1. Introduction
1.1 This Privacy Policy explains how Noble Development ("we", "us", "our") handles personal data when you use NobleBot, our Discord bot, when NobleBot runs in a Discord server you're a member of, when you visit our website, and when you contact us.
1.2 It doesn't cover Discord itself. Discord handles your account and the messages you send under its own Privacy Policy.
1.3 Our Terms of Service explain the rules for using NobleBot. The two documents are meant to be read together.
2. Who is responsible for your data
2.1 Noble Development runs NobleBot and is the controller of the personal data described in this policy. You can reach us through a ticket in our support server (fastest) or by email at romix.personal@gmail.com. We answer in English.
2.2 Each server's staff decide which NobleBot features to switch on in their server and how to use them: for example, whom to warn or ban, what reason to write, and which channels receive logs. They are responsible for their own decisions and for the Discord channels they manage. Questions about a decision taken in a particular server are usually best sent to that server's staff. We'll help where we can.
2.3 Discord decides independently how it handles the data on its platform, including messages that NobleBot posts there.
3. What we process and why
3.1 While NobleBot is in a server, Discord gives it information about that server and its members: user, server, channel, role and message IDs; usernames, display names and avatars; roles and permissions; when you joined the server; when your Discord account was created (which can be read from your user ID); voice channel activity; the server's audit log, where NobleBot has permission to read it; and the content of messages in channels NobleBot can see. Most of this is only used at the moment it's needed. The sections below describe what NobleBot keeps.
3.2 Unless a section says otherwise, the legal basis is our legitimate interests (Article 6(1)(f) GDPR) and those of the servers using NobleBot: providing the features a server has chosen, keeping communities safe from spam, scams, raids and abuse, letting staff moderate and keep a record of what they did, and keeping NobleBot secure and working. You can object to this processing (see section 10).
3.3 Messages
- NobleBot reads messages in channels it can see so it can: run text commands (messages starting with the server's prefix or with @NobleBot); check messages, including edited ones, against the automod filters a server has switched on (invite links, scam links, spam, repeated messages, mass mentions, blocked words, excessive caps, emoji or images, ghost pings and pings of protected roles); act on messages posted in honeypot channels; tell people when someone they mention is AFK; count messages and give XP for them, if the server has levels switched on (section 3.8); and post a sticky message again after people talk in its channel.
- NobleBot does not save the content of ordinary messages in its database. It processes them in memory and then discards them.
- NobleBot keeps recent messages in its memory (not its database) until newer messages replace them or NobleBot restarts. If a server has its mod log switched on, NobleBot uses this to post what a deleted or edited message said into the server's log channel. That post becomes a Discord message in the server, managed by the server's staff.
- Text that you or a server's staff deliberately give NobleBot is saved, as described below: reasons for moderation actions, AFK messages, ticket and appeal answers, giveaway prizes and descriptions, welcome, leave and level-up messages, sticky messages, self-role panel texts and blocked-word lists.
3.4 Moderation records
When someone is banned, unbanned, kicked, muted, unmuted, warned or unwarned, put on or taken off a ticket blacklist, or has their roles removed by anti-nuke, NobleBot opens a numbered case for that server. This also covers bans, unbans, kicks and timeouts done through Discord itself or through other bots, which NobleBot reads from the server's audit log. A case contains:
- the case number, the action, the time it happened and the channel it happened in, if any;
- the member's user ID and username, and the moderator's user ID (NobleBot itself for automatic actions);
- the reason, the duration and end time if the action is temporary, and short details (for example "Done outside NobleBot" or "I couldn't DM them about it");
- who last edited the reason and when, which later case removed a warning, and a link to the mod log message.
NobleBot also keeps each member's warnings and punishment history (shown to staff in /profile and /warnings), the end times of running temporary bans and long mutes so it can lift or renew them, and ticket blacklist entries (who, why, by whom and when). It sends the member a direct message about each action. These records let servers moderate consistently, show staff what happened before, end temporary punishments on time and handle appeals.
3.5 Automatic protection features
- Automod, honeypot channels, verification, raid protection and anti-nuke act automatically, following rules each server has set. Their actions are recorded as cases (section 3.4).
