Privacy Policy

Last updated: November 9, 2026

In short

We store what the bot and the dashboard need to work. No advertising, no tracking, no analytics.
We do not sell your data, and no model is trained on it.
To answer a ticket, the assistant sends it to Groq or Anthropic in the US. A server that switches the assistant off sends nothing.
When the bot leaves a server, that server’s data is deleted 48 hours later. Payment records stay for the ten years tax law requires.
On your profile page you can see your data, download it and delete it.

1. Who is responsible

GuildOtter is operated by Otter Development from Germany. Name and postal address are in the imprint. We have not appointed a data protection officer; the operation stays below the thresholds of § 38 BDSG.

We are the controller (Art. 4 (7) GDPR) for your account, payments and our own security and error logs.
The server’s operator is the controller for what happens inside their server: tickets, transcripts, ratings, the assistant’s answers and whatever a module stores. There we are their processor (Art. 28 GDPR) and follow the settings they choose in the dashboard.
One exception. Reports about a wrong reaction of the assistant (section 4) are stored with names and IDs replaced by roles, and we read them to fix the assistant for every server. That is our own legitimate interest under Art. 6 (1) (f) GDPR.

2. Your account and payments

Sign-in. Your Discord ID, username, avatar and the e-mail address Discord verified. ID, name and avatar sign you in and show which servers you manage. The address is used only for the few notices worth a mail, such as the receipt for a deletion request; never for newsletters, never passed on, and it goes when your session goes. The cookie dash_session keeps you signed in and expires after a period of inactivity.
Payments. Subscriptions and token packs are sold by our reseller Paddle (Paddle.com Market Limited), the merchant of record: Paddle takes the payment, issues the invoice and handles taxes, as a controller of its own under its privacy policy. Paddle tells us the plan, the status, the dates and the e-mail address given at checkout. We never see your card.
Your declaration before paying. You tick that you read the terms and that the service may begin during the withdrawal period. As evidence we keep the wording you saw, the time, your Discord ID, the IP address and the browser. It is the only place we keep an IP address.
Mail log. Every mail about a purchase is written down before it goes out (address, subject, text), so a failed send can be tried again and a later question has an answer.
Earlier access requests. Until 20 October 2026 servers had to ask for access. For those we still hold the server’s name, ID and member count, who asked, their note and our decision, while the bot is on that server.

Payment records, declarations and the mail log are kept for the ten years § 147 AO and § 257 HGB require; a deletion request does not remove them. You need a Discord account to use the service. Everything else on this page depends on what you or a server switch on.

3. Tickets on a server

What a server’s team sets up and what its tickets leave behind. It stays while the bot is on the server, unless a shorter time is named.

Configuration. Settings, topics, forms, panels, messages and knowledge base articles.
Tickets. Who opened a ticket, its topic, status, times, message counts and response times, for the ticket lifecycle and the statistics. Form answers are posted into the ticket channel. While a ticket is open, its conversation lives only on Discord.
Transcripts, if the server switched them on. The messages of a closed ticket (author, time, text, attachments), for the 30 to 365 days the admin picked within the plan, then deleted. Hosted, a transcript opens after Discord login for the person who opened the ticket and the server’s team. As a file, it goes to the server’s own log channel and we keep no copy. Switched off, nothing is written.
Ratings. The stars, optional feedback, the ticket number and the Discord ID and name of who rated. The admin decides whether the public post names you; their team always sees it.
Blocked members. The Discord ID, the reason and evidence, who blocked them and until when.
Audit log. Configuration changes and ticket actions with the Discord ID of who made them, for 180 days.

