Privacy Policy

We store account details you provide or that are required to operate the product: for example email, display name, and a password hash (not the plaintext password). Sign-in uses an HTTP-only session cookie scoped to the site.

A separate optional platform admin role uses its own cookie and database-backed sessions; it does not replace or read customer password material.

When you connect Discord, the service exchanges an OAuth authorization code with Discord and uses the resulting access token only long enough to list guilds you can manage. We store a short-lived pick session (guild ids and names you may link), not your long-lived Discord OAuth refresh token for that flow.

After you link a server, we persist the Discord guild id, guild display metadata we receive from Discord or the bot, and the mapping to your organization.

When the Discrofy bot is installed on a linked server and configured to write to the same database the dashboard reads, we may store Discord identifiers and operational data such as member listings, join events, moderation actions (including optional reason text entered by moderators), aggregates (for example daily stats), and similar categories your deployment enables. Operators should maintain an internal inventory of enabled bot features and database tables against this policy.

Message-related tables in the schema are intended for metadata (for example channel or message ids and timestamps); confirm your deployment before claiming message content is never stored.

Features such as server blueprints, rules suggestions, and content generation send prompts and structured context (for example selected guild and channel identifiers) to an AI provider you configure (for example OpenAI). The service is designed to strip or minimize customer content before it reaches the model where the product implements those safeguards—review your AI deployment configuration for your environment.

AI job metadata (status, model identifiers, errors) may be stored for operations and support.

Paid plans are processed through Stripe. We store identifiers and subscription state needed to enforce entitlements (for example Stripe customer id, subscription id, plan name, trial end, and status on linked-guild billing rows). We do not store full payment card numbers on Discrofy servers; card collection happens on Stripe-hosted flows.

Password reset, waitlist confirmations, support ticket notifications, and similar mail are sent through Resend. The vendor receives the recipient address and message content required to deliver the email.

If you join the public waitlist (for example from the coming-soon page), we store your email address and an optional source label in waitlist_signups and may send a confirmation email. We use this data to notify you about launch timing and related product updates. You can request deletion via the contact address below.

We may email account holders about Discrofy itself: product tips, plan and upgrade information (for example when your workspace reaches a Free plan limit), and reminders about an upgrade you started but did not finish. We do not send marketing about other companies' products and we do not share your address for marketing.

We send these emails on the basis that you are a Discrofy customer (the "soft opt-in" under the UK Privacy and Electronic Communications Regulations). You can opt out with the box on the signup form, whether you sign up with email or Discord. Accounts created before October 2026 receive them on the same basis unless you have already unsubscribed.

Every marketing email has a one-click unsubscribe link, and you can turn these emails off at any time in Settings → Notifications. We keep a record of your choice and a suppression list so we do not email you again after you opt out. Account, security and billing emails are not marketing and are sent regardless. Marketing email is sent through Resend.

Depending on configuration, data may be processed by: Discord (platform APIs), Stripe (payments), Resend (transactional email), Telegram (internal alerts to our support team), Sentry (error monitoring and optional Session Replay), your AI inference vendor, your cloud host and database provider, and — when enabled and accepted via the cookie banner — Google Analytics and Microsoft Clarity (site usage analytics) and the TikTok Pixel (measuring visits from TikTok ads). We do not sell personal data.

Customers who need a DPA or subprocessor list should contact the address below.

Messages sent through the public Contact page or Dashboard → Support create support tickets stored in our own database (support_tickets and support_ticket_messages): name, email, subject, category, priority, the conversation with our team, workspace context, and source label. Submissions are rate-limited by IP or user account. Confirmation and reply notifications are emailed via Resend. When a ticket is created or you reply, a short excerpt (name, email, subject, and the start of your message) is sent to a private Telegram chat used by our support team so we can respond quickly.

See the Cookie Policy for cookie categories. Optional Google Analytics, Microsoft Clarity and TikTok Pixel scripts load only after you accept analytics cookies in the consent banner.

You may request access, correction, export, or deletion of personal data by contacting [email protected]. Deletion timelines depend on backups, billing retention, and legal holds.

Privacy questions: [email protected].