- Verification keeps who is waiting to verify and their deadline, recent failed attempts and kicks (the counters reset after a few hours), single-use invites created so people removed by verification can rejoin (unused ones expire after 14 days), and actions staff have queued for a member (kept for up to 30 days). It also checks how old your Discord account is, if the server requires a minimum account age.
- Raid protection and anti-nuke count recent joins and staff actions (such as deleting channels or banning members) in memory only, over the short time window the server has set, and never save them. Anti-nuke reads the server's audit log to do this.
- Scam link detection compares links with public lists of scam domains that NobleBot downloads regularly. No personal data is sent to the providers of those lists.
- These are automated decisions. If you think one was wrong, ask the server's staff, who can review and reverse it. For global bans, which we decide ourselves, see section 5.
3.6 Tickets
When you open a ticket, NobleBot keeps: the ticket number and type, your user ID, the subject and details you entered, who claimed it, which members were added and by whom, whether it's open, locked or closed, when it was opened, last active and closed, who closed it and why, and a link to its log message. If you rate a closed ticket, it keeps your rating (1–5) and optional note.
When a ticket closes, NobleBot creates a transcript of the ticket channel (messages, names, avatars and links to attachments). It sends the transcript to the person who opened the ticket by direct message and posts it in the server's ticket log channel. NobleBot doesn't keep its own copy.
3.7 Server ban appeals
If a server has ban appeals switched on, someone banned there can appeal from the ban message. NobleBot keeps: the appeal number, your user ID and username, the ban's case number and reason, your answers, the status, who decided, when, and any decision note. Questions from staff and your answers are posted in a private appeal channel. When the appeal is decided, a transcript is posted in the server's appeal log channel and the appeal channel is deleted. After a denial, you can appeal the same ban again after 30 days.
3.8 Message counts, levels, AFK and giveaways
- Message counter: how many messages each member has sent in a server since NobleBot joined it. Only the number is kept, not the messages. It's shown in /profile and used for giveaway requirements.
- Levels and XP: if a server switches levels on, members earn XP for sending messages, for time spent talking in voice channels with at least one other person, and for adding reactions. For each member in that server NobleBot keeps: your user ID, your XP and level in that server, your global XP from that server (see below), when your XP last changed, and whether the server's staff ever gave, removed or set your XP by hand. It doesn't save the messages, reactions or voice activity themselves; the short cooldowns between XP gains are kept in memory only. When you reach a level, NobleBot may post a level-up message and give you the role rewards the server set for that level. Your rank and XP are shown in /rank, the server's /leaderboard and its dashboard to anyone in that server.
- Global XP and the server leaderboard: next to a server's own XP, NobleBot counts global XP the same way in every server (NobleBot's default amounts, without the server's own settings or boosters, and never XP given by staff). Each server's global XP is the total its members earned, and /leaderboard global and the leaderboard page on our website show the top 10 servers by name, icon, level and XP. No member is named there. A server can hide itself with the Show on the global leaderboard setting. Your own global XP from every server is added up and shown as your global level in /rank and on your public profile (section 3.21); there is no ranking of people. Resetting your XP in a server doesn't remove your global XP from that server. Both are deleted when the server's data is deleted, and your part is deleted with your data (section 3.22), though the server's total stays, as it no longer says anything about you.
- AFK: your AFK message, when you set it and how many times you were mentioned. It's deleted when you next send a message in that server.
- Saved roles (Sticky Roles): if a server switches Sticky Roles on, NobleBot saves the IDs of the roles you had (not roles from apps) and when, at the moment you leave that server. If you rejoin, it gives you back the roles the server chose to restore and deletes the saved list. A list is deleted after 180 days if you don't come back, when the server's data is deleted, or with your data (section 3.22).
- Giveaways: who hosts it, the prize and description, the requirements (a role, a minimum number of messages, bonus entries for a role), the role pinged, its channel and message, when it ends, and the winners. For each entry: your user ID, your number of entries and when you entered. NobleBot checks your roles and message count when you enter and again when winners are drawn. Winners are announced in the server and told by direct message. A giveaway and its entries are deleted 7 days after it ends or is cancelled.
3.9 Server settings
NobleBot keeps each server's configuration: which features are on, the channels, roles and categories they use, limits and options, welcome and leave messages, blocked words, ticket types, the text-command prefix, announcement settings and a Noble Pro accent color. When a channel is locked, it keeps the channel's previous permissions (which can include member IDs), who locked it and why, until it's unlocked. It also keeps totals, such as how many people a server's honeypot or verification caught.
