Data Processing Agreement

When your Bot records a moderation action, tracks levels, stores a ticket or counts an invite, it processes personal data about members of your Discord server. You decide that it should happen and why, which makes you the controller. We only store and process it on your instruction, which makes us your processor.

Art. 28(3) GDPR requires that relationship to be governed by a contract. This is that contract. Without it, your use of the Service to process member data would not be lawful — for you, not for us.

Subject matter and purpose. The provision of Ruination Bots: hosting and operating Discord bots on the Controller's behalf and storing the data those bots generate, as configured by the Controller.

Nature of the processing. Collection, recording, organisation, structuring, storage, retrieval, use, transmission to Discord, restriction and erasure, carried out by automated means.

Duration. For as long as the Controller holds an account, and it ends when the account or the relevant Bot is deleted.

Special categories of data (Art. 9 GDPR) are not part of this agreement. The Service is not designed for them. If the Controller configures a Bot in a way that causes such data to be submitted — for example a ticket form asking about health — the Controller does so on its own responsibility and must carry out its own assessment.

We process personal data only on the Controller's documented instructions, including in relation to transfers to third countries, unless required to do otherwise by Union or member state law. In that case we will inform the Controller of the legal requirement before processing, unless that law prohibits it on important grounds of public interest.

The Controller's instructions are given by this agreement, by the Terms of Service, and above all by the configuration made in the dashboard: enabling a module, setting a retention option or deleting a record are instructions in this sense. Further individual instructions may be given in text form to TODO: privacy@yourdomain.tld.

We will inform the Controller without delay if, in our opinion, an instruction infringes the GDPR or other data protection provisions, and may suspend execution of that instruction until it is confirmed or changed.

Everyone we authorise to process personal data under this agreement is bound to confidentiality, either contractually or by a statutory duty, and that obligation survives the end of their engagement. Access is granted only to those who need it to provide or maintain the Service, and only to the extent needed.

We implement measures appropriate to the risk, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing. These are set out in Annex II and may be updated as technology develops, provided the level of protection is not reduced.

The Controller grants general authorisation for the engagement of sub-processors. Those currently engaged are listed at Sub-processors and reproduced in Annex III.

We will inform the Controller of any intended addition or replacement at least 30 days in advance, by email to the address on the account. The Controller may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Controller may terminate the contract without notice and without cost, which is the only remedy for an objection.

We impose on every sub-processor, by contract, data protection obligations no less protective than those in this agreement, and remain fully liable to the Controller for their performance.

Taking into account the nature of the processing, we assist the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests under Chapter III GDPR.

In practice the dashboard is that assistance: access, correction and erasure of member records can be carried out by the Controller directly, without involving us. Where a request reaches us instead of the Controller, we will not answer it ourselves — we will forward it without undue delay and support the Controller in answering.

We notify the Controller without undue delay after becoming aware of a personal data breach affecting data processed under this agreement, with the information available to us, so that the Controller can meet its own obligations under Arts. 33 and 34 GDPR.

We also assist the Controller, taking into account the nature of processing and the information available to us, in complying with Arts. 32 to 36 GDPR, including data protection impact assessments and prior consultation.

At the Controller's choice, we delete or return all personal data after the end of the provision of services, and delete existing copies, unless Union or member state law requires storage.

Deleting a Bot or the account triggers this automatically and irreversibly (immediately, with backups overwritten within 30 days). Backups are overwritten on their ordinary cycle. The Controller can export configuration before deletion; we do not retain a copy afterwards.

We make available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates.

Audits are to be announced with reasonable notice, are limited to normal business hours, must not disproportionately disrupt operations, and are subject to confidentiality. In the first instance we may satisfy an audit request by providing documentation, our own measures, or current certifications and audit reports from our sub-processors. On-site inspection at our providers' data centres is not something we can grant, since we do not operate them.

Where processing takes place outside the EU or EEA, it is covered by an adequacy decision under Art. 45 GDPR or by appropriate safeguards under Art. 46 GDPR, as a rule the European Commission's Standard Contractual Clauses, supplemented by technical measures. Annex III states the position for each sub-processor. Any transfer beyond those described there requires the Controller's instruction.

The following measures are implemented in accordance with Art. 32 GDPR. They are stated honestly rather than aspirationally: what is listed is what is in place.

• Pseudonymisation and encryption. TLS for all data in transit. Encryption at rest at the database and storage layer. Bot tokens additionally encrypted at the application layer with a separate key, never returned to a client and never logged. IP addresses in audit records stored only as hashes.
• Confidentiality — access control. Authentication via Discord OAuth with no passwords held by us. Row-level security in the database restricting each account to its own rows. Administrative credentials held server-side only. A granular permission model for moderators, with the delegation of access itself reserved to the owner.
• Integrity. An append-only audit log of every configuration change, including refused attempts, retained 90 days. Input validation on every API endpoint. Rate limiting against abuse and enumeration.
• Availability and resilience. Managed, replicated database with automated backups held by our infrastructure provider. Health monitoring of running bots with automatic recovery. Job queues that retry with backoff rather than losing work.
• Regular review. Dependency updates, review of access rights, and verification that documented retention periods match what the software actually does.
• Separation. Data is separated per account and per bot at the row level, and access is always scoped by the acting account.
• Instruction control. Processing is driven by the Controller's configuration; no member data is used for our own purposes, and none is used to train models or for analytics beyond the Controller's own dashboard.