Privacy Policy

1. Introduction

FormBot ("we", "us", "our") operates a Discord application bot and accompanying web dashboard (the "Service"). This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

By adding FormBot to your Discord server or using the dashboard, you agree to this policy. If you disagree, please remove the bot and stop using the Service.

2. What Data We Collect

From Discord OAuth (dashboard login):

• Discord user ID, username, and avatar hash
• Email address (if provided by your Discord account)
• List of Discord servers you belong to (to populate the dashboard)
• OAuth access and refresh tokens (stored securely, used only to verify guild membership)

From bot operation in your server:

• Discord server (guild) ID, name, and icon URL
• Discord channel IDs and role IDs referenced in your configuration
• Application form submissions (answers provided by your server members)
• Ticket messages (for transcript generation)
• Poll votes (stored anonymously as voter IDs per option)
• Giveaway entries (Discord user IDs)
• Birthday dates (month and day only — no year unless provided)
• Role backup snapshots (user ID → role ID mappings)
• Audit log actions performed within the dashboard

From Premium billing (via Stripe):

• Stripe customer ID (linked to your Discord account)
• Payment and subscription status (we do not store card numbers — Stripe handles all payment processing)

3. How We Use Your Data

• To operate the bot and dashboard features you configure
• To enforce per-plan feature limits (Free vs. Premium)
• To process and manage Premium subscriptions via Stripe
• To generate HTML ticket transcripts saved as Discord attachments
• To display analytics and submission history in the dashboard
• To send scheduled reminders (birthdays, giveaway endings, etc.) via Discord

We do not sell your data, run advertisements, or share your data with third parties except as described in Section 5.

4. Data Retention

Data is retained for as long as FormBot is active in your server. When you remove FormBot from your server, your server's configuration data is retained for 30 days to allow recovery, then permanently deleted.

Submission data, ticket transcripts, and audit logs are stored until you delete them via the dashboard or request deletion (see Section 6).

User account data (Discord ID, email, OAuth tokens) is retained until you request deletion. OAuth tokens are invalidated upon deletion.

5. Data Sharing

We share data only with the following third-party services:

• Discord — All bot operations interact with the Discord API under Discord's own privacy policy.
• Stripe — Payment processing for Premium subscriptions. Stripe stores payment details; we only receive a customer ID and subscription status.
• Our hosting provider — The server and database infrastructure. Data is stored in the EU/EEA. We require our providers to maintain appropriate data security.

6. Your Rights

You have the right to:

• Access — Request a copy of the data we hold about you.
• Rectification — Request correction of inaccurate data.
• Erasure — Request deletion of your personal data ("right to be forgotten").
• Restriction — Request that we limit processing of your data.
• Portability — Request your data in a machine-readable format.
• Objection — Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@formbot.app. We will respond within 30 days.

If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.

7. Security

We take reasonable technical and organisational measures to protect your data, including encrypted storage of OAuth tokens and Stripe customer IDs, HTTPS for all data in transit, and access controls on our infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children

The Service is not directed at children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect data from children. If you believe a child has provided us personal data, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify server owners via the support Discord server and update the "Last updated" date above. Continued use of the Service after changes constitutes acceptance of the revised policy.

10. Contact

Questions about this policy? Contact us at privacy@formbot.app.