EnderBot Privacy Policy

EnderBot is a bot built for Discord, together with websites.

This privacy policy covers the following services:

In this text, "EnderBot" refers to all of these services, and "you" refers to the person using them.

Data controller: EnderSpirit, owner of EnderBot and responsible for the Service, under this pseudonym. For purchases, VSK, a French SARL with variable capital registered with the Paris trade register under number 105 185 789, with its registered office at 47 rue Vivienne, 75002 Paris, is the seller, collects payments and is responsible for payment and billing data (see the Terms of Sale). VSK also provides development services for EnderBot. Contact: contact@vskstudio.fr.

The Service is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, phone: +49 (0)9831 505-0.

Publication director: EnderSpirit, under this pseudonym. Contact: contact@vskstudio.fr.

By using EnderBot, you confirm that you have read this policy. Each processing activity states its legal basis: your consent, performance of the service you request, or our legitimate interest. Where processing relies on your consent, you may withdraw it at any time, without affecting processing already carried out. We may change this policy; the date at the top shows the latest version.

User data

To operate, EnderBot may collect the following information about you:

• Your Discord ID, so that EnderBot recognises you when you use it.
• Your Discord username, for the leaderboards.
• Your Discord profile picture, which some commands use to generate images.
• Your IP address when you use the website, for the security of the Service and fraud prevention.
• Your command and in-game transaction history, to run the game, produce analytics and prevent fraud.
• Private messages EnderBot sends you, with a preview of their text. They are included in your data export and deleted with your account.

Technical data and security

To protect the Service against fraud, multiple accounts and automation, EnderBot may process the following:

• A technical fingerprint of your browser.
• A signed device identifier, stored in your browser.
• A fingerprint of your connection, and the network operator to which your IP address belongs.
• Data related to your use of the game, with its timestamps.

This processing relies on our legitimate interest in protecting the Service against fraud (Article 6.1.f GDPR).

Server data

EnderBot may collect the following information about servers ("guild" is the technical name for a Discord server):

• The guild's ID, name, emojis, channel names and icon, to display them on the website dashboard.
• Aggregated statistics on messages and activity in each server where EnderBot is present, so that its administrators can consult them. For these statistics, EnderBot is the controller: the text of messages is not kept, only counters are, and each administrator sees only the statistics of their own server. You can stop the recording of your activity at any time from the My data page.

Data is accessible to EnderSpirit, who is responsible for the Service, and to VSK for the development of EnderBot as a contractor, as well as to the people designated as game moderators by EnderSpirit, only to the extent their role requires. Every access to data by an administrator is logged. We take reasonable measures to protect data, but no service is entirely free of risk.

Under the General Data Protection Regulation (EU 2016/679, "GDPR") and the French Data Protection Act, you have the following rights:

• Right of access: obtain a copy of the data we hold about you.
• Right to rectification: have inaccurate data corrected.
• Right to erasure: request deletion of your data, under the conditions described below.
• Right to restriction: ask us to freeze the processing of some data while it is reviewed.
• Right to object: object to processing based on our legitimate interest, and opt out of the activity statistics of your account.
• Right to portability: receive your data in a structured, machine-readable format, where processing relies on your consent or on a contract.
• Post-mortem directives: set what happens to your data after your death (Article 85 of the French Data Protection Act).

You may also lodge a complaint with the French data protection authority, the CNIL, at cnil.fr.

We answer each request within one month of receiving it. This period may be extended by two months for complex requests, and we will tell you if it is.

Use of data

For this policy, EnderBot is split into two parts:

Game system

EnderBot runs a persistent game in which users trade and interact within a single virtual economy shared by everyone. Some logs are kept when players interact with each other, to prevent cheating and protect the integrity of the Service. EnderBot may link accounts that appear to be related. If cheating is established, a member of the team may restrict or suspend the accounts concerned. No sanction is applied without a human decision. Because the game is shared, the data collected here is used across all Discord servers.

