Privacy Policy

1. Overview

At dzbot, we take the privacy and protection of your personal data seriously. This page explains which personal data we process when you visit this website, sign in to the dzbot platform, play on or run a game server that uses dzbot, or interact with the dzbot bot on Discord — why we process it, on which legal basis, who receives it, how long we keep it, and which rights you have under the General Data Protection Regulation (GDPR).

2. Controller

The controller responsible for the processing described on this page is:

Email: info[nospam]@dzbot.de

We are not legally required to appoint a data protection officer and have not done so. For every privacy question or request, please use the email address above.

3. Cookies and Local Storage

We do not use any non-essential cookies on this website. Our website may use technical cookies that are necessary for the basic functionality and security of the site. These cookies are used solely for operational purposes, such as ensuring the site loads correctly or allowing you to navigate between pages.

Because we do not use cookies that track personal information or provide marketing and analytics services, we do not display a cookie consent banner.

When you sign in to the dzbot platform, we additionally set two strictly necessary first-party cookies:

• refresh_token, which keeps you signed in. It expires after at most 5 days without use.
• dz_did, a random device identifier used only for abuse and multi-account prevention as described in Section 8.

The platform also keeps a few preferences in your browser's local storage (for example a dismissed hint or whether your speaker is muted in a live room). These never leave your device.

4. Web Analytics and Performance Monitoring

We use Cloudflare Web Analytics and Real User Monitoring (RUM), provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), to understand how our website performs and is used. This helps us improve page load times, reliability, and overall user experience.

Cloudflare Web Analytics is designed to be privacy-friendly and does not use cookies for analytics purposes. It does not build advertising profiles or perform cross-site user tracking. We only receive aggregated, data-minimized analytics reports — we do not have access to individual user profiles or personally identifiable browsing data.

Technical request data, including IP addresses, may be processed by Cloudflare as part of delivering its analytics, security, and performance services. Cloudflare acts as our data processor under a Data Processing Agreement. For details on how Cloudflare handles this data, please refer to Cloudflare's Privacy Policy.

The legal basis for this processing is our legitimate interest pursuant to Art. 6(1)(f) GDPR: improving website performance, identifying technical issues, and ensuring the security and reliability of our site.

If you wish to object to processing based on legitimate interest, you may contact us using the details provided in Section 2.

5. Visitors of This Website and Contact

We do not collect personal data from visitors to this website unless you voluntarily provide it (e.g., by contacting us). In such cases, the data provided will only be used to respond to your inquiries and will not be shared with third parties without your consent. The legal basis is our legitimate interest in answering your request (Art. 6(1)(f) GDPR) or, where your request concerns a contract with us, Art. 6(1)(b) GDPR.

When our servers answer a request, they write a technical log entry (time, requested address, your IP address and, if you are signed in, your account ID) to keep the service running and to investigate errors and attacks. These logs stay on our own infrastructure. The legal basis is our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

6. Your dzbot Account (Sign-in with Discord)

You sign in to the dzbot platform with your Discord account. When you do, we receive and store:

• your Discord user ID, username and the reference to your Discord avatar, so your picture shows next to your name wherever your name is shown on the platform. The image itself stays on Discord's servers: pages showing it load it from Discord's content network, which therefore sees the viewer's IP address;
• the OAuth access and refresh tokens Discord issues for your login, so we can act within the permissions you granted;
• the list of external accounts you connected in Discord (for example Steam, Xbox or PlayStation: type, account ID, name and whether it is verified), which we use to link your game account to your dzbot account automatically;
• your language preference and the settings you choose on the platform.

The permission to add you to a Discord server (guilds.join) is used only to add you to a game community's Discord or to our customer Discord when you or a feature you use requests it. We do not read your list of Discord servers, your messages or your friends through your login.

If you run a server on dzbot and subscribe to a paid plan, we additionally process the billing details you provide (see Section 11).

The legal basis is the performance of our contract with you — providing the platform you signed up for (Art. 6(1)(b) GDPR). Account data is kept for as long as your account exists and is deleted when you ask us to delete your account, except for records we must keep by law (Section 11).

7. The dzbot Bot on Discord

Server owners add the dzbot bot to their community's Discord server. The bot uses Discord's privileged Server Members and Message Content intents. This section explains exactly what it does with them.

Server members

We store only what a feature needs:

• Role sync: for members who linked a game account, the IDs and names of the Discord roles that dzbot manages for them, so roles stay in sync with in-game status, faction membership, support level and similar.
• Joins: when someone joins a server's Discord, their Discord member ID and the time of joining — to credit the invite to the member who referred them, to link the new member to their game account automatically, and to restore roles they held before. Join records that cannot be matched to an invite or game account are deleted after 30 days.
• Server boosts: the booster status of a linked member is read to grant the server's boost rewards. It is not stored beyond the record of the reward itself.