For sticky messages it keeps the channel, the text, an optional accent color, the message it last posted, the user ID of the staff member who set it up and when. For self-role panels it keeps the channel, the text, the roles on offer, the panel's message and the user ID of the staff member who made it. Which self roles you pick is a change to your Discord roles and isn't saved by NobleBot. For levels it keeps the XP settings, the role rewards, the XP boosters for roles and channels, and the user ID of the staff member who switched levels on.
For Auto Mention it keeps each rule's trigger (a member joining, being verified, or a timer), its channels, who it pings (a role, @everyone, @here, the member or every member), when a timer runs next, and the user ID of the staff member who made it. The ping is deleted right away and isn't saved; members waiting to be pinged after a join are only held in memory for about 2 seconds. For dashboard messages it keeps each message's name, its content (text, image links, buttons and accent color), the channel and the posted message, and the user IDs of the staff members who made and last changed it, with the times.
For who can buy Noble Pro for a server it keeps the rule the owner chose (people with Manage Server, anyone, certain roles or certain people), the role IDs and user IDs on its list, and the user ID of the owner who last changed it, with the time. If you're on such a list, you're removed from it and from its change history when your data is deleted.
Change history: when staff change a setting with /config or on the dashboard, NobleBot records the staff member's user ID, the feature, whether it was done with /config or on the dashboard, each changed value before and after, and the time. Server staff with Manage Server can read this on the dashboard, so they can see who changed what. Each entry is deleted after 90 days.
3.10 Noble Pro
For each server with Pro we keep: the server ID, the user ID of the person who bought it or was given it (if any), when it started and ends, and an internal note. That person receives the "Noble Pro" role in our support server while one of their servers has Pro.
Buying Pro: when you buy a subscription (Terms, section 12), Paddle sells it to you as the Merchant of Record and handles the payment, your receipts, taxes and refunds, so we never receive card or bank details. Paddle collects your email address, country and payment details under its own privacy policy. Paddle sends us, and we keep with your Discord user ID: the subscription and transaction IDs, the plan, its status, the billing dates, the amount and currency, and whether a payment failed. We also keep which server each subscription is on, when it was moved, when you cancelled, and whether you've had the one-time full refund (Terms, section 12.7). We use this data only to deliver Pro, answer your questions, prevent refund abuse, and keep the records accounting and tax law require. We never use it for marketing. A server's owner can remove Pro that someone else bought from their server. We then keep which server it was, who removed it and when, so the buyer can use that slot on another server a day later. The record is deleted once the slot gets a new server, otherwise it's kept with the subscription's records, and the remover's user ID is removed when their data is deleted. The legal basis is the contract with you (Article 6(1)(b) GDPR), our legitimate interest in preventing refund abuse and, for payment records, our legal obligation (Article 6(1)(c) GDPR).
3.11 Developer announcements
We sometimes post announcements about NobleBot in servers that use it. Server staff can turn this off, choose the channel and choose which roles are pinged. Only those settings are kept.
3.12 Messages NobleBot sends you
NobleBot may send you direct messages about moderation actions taken against you and their removal, appeals, global bans, giveaways you won, tickets you opened and, if you own a server, protection alerts and notices about NobleBot leaving. Discord stores these messages as part of your DMs. NobleBot only notes whether a message could be delivered.
3.13 Technical logs
NobleBot writes a technical log of events and errors. An entry can include the time, what happened, the server's name and ID, your username and user ID, and the command, button or form involved. We use it to fix problems and investigate abuse. The log stays on NobleBot's server for 14 days and is then deleted automatically. We don't copy it anywhere else.
3.14 Our website
3.14.1 Hosting and request logs. Our website and dashboard run on the same server as NobleBot, hosted by Space-Node in the EU. To deliver pages and protect the site from attacks, the server handles your IP address, browser details, the page requested and the time. Our request log also notes, for dashboard changes, the Discord user ID, the server ID and the kind of change. We keep the request log for up to 30 days.
