Privacy · babes

1. Introduction

This Privacy Policy describes how the operators of babes (the "Operator", "we", "us") collect, use and protect your information when you use the babes Discord bot (the "Bot"), the web dashboard at babes.bot, or related services (collectively, the "Service").

Short version: we collect the minimum needed to run a Discord bot. We don't sell your data, we don't log message content by default, and you can request a full export or deletion at any time.

2. Data We Collect

We collect only the data required to operate the Service. Different features require different data — see the table below.

Data	Purpose	Source
Discord user ID	Identify users across features (XP, warnings, tickets)	Discord OAuth / Gateway
Username, avatar	Display in dashboard & Bot embeds	Discord OAuth / Gateway
Server (guild) IDs	Load per-server settings	Discord Gateway
Server configuration	Run the features you enable (moderation, welcome, levels, etc.)	You, via Dashboard
Message count & voice seconds	Leveling system and leaderboards	Discord Gateway (counts only, not content)
Moderation actions	Audit log, warn / strike history	Server moderators
Ticket transcripts	Support history (only while ticket is open + retention period)	Ticket participants
Payment metadata	Premium billing & receipts	Payment processor (no card details stored on our servers)

What we do NOT collect

Message content. The Bot does not persistently store the content of messages unless you explicitly enable message logging yourself in your Server.
Voice audio. The Bot never records or stores voice conversations.
Private DMs. We do not read or store user direct messages.
Credit card numbers. Payment card details are handled entirely by our payment processor.

3. How We Use Your Data

We use the data we collect to:

Operate the Bot's features you have enabled.
Authenticate you on the Dashboard via Discord OAuth2.
Provide moderation logs, leaderboards, XP stats and support tickets.
Process Premium subscriptions and send receipts.
Detect abuse of the Service (e.g. rate-limit evasion, malicious input).
Comply with legal obligations.

We do not use your data for advertising, behavioural profiling unrelated to the Service, or resale to third parties.

5. Data Retention

We retain your data only as long as needed to operate the Service:

Server configuration — for as long as the Bot is in your Server. Removed within 30 days if the Bot is kicked.
XP & stats — kept while the Bot is in the Server; weekly counters reset every Monday.
Moderation logs — kept for as long as the Server admin keeps them (configurable, default indefinite).
Ticket transcripts — kept for 90 days after the ticket is closed, then purged unless the Server admin requests longer retention.
Payment records — retained for 7 years to comply with tax / accounting law.

6. Your Rights

If you are a resident of the EU/EEA, UK, or California, you have the following rights under GDPR / CCPA:

Right of access — request a copy of the data we hold about you.
Right of rectification — request correction of inaccurate data.
Right of erasure — request deletion of your data ("right to be forgotten").
Right to data portability — request your data in a machine-readable format.
Right to object — object to certain uses of your data.
Right to lodge a complaint — with a supervisory authority in your country.

To exercise any of these rights, contact us — see Contact. We respond within 30 days.

7. Cookies & Local Storage

The Dashboard uses a small number of first-party cookies strictly for:

Session cookie — keeps you signed in after OAuth.
CSRF token — protects against cross-site request forgery.

We do not use tracking cookies, third-party analytics cookies, or advertising cookies.

8. Security

We protect your data with industry-standard measures:

TLS (HTTPS) for all traffic between your browser / Discord client and our servers.
Encrypted disks on our database servers.
Role-based access control for our team — only authorised personnel can access production systems.
Regular security updates and vulnerability scanning.

No system is 100% secure. If a data breach affects you, we will notify affected users within 72 hours of discovery, as required by GDPR Article 33.

9. Children's Privacy

The Service is not directed at children under 13 (or the minimum age required to hold a Discord account in your jurisdiction, whichever is higher). We do not knowingly collect personal information from children under this age. If you believe a child has provided data to us, contact us and we will delete it.

10. International Data Transfers

Our servers may be located outside your country of residence. When we transfer data internationally, we do so under appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, where applicable.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced via the Dashboard or the official support server at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the latest revision.

12. Contact

For privacy questions, data requests, or to exercise your rights, contact us through the support server linked from the Dashboard, or open a ticket inside Discord with the Bot. Please include the Discord user ID and (if applicable) the Server ID concerned.