When the bot reads a linked member for the role or nickname sync, it also refreshes the reference to their Discord avatar (Section 6). We do not store nicknames or member lists. Where a server keeps nicknames in sync with in-game names, the bot compares them in memory only.

Message content

The bot stores message content in exactly two cases:

• Support tickets: messages in ticket channels created by the bot are stored as the ticket's history, including attachments and edit history, so the server's staff can handle the request.
• Messages addressed to the bot: messages that mention the bot, reply to the bot, or are written in your private /ai companion thread.

All other messages are inspected only transiently to decide whether one of the cases above applies, and are discarded immediately. They are never stored.

When a server's staff member invokes the AI Companion from Discord, the triggering message and a small window of the surrounding messages in that channel — which may include recent messages of other users, at most about 5,000 characters — are sent to OpenAI solely to generate the reply (see Section 9). The Companion can read a Discord channel only if the staff member who asked it has permission to view that channel in Discord.

The legal basis is the legitimate interest of the server owner and of us in running the community features the server owner enabled — support, role management, invite rewards and moderation (Art. 6(1)(f) GDPR). Discord itself is operated by Discord Inc. (USA) as an independent controller under Discord's Privacy Policy.

8. Abuse Prevention and Multi-Account Detection (Signed-in Platform)

When you sign in to the dzbot platform (the companion and web portal, as opposed to this marketing website), we process a limited set of technical identifiers to detect and prevent abuse — in particular the operation of multiple accounts by the same person and the circumvention of bans or other enforcement actions. Specifically, we process:

• your IP address; and
• a randomly generated device identifier stored in a first-party cookie (dz_did).

We link these signals to your dzbot account and store each distinct value together with when it was first and last seen. Access is restricted to the platform operator and to administrators of the organisations whose servers you play on, and only in respect of their own members. The data is used solely for security and abuse prevention — never for advertising, marketing, or cross-site tracking. Organisation administrators never see your IP address itself. Where they are shown information derived from it, that information is limited to your internet provider and your country; it is derived locally within our own systems from a database we host ourselves, is never transmitted to a third party, is not stored, and never identifies a location more precise than the country.

The legal basis for this processing is our legitimate interest pursuant to Art. 6(1)(f) GDPR in protecting the integrity and security of the platform and preventing fraudulent or abusive use.

Retention: IP addresses are deleted within 14 days of their last occurrence; device identifiers are deleted within 90 days of their last occurrence.

You may object to this processing under Art. 21 GDPR using the contact details in Section 2. Where we can demonstrate compelling legitimate grounds for abuse prevention, we may continue to process the data to the extent necessary.

9. AI Companion (Signed-in Platform and Discord)

The AI Companion can be used only by a server's staff members who have been given the AI Companion right. When they use it, the messages they write and the server data the Companion looks up to answer them (for example player names, tickets, logs and orders of that server, and — in Discord — the channel context described in Section 7) are sent to OpenAI, L.L.C. (1455 3rd Street, San Francisco, CA 94158, USA) to generate the reply.

OpenAI acts as our data processor under a Data Processing Agreement. The data is used for inference only: neither we nor OpenAI use it to train or fine-tune models. Our requests are sent with storage disabled, so OpenAI keeps no copy of the conversation for later use; under its API policy, OpenAI may retain API data for up to 30 days solely to monitor for abuse. Because OpenAI is based in the USA, the transfer is covered by the EU Standard Contractual Clauses.

The legal basis is the performance of our contract with the organisation that uses the Companion (Art. 6(1)(b) GDPR) and, for the data of players on its servers, the organisation's and our legitimate interest in running and supporting the game server (Art. 6(1)(f) GDPR).

Conversations are stored in dzbot so the staff member can continue them and review what the Companion proposed, and are deleted 12 months after their last activity. For billing we record, per request, how much it cost — not its content.

When an administrator uses "Record receipts" in the accounting, the uploaded receipt photos and PDFs are transferred to OpenAI so the receipt data can be read from them. OpenAI processes them as our data processor under the same Data Processing Agreement and conditions. The files are kept in dzbot until they become expense drafts, where they are stored as attachments, and are otherwise deleted 30 days after the upload.

10. Game Servers, Players and Live Rooms

dzbot connects to a game server through the hosting account of its owner at Nitrado (marbis GmbH, Karlsruhe, Germany). With the owner's authorisation we read the server's logs, settings and files and send commands such as restarts or item deliveries. From the logs we process, for each player of that server: in-game name, platform and game identifiers, connection times, and in-game events such as kills, positions and building activity. On top of that, dzbot stores what players and staff do on the platform for that server — shop orders and in-game currency, factions, tickets, notes, bans and the audit trail of administrative actions.

