Privacy Policy
1. Introduction & Scope
Bross ("we", "us", "our") operates the website brossbot.com and a suite of Discord bots including Bross., Bross. Members, Bross. Feedback, BrossGuard, BrossBeats, BrossUtils, and BrossBackup (collectively, the "Services"). This Privacy Policy describes how we collect, use, store, and share information about you when you access or use our Services.
By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our Services.
2. Information We Collect
2.1 Discord OAuth Data
When you sign in to the Bross dashboard via Discord OAuth2, we receive and store the following information granted by the permissions you approve:
- Discord User ID: Your unique Discord identifier, used as your account key across all Bross services.
- Username & Discriminator: Your Discord display name and tag (e.g., username#0000).
- Avatar Hash: Used to display your profile picture in the dashboard.
- Email Address: The email associated with your Discord account, used for transactional communications and account recovery.
- Guild (Server) List: A list of Discord servers you administrate, used to populate your dashboard and link bots to your servers.
We do not request nor store your Discord password, direct messages, or voice data at any time.
2.2 Usage & Operational Data
When you or your server members interact with Bross bots, we may collect:
- Command Logs: The commands executed and their timestamps, retained for debugging and abuse prevention purposes.
- Server Configuration: Settings, role IDs, channel IDs, and preferences you configure through the dashboard or bot commands.
- Member Data (via Bross. Members): Discord user IDs, verification statuses, join dates, and metadata of members in servers where the bot is active. This data is processed on behalf of the server administrator.
- Backup Data (via BrossBackup): Structural data of your Discord server including channel names, role hierarchy, and permission configurations — not message content.
- Error & Diagnostic Logs: Stack traces and error codes to help us diagnose and fix issues.
2.3 Network & Device Data
When you access our website or dashboard, our servers and hosting infrastructure automatically record:
- IP address (truncated to /24 subnet for analytics; full IP retained for up to 7 days for security purposes)
- Browser type and version
- Operating system and device type
- Referring URL and pages visited
- Date, time, and duration of your visit
2.4 Payment & Subscription Data
If you subscribe to a premium plan, payments are processed by our payment processor (Stripe). We receive a subscription record including your plan tier, renewal date, and payment status. We do not store your full card number, CVV, or banking details on our systems.
2.5 Support & Communications
If you contact us via Discord, email, or any other channel, we retain the content of those communications to resolve your inquiry and improve our support quality.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Service Delivery: To authenticate you, link your Discord account to the correct servers, and provide all bot functionality you have configured.
- Security & Fraud Prevention: To detect, investigate, and prevent abuse, spam, and unauthorized access to our Services.
- Service Improvement: To analyze usage patterns, fix bugs, and develop new features based on how the Services are used.
- Customer Support: To respond to your requests, questions, and feedback.
- Legal Compliance: To comply with applicable laws, regulations, and lawful requests from authorities.
- Communications: To send you important service announcements, security alerts, and (with your consent) product updates.
We do not use your data for advertising, behavioral tracking across third-party sites, or any purpose not stated in this policy.
4. Legal Basis for Processing (GDPR)
For users located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:
- Contract Performance (Art. 6(1)(b) GDPR): Processing your Discord account data and server configuration is necessary to provide the Services you have requested.
- Legitimate Interests (Art. 6(1)(f) GDPR): We process network/device data and error logs to maintain the security and performance of our Services.
- Consent (Art. 6(1)(a) GDPR): Where required (e.g., optional analytics cookies), we process data only after obtaining your explicit consent, which you may withdraw at any time.
- Legal Obligation (Art. 6(1)(c) GDPR): We may process data where required to comply with applicable law.
5. Data Sharing & Third Parties
We do not sell, rent, or trade your personal information. We may share data with the following categories of trusted partners, solely to operate our Services:
- Cloud Infrastructure: Our servers are hosted on reputable cloud providers (e.g., Hetzner, Vercel). Data is stored in data centers in the EU and/or US with appropriate safeguards.
- Payment Processing: Stripe, Inc. processes subscription payments. Stripe's privacy policy is available at stripe.com/privacy.
- Discord, Inc.: Our bots operate within Discord's platform. Discord's own privacy policy applies to data processed on their platform.
- Legal Authorities: We may disclose information if required by law, court order, or to protect the rights, property, or safety of Bross, our users, or the public.
All third-party service providers are contractually required to protect your data and may only use it for the specific purposes we engage them for.
6. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Discord OAuth tokens | Until revoked or session expires | Authentication |
| Account profile data | Duration of account + 90 days post-deletion | Service delivery, dispute resolution |
| Server configuration | Until bot is removed from server | Service operation |
| Command / audit logs | 30 days | Security, debugging |
| Server backup data | 180 days or until manually deleted | Backup & restore service |
| Security / IP logs | 7 days (full IP), 90 days (truncated) | Abuse prevention |
| Payment records | 7 years | Legal / tax compliance |
After the applicable retention period, data is permanently deleted or anonymized. You may request early deletion at any time (see Section 8 — Your Rights).
7. Security
We implement appropriate technical and organizational measures to protect your personal information:
- All data in transit is encrypted using TLS 1.2 or higher.
- Sensitive data at rest (tokens, keys) is encrypted using AES-256.
- Access to production systems is restricted to authorized personnel and protected by multi-factor authentication.
- We conduct regular security reviews and dependency audits.
- In the event of a data breach affecting your personal data, we will notify you and relevant supervisory authorities within 72 hours of becoming aware, as required by applicable law.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at [email protected].
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data. Note that some data may be retained for legal obligations.
- Right to Data Portability: Request your data in a machine-readable format (JSON/CSV).
- Right to Object: Object to processing based on legitimate interests.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
- Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.
We will respond to all valid requests within 30 days.
9. Children's Privacy
Our Services are not directed to individuals under the age of 13 (or 16 in certain EEA countries). We do not knowingly collect personal information from children. Since our Services operate through Discord, users must comply with Discord's minimum age requirements. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will promptly delete such information.
10. International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence, including the United States and countries within the EU. When transferring data from the EEA, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to ensure adequate protection.
11. Changes to This Policy
We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via an announcement on our Discord server or a notification in the dashboard. Your continued use of our Services after such changes constitutes your acceptance of the updated policy.
12. Contact Us
For any privacy-related questions, requests, or concerns, please contact us:
- Email: [email protected]
- Discord: discord.gg/nKRcHWJ9WX
- Website: brossbot.com