Privacy Policy

01 Overview

BotBasis ("we", "our", "us") is committed to protecting your personal data. This Privacy Policy describes how we collect, use, and share information when you use our Discord bot hosting platform and related services.

We act as a data controller under the General Data Protection Regulation (GDPR) for personal data we collect about you. Our legal basis for processing varies by activity and is described in each section below.

02 Data we collect

We collect different categories of data depending on how you interact with BotBasis:

Account data — when you register, we collect your email address, username, and password hash. If you sign in via Discord OAuth, we receive your Discord user ID, username, and avatar.

Bot & deployment data — bot tokens (stored encrypted), deployment configuration, log output, resource usage metrics (CPU, RAM, request counts), and error traces.

Payment data — subscription plan, billing cycle, and payment status. We do not store full card numbers; payments are processed by our payment provider.

Usage & technical data — IP address, browser type, referring URL, pages visited, and timestamps. This data is collected automatically via server logs and, where consented, analytics cookies.

• We do not read the content of messages your Discord bot sends or receives.
• We do not collect data about members of Discord servers your bot operates in beyond what is necessary to deliver the Service.

03 How we use your data

We use the data we collect to:

• Provide, operate, and improve the BotBasis platform — legal basis: contract performance.
• Process payments and manage subscriptions — legal basis: contract performance.
• Send transactional emails (account verification, billing receipts, downtime alerts) — legal basis: contract performance.
• Monitor service health, detect abuse, and enforce our Terms of Service — legal basis: legitimate interests.
• Analyse aggregate usage trends to improve our product — legal basis: legitimate interests.
• Send product updates and newsletters, where you have opted in — legal basis: consent.
• Comply with legal obligations — legal basis: legal obligation.

04 Sharing your data

We share personal data only in the following circumstances:

• Defensionetworks — our infrastructure provider, processes data to run compute and networking services. Bound by a Data Processing Agreement.
• Payment processor — processes billing transactions. They receive only the data necessary to complete a payment.
• Legal requirements — we may disclose data if required by law, court order, or to protect the rights, property, or safety of BotBasis, our users, or the public.
• Business transfer — in the event of a merger or acquisition, data may be transferred as part of that transaction. We will notify you via email and a notice on our website before any transfer occurs.

All sub-processors are located within the European Economic Area or are covered by adequate transfer safeguards.

05 Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy or as required by law.

• Account data: retained for the duration of your account, plus 30 days after deletion.
• Bot logs and metrics: retained for 90 days on paid plans, 14 days on the free tier.
• Payment records: retained for 7 years to comply with Dutch tax law.
• Server access logs: retained for 30 days for security and abuse detection.

06 Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we limit how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@botbasis.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

07 Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption at rest and in transit (TLS 1.3).
• Bot tokens stored with AES-256 encryption.
• Role-based access controls limiting who can access production data.
• Regular security audits and penetration testing.
• DDoS protection provided by Defensionetworks.

No method of transmission over the internet is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it.

08 Children

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have collected such data, please contact us immediately at privacy@botbasis.com and we will delete it promptly.

09 Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email and by updating the "Last updated" date at the top of this page. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

10 Contact & DPO

For any privacy-related questions or to exercise your rights, contact our Data Protection Officer:

• Email: privacy@botbasis.com
• Address: BotBasis B.V., Amsterdam, Netherlands
• Response time: within 30 days