4. The assistant

Who answers. Groq and Anthropic, two US providers, on accounts we operate. Which one depends on the model the admin picked. The safety screen, which checks each member message for threats, harassment and self-harm before an answer, always runs on Groq.
What leaves. To answer in a ticket: its messages with the Discord username next to each, attached screenshots and the knowledge the server allows. In the FAQ channel: one message, only if it is long enough and shaped like a question, with the same knowledge. A request holds only the conversation it answers, never another ticket or server. If the server switched it on, a closed ticket is read once more for its summary and a short record of what it was about, what settled it, what was left open and what the knowledge base lacked.
Knowledge sources. Channels and web pages an admin points the assistant at are read with the bot’s own permissions, on the admin’s schedule. The text is stored until the source is removed.
Usage and safety records. Token and request counts per server and day, and events such as an escalation, a resolved ticket or a blocked message, with the rule, the ticket number, the screen’s one-line reason and the message length. Never the message itself.
Reports. When a team reports a wrong reaction, or the assistant’s own review points at a weak answer and the server allows that review, we keep a snapshot: the conversation, the knowledge it was given and its answer, with names and IDs replaced by roles. While that setting is on we also keep its decision steps per ticket, replaced the same way. Both are visible to the server’s managers and us, and deleted after 30 days or earlier on request.
Both providers state that data sent through their APIs is not used for training, and we train nothing on it either. With the assistant switched off, nothing from that server goes to an AI provider.

No decision about you is left to the machine. The assistant answers, asks, hands over to a human, blocks a single message or marks a ticket resolved. None of that has a legal or similarly significant effect in the sense of Art. 22 GDPR, and the server’s team can always take over.

5. Optional modules

Only on a server that switched the module on, and only that server’s team sees it. Open a module to read what it stores and for how long.

Applications

For each application your Discord ID and name, your answers as you wrote them and when you sent it in, so the team can review it; while you fill in a longer one, the answers of the parts already sent are kept for 30 minutes. The team’s votes are kept with each team member’s Discord ID, and so are the decision, who made it and the reason. The server may give you a role while you wait, open a private thread with you and the team, and send you the decision by direct message.

With the assistant on, your answers go to Groq or Anthropic for a short summary for the team and a check against what the server looks for, and for a translation when a team member asks for one. The assistant never decides. An application goes 90 days after it was decided, or after you left the server while it waited; until then it stays.

Assistant for other ticket bots

In the categories the server names, the bot reads each new ticket of the other bot: who opened it, from the channel’s rights or that bot’s welcome, and what that bot shows of its form. From there it works as in our own tickets (section 4), and the record stays as long as ours do.

Counting

Per member how many numbers they counted and how many mistakes they made, for the leaderboard, and who counted last. The messages are read to check the number and are not stored.

Giveaways

For each entry your Discord ID, when you joined and how many entries you have, to draw the winners and check the server’s requirements (a role, account age, time on the server, recent wins). Also who won, who started the giveaway and a sponsor’s Discord ID if they are a member. Winners can get a direct message.

For a message requirement the bot counts per member and hour how many messages counted (a few words, no repeats, at most one a minute), never the messages themselves, for 8 days. If many did not count, the team sees a note on the entry. Entries go 30 days after the giveaway ends; who won stays while the bot is on the server.

Honeypot

Whoever posts in the channel the server named has the message deleted and gets what the server chose (softban, kick, ban or timeout), plus a direct message if the server turned that on. We keep the Discord ID, what was done and when for 30 days, after that only the number of triggers. The message is shown once in the log channel and not stored.

Security

Scam check. The bot compares posts with images, links or mass mentions with the same member’s recent posts, compares images with a list of known scam images, reads the text on images and checks links against public phishing lists. All of it runs on our own server; nothing goes to an AI provider. For a caught post we keep the author’s Discord ID and name, the channels, the text and copies of the images for the team: text and copies 30 days, the record of the catch while the bot is on the server. For the scam image list we keep a fingerprint of each image, from which the picture cannot be rebuilt, and a small preview, until we remove it.

Private data. If the server chooses, a message with a phone number, e-mail address, bank or card number, access token or public IP address is deleted. We keep no text: only the author’s Discord ID and name, the channel, the kind of data and a masked form of it (a phone number as country code and last two digits).

Logging. Joins with the invite used, leaves, moderation, deleted and edited messages, role, server and voice changes go to channels the server picks and live only there. How often each invite was used is held in memory only. So that a deleted or edited message can show what it said, its text is kept for seven days with the author’s Discord ID and name, the channel and the names of attached files. Messages from bots are not kept.

Moderation. Each ban, kick, timeout and warning is recorded with the member and the moderator (names and profile pictures as they were), the reason, when it ends and the team’s notes, while the bot is on the server; a warning taken back stays, marked as removed. Unless the server turned it off, the member gets a direct message that does not name the moderator.