Utility system

EnderBot offers various features for Discord servers. Some data may be collected and processed when a server's administrators enable some of these features (for example the "Starboard"). This data stays limited to the Discord server where the feature is enabled. For most of this processing, the server administrator is the controller for their server, and EnderBot acts on their behalf as a processor (Article 28 GDPR). Server statistics are the exception: EnderBot is the controller for them, as described in the server data section. Server notes are written by the EnderBot team and are not visible to the server's administrators. EnderBot is the controller for them and erases them 30 days after it leaves the server, unless it is invited back in the meantime.

The game, your account and the features you use rely on the performance of the service you ask for (Article 6.1.b GDPR). Game logs, analyses and statistics rely on our legitimate interest in running, protecting and improving the game (Article 6.1.f). Payment data is kept to comply with a legal obligation (Article 6.1.c).

Your Discord identifier is required: without it, EnderBot cannot recognize you or provide the Service. Without payment data, a purchase is not possible. No data is required for any other reason.

Informing the members of your server

If you run a server that uses EnderBot, you can copy this text into the channel of your choice or into your server rules:

Third-party services

VSK, which sells EnderBot and provides its development as a contractor, receives the data needed to sell subscriptions and for that development. It processes this data for those purposes only; its rules for purchases are in the Terms of Sale.

Hetzner Online GmbH, established in Germany, hosts the Service's servers and databases as a processor.

Discord hosts the bot and the servers. It processes the data needed to run the application, under its own privacy policy.

Stripe, our payment provider, processes payment data for purchases. Bank details are entered with Stripe: we neither receive nor keep card numbers. Stripe sends us the transaction identifier and amount, along with the information needed to manage your subscription. This processing relies on performance of the sales contract (Article 6.1.b GDPR).

Top.gg, the Discord bot listing site, is involved in two cases. When you run the vote command, EnderBot sends Top.gg your Discord ID to check whether you have voted. When you vote on Top.gg, Top.gg sends EnderBot your ID so that your reward can be credited. This processing relies on performance of the service you request (Article 6.1.b GDPR). Top.gg processes this data under its own privacy policy.

DiscordBotList, the other Discord bot listing site, is involved when you run the vote command. EnderBot queries DiscordBotList for the list of the bot's recent votes, using its own access key, then looks for your ID in it. The data of other voters is not kept. When you vote, EnderBot records the date of your vote so that your reward can be credited. This processing relies on performance of the service you request (Article 6.1.b GDPR). DiscordBotList processes this data under its own privacy policy.

MEE6, the leveling bot, is only involved when a server administrator starts an import of its levels. EnderBot asks MEE6 for the server leaderboard, in pages of 100 members and at most five pages, and imports each member's XP total as their progress on the server. This processing relies on the community's legitimate interest in keeping its progress (Article 6.1.f GDPR), the import being started by a server administrator.

Some images on the site do not come from our servers: avatars and icons are served by Discord, and some card illustrations by the image hosts chosen by the community (Imgur, Catbox, Postimg, ImgBB). When a page shows them, your browser requests them directly from these services, which receive your IP address and process it under their own rules. This loading relies on our legitimate interest in displaying the site's content (Article 6.1.f GDPR).

Takt, the website's audience measurement tool, is published by VSK and hosted in the European Union. It receives the data described in "Audience measurement", including your IP address reduced to its network.

Discord and Stripe process data in the United States. These transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework, for certified companies, or on the standard contractual clauses adopted by the European Commission. Top.gg and DiscordBotList may also process your identifier outside the European Union, and the image hosts your IP address, under their own rules. You can get the details of these safeguards, or a copy, by writing to contact@vskstudio.fr.