3.14.2 Logging in with Discord. The dashboard, the admin panel and the global ban appeal page need a Discord login. Discord asks you to share your account (identify: user ID, username, display name and avatar) and your list of servers (guilds). We never see your password, email or messages. We keep a session: your user ID, username, display name, avatar, when you logged in and were last active, and the access tokens Discord gave us, encrypted with AES-256-GCM. Your server list is held in memory for about a minute so pages load quickly. The session ends after 30 days without a new login, or when you log out, which also tells Discord to cancel the tokens. The legal basis is the contract with you: you asked to use the dashboard (Article 6(1)(b) GDPR).
3.14.3 Cookies. We set one cookie, noble_session, which keeps you logged in.
It's only readable by our server and only sent to our own site. During login we also set a short-lived
noble_oauth cookie (10 minutes) that protects the login from forgery. Both are strictly
necessary, so they don't need consent. We don't use advertising or third-party cookies. Our
Cookie Policy lists every cookie and browser storage item with its lifetime.
3.14.4 Dashboard actions. Everything you do in the dashboard goes through NobleBot, which checks your current permissions in that server every time. A ban, mute or warning made there is the same as one made with a command: it gets a case (section 3.4) with the note "Done from the NobleBot dashboard", and the member gets the usual direct message. Settings you change are saved like changes made with /config, including the change history (section 3.9). Ticket transcripts shown on the dashboard are loaded from the server's ticket log channel each time and aren't stored by the website.
3.14.5 Exporting and importing cases. Staff can download a server's cases as a CSV or JSON file (case details as in section 3.4, including member names and user IDs). The file is made in the staff member's browser; the server's staff are then responsible for it. Staff with Manage Server can import such a file into another server they manage. The imported cases get new case numbers there and are marked as imported from the original server. Importing never bans, mutes or messages anyone.
3.15 Website analytics
3.15.1 Only if you choose Allow analytics in the banner, our own analytics (no other company is involved) records which pages you open, which links and buttons you click, how long a page stays open, the website that sent you (its domain only), and whether you use a phone, tablet or desktop. On public pages it also saves where on the page you clicked (a position and your screen width, not what was under it), so we can draw a heatmap of the page. A random visitor ID is saved in your browser's local storage, so we can count visitors rather than page views. Numbers in addresses, like server and user IDs, are removed before anything is saved. We don't record your IP address, Discord account or what you type.
3.15.2 We use it to see which pages help people and where they get stuck. The legal basis is your consent (Article 6(1)(a) GDPR). You can change your mind any time with Analytics choice at the bottom of every page; saying no deletes the visitor ID from your browser. Analytics data is deleted after 180 days.
3.16 Global ban appeals on the website
If you're globally banned, you can appeal at our appeal page after logging in. We keep your user ID and name, the ban's reason and start date, your answers, the status, and who decided, when and why. A decided appeal is deleted 30 days after the decision; an appeal that's still open when your ban ends is closed and deleted 30 days later.
3.17 When you contact us
Tickets in our support server are handled by NobleBot like tickets in any other server (section 3.6), and your messages there are stored by Discord. If you email us, your email is stored by Google, which provides our email service. We keep emails until your request is resolved and for up to 12 months afterwards, in case of follow-up questions. When we handle a request about your rights, the legal basis is our legal obligation to answer it (Article 6(1)(c) GDPR).
3.18 Public statistics
We may publish totals, such as how many servers and members NobleBot serves or how many accounts its protection features have caught. These are numbers only. They never include user IDs, server IDs or names, so nobody can be identified from them. The live counts on our home page (servers, members and servers with Noble Pro) are totals only.
For the developers' own statistics NobleBot counts, per day, how often each command was used (as a slash or text command) and how often it failed, and how many servers added or removed NobleBot. These counts hold no user IDs, server IDs or names and are deleted after 400 days.
3.19 Your messages from NobleBot on the website
3.19.1 Every direct message NobleBot sends you, such as a ban, mute or warning notice, a ticket transcript or a giveaway win, is also saved so you can read it under Notifications after logging in. We keep your user ID, the server it's about (its ID and name), the message text, its link buttons, the names of attached files (not the files), whether Discord delivered the DM, whether you've read it, and when it was sent. If your DMs are closed, the website is the only place you can read it. The legal basis is our legitimate interest in making sure you can see what was decided about you (Article 6(1)(f) GDPR).