Auto moderation. The bot checks each message against the server’s rules (blocked words, links, invites, mentions, capital letters, length) and counts how often and where a member writes. For that it holds the times, the channels and a fingerprint of each message, not its words, in memory only and for a week at most. What follows a broken rule is the server’s choice and is recorded like a command. Discord’s own rules, if the server uses them, are checked by Discord.

Server activity

Counts for the server’s statistics: per day and hour how many messages were written, per channel and per command of this bot, joins, leaves, the member count and minutes in voice. Per member we keep the Discord ID, when they joined and left, when they first wrote after joining, the last day they wrote and how many messages that was. Never what a message said. Bots are not counted. Everything goes after 400 days, and the server can delete it at any time.

Sticky messages

Only the message the server wrote, nothing about the members who write in that channel.

Timers

A reminder keeps its text, when it is due, its channel and the link to the message it was set from, and arrives by direct message, or in that channel when direct messages are closed. The team sees how many are waiting, never whose or what they say. A channel timer keeps who started it, its text, its channel, who it pings and who pressed Notify me. Both go 7 days after they ran. Your time zone stays until you change it or delete your data. A reminder before a Discord event reads who is interested at that moment and stores nothing of the list.

Verify

Who still has to verify and how it ended (verified, stopped and why, removed), with the Discord ID, a Verification ID and a record of each check and its result, such as the country or that a VPN was found, never the address. Kept 30 days.

On the web page you sign in with Discord; we read only your ID. Depending on the server’s settings the page checks the country of your IP address (Cloudflare tells us), whether it belongs to a VPN, proxy, Tor, a data center or a mobile network (proxycheck.io receives the address and nothing else), whether the window is private and whether the press looks automated. It may load Cloudflare Turnstile, which runs in your browser under Cloudflare’s privacy policy. For the alt account check it keeps a random browser ID in a cookie and computes a fingerprint of your browser and device in your browser.

The address, the browser ID and the fingerprint are stored only as a keyed hash that is different for every server, so the team sees when two accounts verify from the same browser, device or place. Cookies: the sign-in 30 minutes, its state while it runs 10 minutes, the browser ID 30 days.

Voice support

Who is waiting and since when, only while they wait. For each call who was helped, which team member took it, the channel, how long it ran and, if the server asks for feedback, the stars and the comment. Calls are never recorded, transcribed or listened to.

Welcomer

Sends the messages the server wrote and gives the roles it chose. Nothing about the members it greets is stored.

6. Legal basis and cookies

Purpose	Legal basis (GDPR)
Signing you in and showing you your servers	Art. 6 (1) (b): the agreement you enter into by using the dashboard
Payments, subscriptions, token packs and the mails about them	Art. 6 (1) (b) for the purchase, Art. 6 (1) (c) for the accounting records tax and commercial law prescribe
Keeping what a buyer declared before paying	Art. 6 (1) (c) for the evidence the withdrawal rules require, Art. 6 (1) (f) for being able to show what was agreed
The ticket system, the assistant and every module a server switches on	Art. 6 (1) (b) towards the server’s operator; towards its members we act as their processor under Art. 28, on the operator’s basis
The list of known scam images every server shares, and the duplicate account check in Verify	Art. 6 (1) (f): keeping scams, spam and duplicate accounts off the servers we run on
Keeping the service up and stopping abuse: security and error logs, AI safety events, reports about the assistant	Art. 6 (1) (f): our and every server’s interest in a service that works and is not abused
Counting AI usage against a plan	Art. 6 (1) (b) and (f): billing transparency and capacity planning
Records of earlier access requests	Art. 6 (1) (f): knowing how a server came onto the platform

Where we act as processor, the basis is the server operator’s to give and ours to follow. Where processing rests on a legitimate interest, you can object under Art. 21 GDPR (section 9).

No analytics and no tracking cookies. The dashboard sets only the session cookie, the Verify page only the cookies named there; both are needed for what you asked for, so they fall under § 25 (2) no. 2 TDDDG and need no banner. We log no IP addresses while you use the dashboard. When a page breaks in your browser, it sends us the error, the page address and, if you are signed in, your Discord ID. Each report is kept 30 days, after that only the error and how often it happened.

