01 Data controller
The data controller is the Publisher identified in the legal notice. For any data question: [contact email] or the support server.
Administrators of each Discord server decide which modules are enabled on their server and remain responsible for informing their members about the processing they configure.
02 Data processed
| Category | Examples | Source |
|---|---|---|
| Discord identifiers | User ID, username, avatar, server and channel IDs | Discord API |
| Panel account | Discord ID (OAuth2 sign-in) or email and hashed password (bcrypt) | You |
| Server configuration | Module settings, roles, channels, automatic messages | Administrators |
| Module activity | Levels and XP, economy and inventory, birthdays, achievements, mini-game stats, reputation | Bot usage |
| Moderation and support | Warnings, sanctions, tickets and transcripts, bug reports, suggestions, audit logs | Bot usage |
| Message content | Messages scanned by auto-moderation or sent to AI features at your request; configured AI memories | Bot usage |
| Technical data | Session cookie, chosen language, IP address (logs and rate limiting) | Browsing |
BlueBird collects no payment card data and asks for no special-category data within the meaning of Article 9 GDPR.
03 Purposes and legal bases
- Providing the Service (commands, modules, panel, Premium) — performance of a contract (Art. 6(1)(b) GDPR).
- Security and abuse prevention (rate limiting, logs, block lists) — legitimate interest (Art. 6(1)(f)).
- Moderation configured by administrators — administrators' legitimate interest in keeping their server safe.
- Anonymised or aggregated internal statistics — legitimate interest in improving the Service.
- Accounting obligations for Premium purchases — legal obligation (Art. 6(1)(c)).
04 Retention periods
- Panel session data: up to 12 hours of inactivity.
- Server data (configuration, levels, economy, tickets…): while the bot is on the server, then deleted [within X days] after removal, or on request.
- Panel account: until deleted or after [X] years of inactivity.
- Technical and security logs: [12 months maximum].
- Accounting records: 10 years (French Commercial Code).
05 Recipients and processors
Data is only accessible to the Publisher and, for their server's data, to authorised administrators. It may be shared with the following technical providers, strictly as needed:
- Discord Inc. (USA) — the platform the bot runs on;
- Host [name, country] — hosting of the bot, website and database;
- AI providers (Groq Inc. and/or OpenAI, USA) — only the content you submit to AI features;
- Integrations enabled by administrators (Twitch, Steam, FiveM…) — public identifiers required by the integration;
- Google Fonts — loading the site's fonts, which sends your IP address to Google.
Transfers outside the European Union rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses.
06 Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, objection and data portability, and under French law the right to set instructions regarding your data after death.
To exercise them, contact the Publisher with your Discord ID. You will receive an answer within one month. You may also lodge a complaint with the French data protection authority, the CNIL, or your local authority.
07 Security
Measures in place: encrypted connection (HTTPS), passwords hashed with bcrypt, HttpOnly and SameSite session cookies, security headers (CSP, HSTS), rate limiting, Discord permission checks before any access to a server's panel.
08 Minors
The Service is intended for users who meet Discord's minimum age in their country. The Publisher does not knowingly collect data from children under that age; if you believe it has, contact it for deletion.
09 Updates
This policy may change. The last update date is shown at the top of the page; significant changes are announced on the support server.