3.19.2 You can delete any of these messages, or all of them, at any time. We also save when you last logged in to the website. If you haven't logged in for 90 days, messages older than 90 days are deleted, and you get one notification saying so.
3.19.3 When the NobleBot developers publish a news post, we save a notice for you under Notifications so you can open it from the bell. For each post we keep which post it was about, when it was sent and whether you've read it. We also keep your choice to turn news notifications on or off. We keep at most 50 news notices per person. They are deleted after 90 days, when you delete them, and when your data deletion request runs. The legal basis is our legitimate interest in telling users about changes to the service (Article 6(1)(f) GDPR).
3.19.4 News posts are public. A post shows the Discord display name and avatar of the developer who wrote it, together with when it was published. If a developer's data is deleted, their name on past posts is replaced with "Noble Development" and the avatar is removed.
3.20 Website settings
The settings page saves your choices for motion, underlined links and screen reader mode in your browser. When you're logged in, they're also saved with your user ID so they follow you to other devices. They're kept until you change them or your data is deleted.
3.21 Public profiles and badges
3.21.1 If you've logged in to our website in the last 90 days, you have a public profile page at
/u/<your user ID>. It shows your Discord display name, username, avatar, banner and
profile color, when your Discord account was created, your badges, your global level
(section 3.8), and whether you're a member of our Noble Development Discord server
and since when. This information is loaded from Discord and NobleBot when someone opens the page and
isn't stored by the website. Profiles of people who haven't logged in for 90 days aren't shown.
3.21.2 You can switch your profile off with Hide my profile on the settings page. We keep that choice (your user ID, whether it's hidden and when you changed it) until you change it or your data is deleted. A hidden profile is only visible to you.
3.21.3 The NobleBot developers can give people badges, shown next to your name on our website. For each badge you hold we keep your user ID, which badge, who gave it (or that NobleBot gave it automatically) and when. Some badges come with a role in our Noble Development server. You get a direct message when a developer gives you one.
3.21.4 Some badges are given automatically: for boosting or being a member of our Noble Development server (we read the boost and join dates Discord already shows there), for owning or buying a server with Noble Pro, or for adding NobleBot to a server. For that last one, when NobleBot joins a server it reads that server's audit log (only if it has View Audit Log) to see who added it, and keeps the server's ID, that person's user ID and when it was added. That record is deleted with the server's other data (section 6) or when your data is deleted. A badge set to follow its condition is taken back when you no longer meet it. The legal basis for profiles and badges is our legitimate interest in letting the community recognise people and their activity (Article 6(1)(f) GDPR). You can object at any time (section 10).
3.22 Asking us to delete your data
3.22.1 Logged in, you can ask for your personal data to be deleted on the settings page. To make sure it's really you, you pass Cloudflare Turnstile's human check and then log in with Discord again. We keep the request (your user ID and name, your optional note, the browser's analytics visitor ID and the dates) and carry it out 7 days later. Until then you can cancel it, and so can we, for example when the request looks like it wasn't made by you.
3.22.2 We then delete your messages from NobleBot on the website, message counts, XP and levels in every server, AFK statuses, the roles servers saved to give back if you rejoin, giveaway entries, ticket ratings and notes, badges, your profile choice, website settings and logins, your login sessions, and the analytics from the browser you made the request in, and NobleBot DMs you that it's done. We keep moderation records (cases, warnings, punishments, timed punishments, global bans and appeals), because servers have a legitimate interest in a record of what happened (section 10). We also keep payment records for as long as accounting and tax law requires (section 3.10). After the deletion, we keep a short record that it happened (user ID, name and dates) for 30 days, then delete that too.
4. When NobleBot is removed from a server
- When NobleBot is removed from a server, or the server is deleted, that server's data (sections 3.4–3.9) is kept for 16 days and then deleted automatically. If NobleBot is added back within that time, the data is kept and everything works as before. A server's owner can ask us to delete it sooner.
- Until then we keep a record of the server's ID, its owner's user ID, when NobleBot left and when the data will be deleted.
- If NobleBot left because the server's owner is globally banned (section 5), the same 16 days apply. Adding NobleBot back only keeps the data if the owner is no longer globally banned.
- Messages NobleBot already posted in the server, such as log messages and transcripts, are Discord messages. They stay until the server's staff delete them.
- If you leave a server, the data about you stays with that server's data (for example its moderation cases), because the server's moderation history depends on it.
5. Global bans
5.1 Purpose. A global ban protects servers that use NobleBot, and NobleBot itself, from scammers, raiders, accounts spreading malicious links, malicious automated accounts, and people who seriously or repeatedly break our Terms of Service.
5.2 Who decides. Only Noble Development's developers can issue a global ban, after reviewing the case themselves. Global bans are never issued automatically.
5.3 What we keep. Your user ID, the reason, the user ID of the developer who issued it, when it started and when it ends, and the servers where NobleBot banned you because of it, with the time of each ban.
5.4 Effects. While a global ban is active:
- you can't use NobleBot's commands. Slash commands reply with the reason, the end date and how to appeal, and text commands are ignored;
- in servers that have switched global bans on (it's off by default), NobleBot bans you straight away and bans you automatically if you join later. Each ban is recorded as a case in that server;
- if you own a server that uses NobleBot, NobleBot sends you a message, posts a notice in the server and leaves it, even if that server never switched global bans on. The server's data is then handled as described in section 4.
5.5 How long. Every global ban has an end date, set when it's issued, at most 3 years later. When it ends, or if we lift it earlier, it's deleted from the global ban list. NobleBot removes the bans it placed because of it (unless a server already removed them), tells you by direct message and deletes its list of those servers. The ban and unban cases remain part of each server's moderation records.
5.6 Appeals. You can appeal on our appeal page (section 3.16). If you can't use it, open a ticket in our support server or email romix.personal@gmail.com. A person reviews every appeal and we'll tell you the decision and the reasons by direct message. If an appeal is rejected, you can appeal again after 30 days.
5.7 Legal basis. Our legitimate interest, and that of participating servers, in protecting communities from scams, raids and abuse (Article 6(1)(f) GDPR). You can object at any time, and the appeal is how you get a person to look at the decision again.
6. How long we keep data
| Data | How long |
|---|---|
| Ordinary message content | Not saved. Recent messages stay in memory only until newer messages replace them or NobleBot restarts. |
| Server data: settings, cases, warnings, punishment history, tickets, ratings, appeals, message counts, XP and levels, sticky messages, self-role panels, verification records, channel locks | While NobleBot is in the server, then 16 days after it's removed |
| Change history of a server's settings | 90 days, or sooner if the server's data is deleted |
| Temporary bans and long mutes | Until they end or are lifted (the case stays with the server data) |
| AFK status | Until your next message in that server |
| Roles saved when you leave a server with Sticky Roles on | Until you rejoin, at most 180 days |
| Giveaways and their entries | 7 days after the giveaway ends or is cancelled |
| Queued verification actions | Up to 30 days |
| Global bans and the list of servers where NobleBot banned you | Until the ban ends (at most 3 years) or is lifted |
| Global ban appeals | 30 days after the decision, or after the ban ends |
| Your messages from NobleBot on the website | Until you delete them, or once they're 90 days old if you haven't logged in for 90 days |
| When you last logged in to the website | 90 days after your last login |
| Website login sessions | Until you log out, or 30 days |
| Website analytics (only with your consent) | 180 days |
| Record of a removed server waiting for deletion | Until the data is deleted or NobleBot is added back |
| Noble Pro records | While Pro is active and for 12 months after it ends |
| Who can buy Noble Pro for a server (the rule and its lists) | Until the owner changes it, the server's data is deleted, or your data is deleted |
| Badges you hold | Until a developer takes the badge back, an automatic badge's condition ends, or your data is deleted |
| Who added NobleBot to a server (for automatic badges) | Until the server's data is deleted (2 weeks after NobleBot leaves) or your data is deleted |
| Your choice to hide your profile | Until you change it or your data is deleted |
| Website settings | Until you change them or your data is deleted |
| Data deletion requests | Until carried out (7 days after the request) or cancelled, then a short record for 30 days |
| Payment records: the details Paddle sends us, renewals, cancellations, refunds and server moves | As long as accounting and tax law requires (8 years in Hungary), even after a data deletion request |
| Your subscription choices (plan and server) | While your subscription runs and for 12 months after it ends, or until your data is deleted |
| Subscription emails waiting to be sent | Until sent, or at most a day if sending keeps failing |
| Emails to us | Until your request is resolved and for up to 12 months afterwards |
| NobleBot's technical logs | 14 days |
| Website server logs | Up to 30 days |
| Backups | 14 days (section 9) |
We may keep specific data longer if we need it to establish, exercise or defend legal claims, or if the law requires us to. In that case we keep only what's needed, and only for as long as it's needed.
