Effective: December 3, 2025. Last updated: October 4, 2026.
This Privacy Policy explains what data the Eroth Discord bot ("the Service") collects, how it
is used, and what your rights are. The data controller is the operator of the Service, contactable
in the Eroth support server (channel #support):
https://discord.gg/eroth.
1. Data We Collect
Discord identifiers: your Discord user ID, your username at the time of
interaction, and the IDs of guilds and channels in which you use the Service. We do not
store your email address from Discord.
Game data: in-game currency balances, character collection, combat
progression, bond status, and similar gameplay state strictly necessary to operate the
Service.
Purchase data: when you make a purchase from the Service operator, Stripe collects and processes your
payment details (we never see your full card number). We store the Stripe customer ID, the
PaymentIntent ID, the purchased SKU, the amount, the currency, and the timestamp, in order
to fulfil and audit the transaction.
Operational logs: basic logs of bot activity (command invocations, error
stack traces) used for debugging, retained for up to 30 days.
2. Legal Basis for Processing (GDPR)
Contract: storing your game state and processing purchases is necessary to
provide the Service you have requested.
Legitimate interest: operational logs and fraud monitoring are processed to
keep the Service secure, available, and free of abuse.
Legal obligation: purchase records are retained as required by tax and
consumer protection law.
3. Third-Party Processors
Discord, Inc.: hosts the platform on which the Service runs. See the
Discord Privacy Policy.
Stripe, Inc.: processes payments for purchases from the Service operator
and handles dispute resolution for those payments.
Stripe receives the data necessary to perform a transaction and is itself the controller of
that processing.
Railway: hosts the Service infrastructure (PostgreSQL database and Node.js
runtime). Database backups are stored in encrypted form by Railway.
4. Data Retention
Game data: retained for as long as your account is active, plus up to 90 days after deletion
request to allow rollback in case of dispute.
Purchase records: retained for the period required by applicable tax law (typically 10 years
in the EU).
Operational logs: retained for up to 30 days, then automatically purged.
5. Your Rights
If you are in the EU, EEA, UK, or another jurisdiction with similar protections, you have the
right to:
Access the personal data we hold about you.
Request correction of inaccurate data.
Request erasure of your game data (purchase records may be retained as required by law).
Object to processing based on legitimate interest.
Lodge a complaint with your local data protection authority.
To exercise any of these rights, contact the Eroth support server (channel #support):
https://discord.gg/eroth, including your Discord user ID and a description of your
request.
6. Security
We use TLS for all web traffic, store database credentials in environment-variable secrets,
restrict database access to the application runtime, and rely on Stripe for PCI-DSS compliant
payment handling. No system is perfectly secure; if you suspect a breach affecting your account,
contact us immediately.
7. Minors
The Service is not directed at children under 16 (see the Terms of Service Eligibility clause).
If we learn that we have collected personal data from a person under 16 without verifiable
parental consent, we will delete it.
8. Changes to This Policy
This Policy may be updated from time to time. Material changes will be announced through the
official Discord channels of the Service.