Privacy policy

1. Controller

The controller for data processing at Sidekick is Timon Sost, Hohnstorfer Str. 11, 29553 Bienenbüttel, Germany, email: [email protected].

Which modules run on a Discord server and how they are set up (e.g. logs, welcome, levels) is decided by that server’s team. Server owners therefore share responsibility for the use on their server and should inform their members about it.

2. Overview

Sidekick is a Discord bot with a web dashboard. We only process data needed for the features a server has switched on. We do not sell data, show no ads and use no tracking or analytics services. Fonts are delivered by our own server.

3. Data on Discord servers

Depending on the modules switched on, Sidekick stores: Discord IDs of servers, channels, roles and members; moderation cases (type, reason, time, moderator); level, XP, number of messages and voice minutes; credits and reputation; copies of messages so that deleted or edited messages appear in the log channel; log entries; ticket transcripts and answers from ticket forms; invites (who invited whom); game progress (counting, emoji quiz) and puzzle suggestions; birthdays and profile texts given voluntarily; ban appeals (text and decision).

Sidekick only reads the content of messages as far as a module needs it (e.g. Automod, auto-responses, logs, games). Automod deletes or punishes messages according to rules set by the server team; appeals are always decided by a person.

4. Website, dashboard and login

When you open sidekickbot.de, technically necessary data is processed (IP address, time, page requested, browser details) to deliver the page and protect it against attacks. This data is not combined into profiles.

Login works via Discord (OAuth2, scopes “identify” and “guilds”). We receive your Discord ID, your name, your avatar and the list of your servers. The session is kept for at most 7 days; Discord’s access key is stored encrypted in our database. Changes made in the dashboard are recorded with name and time in the server’s change log.

Cookies: “sk_session” (login), short-lived cookies for the login process and cookies for language and appearance. All of them are technically necessary (§ 25 (2) TDDDG); there are no tracking cookies. Your browser also remembers whether you hid notices such as the invitation to the support server.

The number of people online on our support server is fetched by our server from Discord – your browser does not connect to Discord for it. Only when you click a link to Discord do Discord’s privacy terms apply.

5. Purposes and legal bases

Providing the bot and the dashboard to server owners and logged-in users: Art. 6 (1) (b) GDPR (contract or pre-contractual measures).

Processing data of a server’s members, e.g. moderation, protection against spam, scams and attacks, logs, levels and games: Art. 6 (1) (f) GDPR. The legitimate interest is running servers safely, keeping moderation traceable and offering the features the server wants.

Voluntary details such as birthday, profile text or puzzle suggestions: Art. 6 (1) (a) and (b) GDPR. You can change them yourself or have them deleted at any time.

Security and troubleshooting (technical logs, backups): Art. 6 (1) (f) GDPR.

6. Recipients and processors

Discord Inc. (USA): Sidekick works through Discord’s interfaces. Discord processes data under its own responsibility; Discord’s privacy policy applies as well.

Hosting: Wispbyte (Butnaru Ioana Ancuta I.I., Romania). Bot, database and dashboard run on servers in Romania (EU).

Cloudflare, Inc. (USA): forwards requests to sidekickbot.de to our servers in encrypted form and sees technical data such as IP addresses; Cloudflare also forwards emails sent to [email protected].

Google Ireland Ltd. / Google LLC: emails to [email protected] end up in our Gmail mailbox.

Where required, data processing agreements under Art. 28 GDPR are in place with these service providers.

7. Transfers to third countries

Discord, Cloudflare and Google also process data in the USA. The transfer is based on the EU Commission’s adequacy decision for the EU-US Data Privacy Framework, under which these companies are certified, and additionally on the EU Commission’s standard contractual clauses.

8. Storage period

Message copies and log entries: 7 days (with Premium up to 90 days). Ticket transcripts: 30 days (with Premium up to 1 year). Dashboard change log: 90 days. Dashboard sessions: at most 7 days. Database backups: 7 days on the server, copies with the operator at most 30 days.

Other data (e.g. levels, moderation cases) stays until the server deletes it in the dashboard or Sidekick leaves the server – then all data of that server is deleted after 30 days. Emails are kept as long as needed to handle the request and to meet legal retention duties.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you gave at any time with effect for the future.

Right to object (Art. 21 GDPR): where processing is based on our legitimate interest, you can object at any time on grounds relating to your particular situation.

Write to [email protected] for this; please include your Discord ID so we can find your data. You can also lodge a complaint with a data protection supervisory authority, e.g. the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

10. Obligation to provide data, age

You are not obliged to provide data. Without processing by Sidekick, however, its features cannot be used on a server. Sidekick is meant for people who may use Discord under Discord’s terms.

11. Changes

We update this policy when Sidekick or the law changes. The version published here always applies.