Privacy Policy

The controller responsible for data processing on this website and through the AutoMod Discord bot is:

Paul Schaper
Im Rehmen 20
29358 Eicklingen, Germany
Email: [email protected]

When you visit this website, our servers automatically collect general access data, such as browser type and version, the operating system used, referring pages, and the date and time of access. This information is technically necessary to deliver the website to you and is used for security and diagnostic purposes only.

When AutoMod is added to a Discord server, it processes Discord data made available to it through Discord's API in order to provide moderation and community features. Depending on which features are enabled, this may include:

• Message content, for automated moderation, logging, and command handling
• Reactions, for reaction roles and starboard functionality
• Channel and role information, to enforce permissions and automation rules
• Member join/leave events and role assignments

The dashboard uses a cookie to store your session and API access token after you sign in with Discord. This allows you to remain logged in across visits without re-authenticating every time. We do not use cookies for advertising or third-party tracking purposes.

We process personal data on the basis of Art. 6(1)(a) GDPR (consent, e.g. when you authorize AutoMod via Discord OAuth) and Art. 6(1)(f) GDPR (legitimate interest in providing reliable and secure moderation services to server owners and their communities).

Data associated with a Discord account is retained only for as long as necessary to provide the service. Should AutoMod be removed from a server, or should a user request deletion, associated data is removed from our systems within seven days, except for the Server Protection records described below, which are kept for a limited time to rebuild a server after an attack, and the pseudonymized usage statistics described below, which are deleted after 13 months. Session tokens are only retained for as long as they remain valid.

Under the GDPR, you have the right to:

• Request confirmation of whether we process data concerning you
• Request access to, correction, or deletion of your data
• Request a portable copy of your data
• Object to or request restriction of processing

To exercise any of these rights, please contact us using the details above.

When a server's administrators turn on the Invite Tracker, AutoMod stores for every member who joins that server: their Discord user ID and display name, the invite code they used and the user ID of the member who created it, how they joined (invite, vanity URL or Server Discovery), when they joined and left, and whether the join was flagged as fake (own invite, very new account, leaving shortly after joining) or as a rejoin. For each inviter it stores their user ID, display name, avatar link and invite counts.

This data is used to show the server's administrators who invited whom, invite rankings, statistics, join and leave announcements and invite competitions (Art. 6(1)(f) GDPR, the legitimate interest of server operators in understanding how their community grows and keeping it free of fake accounts). Members can see invite counts and rankings in the server through the bot's commands. If a server shows its top inviters on its public server page, their display names, avatars and invite counts are visible there.

The join and leave history is kept for 30 days, one year or two years, depending on the server's plan. The record of a member who left is kept for 180 days so a rejoin isn't counted as a new invite. Daily statistics per invite code contain no user data and are kept for up to 400 days. Invite counts are kept until the server resets them or AutoMod is removed from the server.

When a server's administrators connect a Twitch or Kick channel on the Integrations page, AutoMod stores the channel's name and ID and the OAuth tokens Twitch or Kick issued (encrypted). They are used to receive the channel's events (stream status, follows, subscriptions, gifted subscriptions, bits, KICKs, raids and channel points redemptions) for the server's notifications, automations and supporter roles. Disconnecting deletes the tokens.

Members can link their own Twitch or Kick account on their AutoMod profile. AutoMod then stores the account's ID, name and display name together with the member's Discord user ID, and nothing else: the token used to identify the account is revoked right away. The link lets servers whose connected channel the member supports give them supporter roles and lets automations recognize them (Art. 6(1)(a) GDPR, consent). Members can unlink at any time on their profile, which deletes the link immediately; roles earned through it are removed at the next sync.

For connected channels with supporter roles, AutoMod stores which viewer IDs currently subscribe to or follow the channel, with the subscription tier and end date, as reported by Twitch or Kick (Art. 6(1)(f) GDPR, the server operator's legitimate interest in rewarding supporters). A subscription is deleted once Twitch reports it ended or, for Kick, once it expired. AutoMod also records which supporter roles it gave a member, so it only ever removes those; the record is deleted together with the roles.

When a server's administrators turn on Server Protection, AutoMod processes the server's audit log events (who did which protected action, such as deleting channels or banning members, and which channels, roles or members it affected) and member joins (user ID, account creation date, whether the account has a default avatar, and the username, to recognize groups of similar accounts). Messages of members who joined within the last 24 hours are compared in memory to spot identical messages sent by many new members; their content is not stored, only a short hash is kept in memory for 30 seconds. When Server Protection acts, it stores an incident with the user ID and name of the member concerned, what happened and what was done (kept for 90 days), the roles taken away during a quarantine (until it is lifted), and the state of an ongoing raid mode (until it ends).