7. Who receives data
- Discord, because NobleBot works entirely through Discord. Discord acts as a separate controller under its own Privacy Policy.
- Space-Node, which hosts NobleBot, our website, the dashboard and their databases in the European Union. It processes data only on our behalf.
- Google, which provides our email service, if you email us.
- Paddle, if you buy Noble Pro. As the Merchant of Record it takes the payment as a separate controller under its own privacy policy and sends us the payment details described in section 3.10.
- Server staff and members. What NobleBot posts in a server can be seen by anyone who can see that channel: for example, welcome messages show your name, giveaway results mention the winners, and log channels show cases to staff.
- Cloudflare, only when you ask us to delete your data: its Turnstile check receives your IP address and browser details to tell people from bots (Turnstile privacy addendum).
- Authorities, if the law requires us to share data with them.
We don't sell personal data and don't share it for advertising.
8. Transfers outside the EU
Discord, Google and Cloudflare are based in the United States. All three say they take part in the EU-US Data Privacy Framework, which the European Commission has found to provide adequate protection. If you buy Noble Pro, Paddle (Paddle.com Market Limited, United Kingdom, covered by an EU adequacy decision) and its payment providers may also process your data outside the EU, under the Data Privacy Framework or the European Commission's standard contractual clauses. NobleBot, our website and our backups are kept in the EU.
9. Security and backups
9.1 Access to NobleBot's server, its database and its Discord login is limited to Noble Development. NobleBot only asks Discord for the permissions its features need. The website talks to NobleBot over an encrypted, authenticated connection, never trusts the browser about who you are, and stores session tokens only as hashes.
9.2 Once a day, we back up NobleBot's and the website's databases. The backups stay on NobleBot's server in the EU, and only we can open them. Each backup is deleted 14 days after it's made, so data we delete can stay in a backup for up to 14 days. Backups are only used to recover from a failure. If we ever restore one, we delete again any data that should already have been deleted, including data you asked us to delete.
9.3 If a data breach puts your rights at risk, we'll report it to the competent data protection authority within 72 hours where required, and tell you directly if the risk is high.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct data that's wrong;
- have data deleted, for example when it's no longer needed;
- restrict how we use your data while a question about it is being resolved;
- object to processing based on legitimate interests. We'll stop unless we have compelling reasons that override your interests, or need the data for legal claims;
- data portability, where it applies;
- not to be subject to a decision based only on automated processing that significantly affects you, and to have a person review it.
You can get a copy yourself at any time: log in to the website and press Download my data
in Settings. The file holds what the website and NobleBot keep about you (your account, settings and
notifications, your levels, badges, giveaway entries, tickets you opened, and moderation records about
you) plus what you did as server staff. To protect the staff members involved, moderation records about
you show them as [STAFF ID], and other people mentioned in reasons as [HIDDEN USER].
If you need more than the file gives you, ask us as described below.
Requests to delete moderation records are weighed against the server's legitimate interest in keeping a record of what happened, so they aren't always granted. If we refuse a request, we'll explain why.
To use your rights, open a ticket in our support server or email romix.personal@gmail.com. We may ask you to confirm that the Discord account is yours, for example by contacting us from it. We answer within one month, free of charge. For complex requests this can be extended by up to two more months, and we'll tell you if it is.
You can also complain to a data protection authority, in particular in the EU country where you live or work, or where you think the law was broken. You can also go to court.
11. Age requirements
NobleBot is only for people who meet Discord's minimum age in their country, and at least 13. We don't ask for your age. If you believe a child below that age has given us personal data, for example in a ticket or appeal, contact us and we'll delete it.
12. Changes to this policy
We'll update this policy when NobleBot or the law changes. The date at the top shows the latest version. We announce significant changes in our support server before they apply.
13. Contact
Noble Development · Support server: discord.gg/aErhgjS7Nu · Email: romix.personal@gmail.com · Language: English.