7. Who receives it

A server’s data is visible to the people who can manage that server on Discord. The operator of GuildOtter can open any server’s dashboard, for support and abuse handling only. Beyond that, these providers receive only what their role needs, and we update the list before a new one starts.

Provider	Role	Region
Groq	Generates the assistant’s replies, and screens messages for abuse.	United States
Anthropic	Generates the assistant’s replies when a server picked a Claude model.	United States
Hostinger	Runs the server the bot, the dashboard and the database live on.	European Union
Cloudflare	Sits in front of the site: DNS, protection against attacks.	Global, EU traffic on EU nodes
Discord	The platform itself, and the login. We receive your ID, name, avatar and which servers you manage.	United States
Paddle	Our reseller and merchant of record for every purchase: takes the payment, issues the invoice and handles taxes, as a controller of its own. Tells us the plan, the status and the e-mail address you gave at checkout.	United Kingdom
proxycheck.io	Tells the Verify web page whether an address belongs to a VPN, a proxy, Tor, a data center or a mobile network, where a server switched that check on. It receives the address and nothing else.	United Kingdom
Resend	Delivers the mails about a subscription: confirmation, a failed payment, an ending. They carry the server name, the plan, the amount and the date, never ticket content.	Sent from the EU, stored in the United States, EU Data Privacy Framework

Hostinger and Cloudflare process in the EU, Paddle and proxycheck.io in the United Kingdom, which has an adequacy decision (Art. 45 GDPR). Groq, Anthropic, Discord and Resend process in the United States. Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the others are bound by the Standard Contractual Clauses in their data processing terms (Art. 46 (2) (c) GDPR). Ask us and we send you the safeguards of a given provider.

The residual risk, stated plainly

Standard Contractual Clauses bind a provider, not a US authority. We cannot rule out that authorities there access data held by a US provider, with weaker rights for you than inside the EU. A server that does not accept this can switch the assistant off; tickets keep working.

8. How long we keep it

Each item above names its time. Anything without one stays while the bot is on the server.

When the bot is removed

Everything that server owns is deleted after 48 hours: settings, tickets, transcripts, knowledge, statistics and module data. The 48 hours let a bot removed by mistake come back with everything intact; once they pass, it is gone. Two things stay: the payment records with their declarations and mails, for the ten years tax law requires, and a note that the server already received a one-off offer or notice (a server ID, a kind and a date, nothing about a person), so that leaving and returning does not hand out the same thing twice.

9. Your rights

On your profile page you see your tickets and transcripts across every server, download a copy of your data and remove yourself from the record. For anything else, write to us. It costs nothing, and we answer within one month (Art. 12 (3) GDPR).

Access (Art. 15), rectification (Art. 16), restriction (Art. 18) and portability (Art. 20).
Erasure (Art. 17). It runs seven days after you ask and can be called off until then. Your name comes off every ticket and the conversations are deleted. Ratings, suggestions and problem reports stay without a name, as do the servers’ ticket counts, and a server’s ban of your account stays with that server. Payment records stay as the law requires.
Objection (Art. 21) against anything based on a legitimate interest: our security and error logs, abuse prevention, the reports we read to fix the assistant. We then stop, unless compelling grounds override yours.
Withdrawing consent (Art. 7 (3)) wherever a step asks for it, with effect from then on.
Complaint (Art. 77) to any supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

For what happens inside a server we are the processor, so a request about a ticket, a transcript or a rating is that server’s team to decide. Write to us anyway: we pass it on and help them answer it, as Art. 28 (3) (e) GDPR requires.

10. Security, age and changes

Everything travels over HTTPS, the database and its backups are encrypted at rest, and only the operator can reach the production system. If a breach affects personal data, we notify the people concerned and the authority (Art. 33 and 34 GDPR), and the affected server’s operator without undue delay.
Discord requires its users to be at least 13. GuildOtter is not aimed at children below that age, and we delete such data when we learn of it.
When the service changes in a way that affects this page, we update it and move the date at the top. Substantial changes are announced in the dashboard.

11. Contact

Write to [email protected], message endofcircuit on Discord, or use the postal address in the imprint. Tell us which server and which Discord account your request is about.