Automatic deletion

Retention periods

Each category of data has a retention period. Beyond it, data is deleted automatically, unless stated otherwise:

• IP address, browser fingerprint, device identifier, connection fingerprint and links between accounts: 365 days.
• Network operator lookup cache, verification challenges (captcha) and device-token events: 30 days.
• Signals related to use of the game: 30 days.
• Login sessions: 7 days, then deleted.
• In-game transaction history: 180 days.
• Command log: 120 days. After 7 days, the text of each command is replaced by the command name alone. The command linked to secret codes is never kept with its text.
• Message and voice statistics per server: 400 days.
• Log of administrator access to your data: 365 days. It keeps the administrator's identifier and is not included in your data export.
• Fraud review records: 365 days for the analysis elements, 365 days after their expiry for trust levels. Sanction history: 3 years after the last decision, and never while a sanction is in progress.
• Payment data (purchase history, amounts, transaction identifiers): 10 years after the close of the financial year, the period required for accounting records (Article L123-22 of the French Commercial Code).
• Register of erasure requests (internal identifier and date the erasure started): no time limit.
• Private messages EnderBot sends you (recipient, type, text preview, delivery status and dates): 90 days. The full content is kept only until the message is sent or abandoned. A message still waiting to be sent is not subject to this purge and keeps its content and metadata until it is settled.
• Withdrawal declarations: first name, last name and email are erased when your account is deleted; the payment identifier, amount, currency and dates are kept for ten years after the end of the accounting year (article L123-22 of the French Commercial Code).

Backups

EnderBot makes full backups of its database. We keep the four most recent backups and, for each month, the most recent backup of that month, with no time limit. Data erased from the database may therefore remain in the backups we keep.

Manual requests

You may ask for access to your data, its correction, its erasure, a restriction of its processing, or object to processing. From your data page, you can request a copy of your data and schedule its erasure: the erasure runs automatically 30 days after the request, and you can cancel it during that period. An erasure cancels your card subscription: it ends at the end of the current period, or at the latest when the 30-day delay ends. Export requests are handled by hand. We record each request and handle it within one month.

To understand how the website is used and improve it, we use Takt, an audience measurement tool. This processing relies on our legitimate interest in measuring the website's traffic.

Takt receives the page viewed, the referring site, your browser, your system, your screen width and your IP address reduced to its network: the first three bytes for an IPv4 address, the first three blocks for an IPv6 address. The full address is not sent. Takt derives your geographic area and a visit identifier renewed every day from it, then discards the address. It sets no cookie, builds no profile and does not follow you from one site to another. Measurements are kept for 25 months.

You can opt out of audience measurement with the button below. This choice applies to this browser. If you are logged in, your data page brings together this choice and the opt-out from your account's activity statistics. A Discord member who is not registered on the website cannot use this second option.

The website stores only the following items in your browser. None of them is used for advertising.

• Session cookie, set when you log in: it keeps you logged in, 7 days.
• Language cookie: it remembers the display language, 1 year. The service's owners also have a wiki preview cookie, 1 year.
• Signed device identifier: it protects the Service against fraud. It is kept in a 2-year cookie and in your browser's storage.
• Browser storage (local storage, session storage, IndexedDB): your display preferences, your profile comparison history, cached game data for faster loading and your opt-out from audience measurement, if any. The game cache expires after 7 days and session storage empties when the tab closes. The rest stays until you clear it.

Session and language cookies and browser storage serve the service you ask for or remember a choice you made, so they do not require your consent (Article 82 of the French Data Protection Act). The device identifier relies on our legitimate interest in protecting the Service. You can clear everything from your browser settings, which will log you out.

To exercise your rights or ask a question about this policy, join the Discord support server or write to the Service's operator on Discord: @enderspirit or @akayashuu You may also write to contact@vskstudio.fr. We may ask you to confirm your identity before answering.

Discord support server discord.gg/veMMzPj6M8

E @enderspirit on Discord

A @akayashuu on Discord

The Service is intended for people aged 15 or over. Anyone under 15 may only use it with the agreement of their legal guardian. Purchases are reserved for adults, or for minors who have their legal guardian's agreement. We do not run any technical age check. If we learn that a minor under 15 has provided data without the required agreement, we delete that data, on request or as soon as we become aware of it.

This policy is governed by French law and the GDPR. You may bring a claim before the competent courts, including those of your place of residence.