The legal basis is the legitimate interest of the server owner and of us in running, moderating and supporting the game server and its community features (Art. 6(1)(f) GDPR) and, for features you use yourself (such as orders), the performance of the corresponding contract (Art. 6(1)(b) GDPR).

Live rooms (voice and chat in the casino and at poker tables) run on our own LiveKit server. Voice is passed through live and is never recorded or stored. Live room chat messages are kept for 7 days so moderators can follow up on complaints, and are then deleted.

While a server is paused because it has neither trial nor paid time left, we keep importing its logs as long as the Nitrado connection works, so that its history, statistics and player records have no gap when the server resumes. The legal basis is the legitimate interest of the server owner and of us in a continuous record of the server (Art. 6(1)(f) GDPR). The data is deleted with the server (Section 11).

Game server data is kept while the server uses dzbot, subject to the specific periods in Section 11.

11. Retention Periods

We keep personal data only as long as we need it for the purpose it was collected for:

• Support tickets, including their messages and attachments, and AI Companion conversations: deleted 12 months after their last activity — also on servers that are still active.
• Discord join records that could not be matched: deleted after 30 days.
• Live room chat messages: deleted after 7 days.
• IP addresses for abuse prevention: deleted within 14 days of their last occurrence.
• Device identifiers for abuse prevention: deleted within 90 days of their last occurrence.
• Receipt uploads that did not become expense drafts: deleted 30 days after the upload.
• Data of failed background jobs: deleted after 7 days.
• Audit trail of administrative actions: 12 months by default; each server owner can set a period between 1 and 120 months.
• Servers that stop using dzbot: when a server's subscription or payment ends — usually when the bot is removed — all of that server's data is deleted 30 days later.
• Accounts: kept as long as the account exists and deleted on request.

Our own accounting records — payments, invoices and the related bookings — are kept for the statutory retention periods of German commercial and tax law, generally 10 years (§ 257 HGB, § 147 AO). They are not deleted together with a server, and during this period they are used only to meet these legal obligations (Art. 6(1)(c) GDPR).

12. Recipients and Processors

We do not sell personal data and do not share it for advertising. We use the following service providers; where they act as our processors, they are bound by a Data Processing Agreement under Art. 28 GDPR:

• Hosting — netcup GmbH, Karlsruhe, Germany: the servers that run the dzbot platform and its database, located in Germany. Monitoring and logs run on this same infrastructure.
• File storage — Backblaze, Inc. (USA), data centre in the EU (Amsterdam, Netherlands): uploaded files such as ticket attachments, images, note attachments, receipts and invoice documents.
• Content delivery, security and analytics — Cloudflare, Inc. (USA): all traffic to dzbot passes through Cloudflare's network for protection against attacks and fast delivery (see Section 4).
• AI — OpenAI, L.L.C. (USA): AI Companion and receipt reading (see Section 9).
• Payments — Stripe Payments Europe, Ltd. (Dublin, Ireland) and its affiliates: processing subscription and AI credit payments, and payments to server owners through Stripe Connect. Stripe also acts as an independent controller for its own legal obligations, such as fraud prevention.
• Discord — Discord Inc. (USA): sign-in, the bot features described in Sections 6 and 7, and delivery of Discord avatars shown on the platform. Discord acts as an independent controller.
• Game server hosting — Nitrado (marbis GmbH, Karlsruhe, Germany): the game server API used on the server owner's instruction (see Section 10).

Within dzbot, data of a game community is visible to that community's staff according to the access rights the server owner assigns.

13. International Data Transfers

Some of the providers above are based in the USA or may access data from there (Discord, OpenAI, Cloudflare, Stripe, Backblaze). Such transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified, the adequacy decision for the EU–U.S. Data Privacy Framework (Art. 45 GDPR). You can request a copy of the safeguards using the contact details in Section 2.

14. Your Rights

Under the GDPR you have the right to:

• request access to the personal data we hold about you (Art. 15);
• request correction of inaccurate data (Art. 16);
• request deletion of your data (Art. 17);
• request restriction of processing (Art. 18);
• receive the data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller (data portability, Art. 20);
• object at any time to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21);
• withdraw any consent you gave, with effect for the future (Art. 7(3)).

To exercise any of these rights — including requests to access or delete your data — please contact us at info[nospam]@dzbot.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence or place of work. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

15. Changes to This Policy

We may update this policy from time to time to reflect changes in legal requirements or our operations. Any updates will be posted on this page, and the date at the top shows when it was last changed.

If you have any questions or concerns about our data protection practices, please feel free to contact us at info[nospam]@dzbot.de.