Privacy policy
Last updated 2026-10-15
1. Scope
This policy explains what personal data notabot processes when you use the website, dashboard and API, why, and what rights you have. It does not cover data held by Discord or Stripe under their own policies.
2. Controller
The controller is the operator of notabot. Send privacy requests through the contact page.
3. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Discord id, username, avatar, account creation date | Login, account, free-trial eligibility | Contract | Life of the account + 1 year |
| API keys (stored hashed), key names and limits | Authenticating requests | Contract | Life of the account |
| Usage records: request type, status, latency, cost, time | Billing, usage dashboard, support | Contract | 13 months |
| Payments: amount, status, Stripe ids, receipt link, email given to Stripe | Billing, refunds, accounting | Legal obligation | 10 years |
| IP addresses, security logs, ban history | Fraud and abuse prevention, security | Legitimate interest | 12 months |
We do not store the content you send to the solver beyond what is needed to answer the request, and we never log API keys. We do not receive or store card numbers: payments are handled by Stripe.
4. Who we share it with
We never sell personal data. We share it only with:
- our processors: Stripe (payments), Discord (login) and DigitalOcean, LLC (App Platform, Frankfurt region) (website, API and database hosting);
- payment and fraud-prevention partners, when needed to prevent fraud or abuse;
- authorities, when the law requires it.
5. Transfers outside the EU
Our servers run in the EU (Frankfurt), but some processors (for example Stripe, Discord and DigitalOcean, which are US companies) may process data outside the European Economic Area. These transfers rely on an adequacy decision (EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.
6. Cookies
We use one strictly necessary cookie to keep you signed in, and a short-lived one during Discord login. No advertising or analytics cookies, so no consent banner is needed.
7. Security
Encrypted connections (HTTPS), API keys stored only as hashes, access restricted to what each component needs, and backups of the database. No system is perfectly secure. If a breach affects your data, we will notify you and the authority as the law requires.
8. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw any consent. Write to us through the contact page. We answer within one month. Some data, such as payment records, must be kept for legal reasons even after deletion of the account. You can also complain to the CNIL, Commission nationale de l’informatique et des libertés (cnil.fr).
9. Minimum age
The Service is not intended for anyone under 16. If we learn we hold data about someone younger, we delete it.
10. Changes
We will publish any update on this page and notify you of material changes by Discord or email. The date at the top shows the latest version.