner a one-time direct message with setup tips. If no module has been set up after three days, one reminder follows. If a server receives a reward from the referral programme (2.7), we also inform the owner by direct message. For this we only store when the messages were sent. We do not send any further promotional messages. Direct messages from bots can be turned off in Discord's privacy settings.

2.7Referral programme

If someone invites 5Bot through a server's referral link or enters its code, we store which server referred which, how, and with which status (e.g. under review or rewarded). Whether the reward conditions are met is checked using data that exists anyway (join date, active modules, member count). We do not store any personal data for this – the programme works at server level.

3Purposes and legal bases

4Recipients and third parties

4.1Discord

The bot runs on the platform of Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. All interactions and the messages sent by the bot are transmitted via Discord; Discord processes data in accordance with its own privacy policy. Discord Inc. is certified under the EU-US Data Privacy Framework.

4.2Hosting

Bot, dashboard and database are operated by 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen (Germany). A data processing agreement under Art. 28 GDPR is in place with the provider.

4.3Stripe (payments)

For payment processing we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Irland. Stripe processes your payment data as an independent controller; data may be transferred to Stripe, Inc. in the USA (safeguarded by the EU-US Data Privacy Framework and standard contractual clauses). Further information: Stripe privacy policy.

4.4Other Discord servers (patrol chat)

If the server's leadership sets up a patrol chat, messages from the linked channel – with display name, avatar and attachments – also appear in the linked channels of the other servers in this network and are visible to their members there. Which servers are linked is decided by the servers' leadership; every join and leave is shown in the channel, and with /streifenchat every member can see which servers the channel is linked to.

4.5Sentry (error monitoring)

So that we notice and fix errors in the bot and the dashboard quickly, we report unexpected errors to Sentry, a service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. The data is stored in the EU (Frankfurt am Main). We transmit the error message, the execution path in the program code (stack trace), the affected page or function, the server ID for bot errors and, for errors in the browser, the browser and operating system type. We deliberately do not send Discord IDs, names, inputs, cookies or request contents. Reports are deleted after 30 days. A data processing agreement under Art. 28 GDPR is in place with Sentry; any access from the USA is covered by the EU-US Data Privacy Framework or standard contractual clauses. Further information: Sentry privacy policy.

Data is only passed on to other third parties if we are legally obliged to do so.

5Storage period

• Server configuration and module data: as long as the bot is on the server. If the bot leaves the server, the data is deleted after 30 days (a grace period for restoring it after accidental removal). Proof of purchase (see below) and requests for beta access are excluded.
• Clock-in times and absences: as long as the server needs them; server administrators can delete individual entries in the dashboard at any time. Sanctions and bookings are kept as the server's history (bookings are reversed, not deleted); we delete individual entries on request. The server's leadership can delete applications individually in the dashboard at any time; rank history, training records and shifts are kept as the server's history until the bot leaves the server or we delete them on request.
• Mapping of forwarded patrol chat messages: 7 days.
• Dashboard account and session: sessions end after 7 days of inactivity; we delete the account on request.
• Own bot (Premium Plus): until it is removed in the dashboard or the server's data is deleted; we then delete the token and IDs immediately.
• Free trial: 24 months after the trial ends; after that we delete the entry automatically.
• Gift codes: as long as the code exists; deleting the code also deletes all its redemptions.
• Project packages and discount redemptions: for the duration of the contract; thereafter within the retention periods under commercial and tax law insofar as billing is concerned. On request, we delete the link to your account where no retention obligation applies.
• Referral programme: until the data of the servers involved is deleted.
• Error reports (Sentry): 30 days.
• Audit logs: 12 months.
• Invoice and contract data: in accordance with retention periods under commercial and tax law (up to 10 years).

6Cookies and local storage

We only use technically necessary cookies and store some settings locally in your browser. There is no tracking; we do not integrate any advertising, analytics or reach measurement services. No consent is required for this (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). For the same reason, we show a notice rather than a consent request.

In the production environment, the cookies additionally carry the prefixes __Secure- or __Host-. The local storage entries do not leave your browser and are not read by us. You can delete them at any time in your browser settings; you will be signed out, but all other features remain usable.

7Fonts

We serve the fonts used from our own server. They are embedded when the website is built, not loaded at runtime. Opening the page therefore creates no connection to Google or any other font provider, and no IP address is transmitted there.

8Your rights

You have the following rights towards us regarding personal data concerning you:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

To exercise these rights, an email to [email protected] is sufficient – please include your Discord ID so that we can identify you. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence.

9Data security

We use technical and organisational measures to protect your data – including encrypted transmission (TLS), access restrictions, role and permission concepts in the dashboard and regular backups.

10Minors

The Service is aimed at users who have reached the minimum age applicable to Discord. Paid services may only be purchased by adults or by minors with the consent of their parents or guardians.

11Changes

We adapt this privacy policy when the Service or the legal situation changes. You can always find the current version at https://5bot.de/datenschutz.