To rebuild a server after an attack, AutoMod stores snapshots of its roles, channels and their permission settings. Permission settings can contain the user IDs of individual members. Depending on the server's plan, the newest snapshots or those of the last 7 or 30 days are kept. As an exception to the general retention rule, snapshots, incidents and restore records are kept for up to 35 days (snapshots taken by hand: up to 90 days) after AutoMod is removed from a server, because attackers often remove the bot first; they are then deleted automatically. The learned join rate per hour contains no personal data.

Network signals: when Server Protection stops an account automatically in a server that shares its detections (on by default, can be turned off), AutoMod stores the account's user ID, what it was stopped for (a raid, an attack or a spam wave) and when, and the reporting server only as a one-way keyed hash. When the account joins another server that checks joining accounts, that server learns how many other servers stopped the account and for what, never which servers. Reports are only accepted from servers with at least 50 members that have had AutoMod for at least 7 days, only automatic detections count, and an account's reports are deleted 30 days after the newest one.

This processing is based on Art. 6(1)(f) GDPR: the legitimate interest of server operators and their members in protecting their communities from destructive attacks, raids and spam, including coordinated attacks across several servers. You can object to the processing or request deletion of your network reports using the contact details above.

To understand how AutoMod is set up and used, and to improve it, we record a small set of usage events ourselves, without cookies, third-party tools or tracking scripts: clicks on "Add to Discord" and the page they came from, AutoMod being added to or removed from a server (with the server's member count, how many days AutoMod was kept and whether the setup assistant was completed), and progress through the setup assistant and the dashboard tour (for example the chosen server type, protection level and features). Each event is stored with the server ID and, if you are signed in, a one-way keyed hash of your Discord ID, never the ID itself or your name. Message content is never included.

To avoid counting the same click many times, the IP address of a click is only turned into a one-way keyed hash, which is deleted after one hour. Usage events are deleted automatically after 13 months and are only evaluated in aggregate.

When the setup assistant changes a server's settings, it keeps the previous settings for 24 hours so the change can be undone, and then deletes them automatically.

Legal basis is Art. 6(1)(f) GDPR: our legitimate interest in making it easy to get started with AutoMod and in improving its features. You can object to this processing using the contact details above.

When you buy a membership, pass, gift or tip from a server's store, we store your Discord user ID, display name, what you bought, its status and dates, and references to the related Stripe objects. We need this to deliver your perks (roles), show your memberships and handle renewals, cancellations, refunds and gifts (Art. 6(1)(b) GDPR).

Payments are processed by Stripe on the seller's own Stripe account. Your payment details are entered on Stripe's page and never reach AutoMod. Stripe and the seller (the server owner) receive the data needed for the payment, such as your name, email address and billing address, and process it under their own responsibility and privacy policies.

Purchase and payment records are kept for as long as they're needed for the contract and to comply with legal retention duties (for example, accounting records of AutoMod's fees for up to ten years). This overrides the shorter retention described above for these records only.

If you report a store, we store your report and, if you're signed in, your Discord user ID to review it (Art. 6(1)(f) GDPR, our legitimate interest in keeping stores safe and lawful).

When you buy Premium or Pro inside Discord, Discord tells us about the purchase (an entitlement): its ID, the plan, the server it's for, your Discord user ID and when it starts and ends. We store this to unlock the plan on that server and to show it in your billing settings (Art. 6(1)(b) GDPR). Your payment details are handled by Discord and never reach AutoMod.

We keep these records while the subscription runs and afterwards for as long as we need them to answer questions about past purchases and to meet legal retention duties.

Some features use artificial intelligence provided by OpenAI (OpenAI, L.L.C. and its affiliates): the AI Builder in Automations including voice input, "Write with AI" in message editors, the AI action in Automations, AI ticket summaries and reply suggestions, and AI Moderation. When they're used, the text or recording entered and, where needed, the server's channel, role and automation names are sent to OpenAI to generate the answer. The AI action in Automations and the ticket features send the content the server admin configured them to process, such as member messages or a ticket's conversation. AI Moderation sends the content of checked messages to OpenAI's moderation service.

OpenAI processes this data on our behalf and, according to its API terms, does not use it to train its models. Data may be processed in the United States; the transfer is based on the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. OpenAI may keep API data for up to 30 days for abuse monitoring.

We store AI Builder conversations, drafts and versions with the server's automations until they are deleted, and per-day credit usage counters for up to 40 days. We use a pseudonymized server identifier for OpenAI's abuse detection, never your Discord ID or name.

Legal basis is Art. 6(1)(b) GDPR (providing the features you request) and, for AI Moderation, Art. 6(1)(f) GDPR (the server's legitimate interest in moderation). Please don't enter personal data into AI features that isn't needed. The "ChatGPT (own key)" plugin sends requests with the server's own OpenAI key; for those, the server owner and OpenAI are responsible.

AutoMod's moderation actions are configured and controlled by the respective server's administrators. Server Protection can act on its own when its rules, raid detection or network signals detect an attack, for example by quarantining, kicking or banning an account. These measures only concern access to an individual Discord server, are logged for the server's administrators, and can be reviewed and reversed by them at any time. We do not make decisions that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR.