Privacy Policy

BSG Nexus Discord Bot Service
Last updated: June 2026

This Privacy Policy explains what personal data is collected, why it is collected, and how it is handled when using the BSG Nexus Discord bot service, in accordance with the General Data Protection Regulation (GDPR).

---

1. Data Controller

The data controller within the meaning of the GDPR is Tobias Lange (hereinafter "Controller").
For privacy-related questions, Contact: kontakt@tlange.info

---

2. What Data Is Stored?

2.1 Discord Server Data

• Discord Guild ID — unique identifier of the Discord server
• Configuration settings — channel names, roles, feature toggles
• Channel IDs — Discord channel identifiers for bot functions

2.2 User-Related Data

• Discord User ID — for cooldown tracking and warnings
• Discord username — stored in the web panel activity log upon login

2.3 Content Data (entered by administrators)

• Game names and vote counts
• Warning reasons and timestamps
• Admin notes
• Announcement texts and scheduled times
• Appointment schedules

2.4 Technical Log Data

• Web panel activity log (actions, timestamps, username)
• Maximum 500 entries per server; older entries are automatically deleted

2.5 Data Not Stored

• Discord message content
• IP addresses of Discord users
• Passwords (authentication is handled exclusively via Discord OAuth)

---

3. Purpose of Processing

Data is stored exclusively to provide the bot's functionality:

Data	Purpose	Legal Basis
Guild ID, configuration	Bot operation	Art. 6(1)(b) GDPR — contract performance
User ID (cooldowns)	Abuse prevention	Art. 6(1)(f) GDPR — legitimate interest
User ID (warnings)	Moderation function	Art. 6(1)(b) GDPR
Activity log	Accountability of admin actions	Art. 6(1)(f) GDPR

---

4. Data Sharing

Data is not sold to third parties or used for advertising purposes.

Technically necessary sharing occurs with: - Database hosting provider — for storage purposes only, under a data processing agreement

---

5. Retention and Deletion

Data Type	Deletion
All server data	30 days after bot removal
Activity log	Automatic: oldest entries after 500 entries
Warnings	Manually by admin or upon server deletion
Game names / votes	Manually by admin or upon server deletion

---

6. Your Rights

Every data subject has the following rights under the GDPR:

• Access (Art. 15 GDPR) — request information about stored data
• Rectification (Art. 16 GDPR) — correct inaccurate data
• Erasure (Art. 17 GDPR) — removing the bot deletes all data after 30 days; warnings can be deleted by server admins at any time
• Restriction (Art. 18 GDPR)
• Objection (Art. 21 GDPR)
• Complaint — right to lodge a complaint with a supervisory authority

To exercise these rights, contact the service provider or the administrator of your Discord server.

---

7. Data Security

• Database connections are SSL-encrypted
• Web panel uses HTTPS in production
• Authentication exclusively via Discord OAuth2 — no passwords stored
• CSRF protection on all web panel forms
• Rate limiting to prevent abuse
• SQL injection prevention via column name whitelisting

---

8. Discord

Use of the Service requires a Discord account. Discord processes data according to its own Privacy Policy:
https://discord.com/privacy

---

9. Changes

This Privacy Policy may be updated at any time. The current version is always available in the bot documentation.