Privacy policy

Protector sells no data and collects none for advertising. This policy describes precisely what is processed by the Discord bot Protector ("the Bot") by the protector-bot.com website ("the Site") and by the support.protector-bot.com support center ("the Support Center").

1. Data controller

The Bot and the Site are run on a personal, non-professional basis by their operator ("we"). Contact: eza@protector-bot.com or support@protector-bot.com, eza_official on Discord, or the support server. Information about the publisher and the host is in the legal notice.

2. Data kept by the Bot

The Bot stores only what it needs to work, in a database hosted on a virtual private server rented from Contabo GmbH (Germany), located in the European Union and dedicated to Protector.

a) Per-server configuration

Server ID and chosen settings: enabled modules, thresholds, log channels, staff roles, security role, language, verification role and channel. If the Discord AutoMod shield is on, the Bot also keeps a fingerprint of the native AutoMod rules it set on the server, never any member data.

b) Moderation record

ID of the sanctioned user and of the moderator, type of sanction, optional reason, duration, timestamp and origin (bot, report, external action). Sanctions made outside the Bot, through the Discord audit log, may also be recorded with their reason.

c) Global blacklist and anti-bot

IDs of users or bots on the blacklist or allow list, reason, ID of the team member who acted, timestamp.

d) Protector team

IDs of team members and their permission level.

e) Structure backups (anti-nuke)

A copy of the channel and role structure (names, types, categories, positions, permissions), refreshed about every 10 minutes, to restore the server after a raid. If the "Restore recent messages" option is enabled (by default, can be turned off in /config, Anti-nuke), the copy includes the last 10 messages of each text channel (content, author's name and avatar), replaced at each capture. The state of each channel and its last 20 known states are also kept, to rebuild a channel deleted or altered by an attacker.

f) Judgment log (moderation improvement)

When a report is handled by a server's moderation team, or an automatic filter acts on a message, the Bot may keep the content concerned, the few messages around it, the reason, any automatic analysis and the decision taken. This log is used exclusively to measure and improve moderation accuracy, above all to reduce false reports. It never triggers a sanction.

No Discord ID is stored in it: each author is replaced by an irreversible pseudonym, computed with a secret key specific to the installation. Only messages already handled by moderation are concerned, capped at a few messages per server per day. Some cases are submitted to the Protector team for review, always in this pseudonymized form. Each server can refuse this collection in /config, Improvement.

g) Support tickets

If a server enables tickets, a ticket's content is kept while the ticket is open, then assembled on closing into a transcript archived in the channel chosen by the server, sent to the member who opened the ticket, and pushed to the server's HTTPS address if it configured an outgoing webhook. The transcript belongs to the server, which is responsible for it.

h) Owner-requested backups

When the Bot joins and at each /backup create, a backup of the structure and of the last 10 text messages of each channel is saved, until the owner deletes it.

i) Database safety copies

The whole database is copied automatically every hour so it can be recovered after a failure. These copies stay on Protector's server and are deleted at most four weeks after they are created.

j) Joins, invites and event log

For each join on a protected server: the member's ID, the invite code used and the ID of the person who created it, when Discord makes this possible to know. This data powers the /invites command and helps spot accounts brought in bulk by the same inviter. If the server enables the event log, a summary of each logged event (author, channel, kind of change) is also kept for 90 days, for the member profile and the persistent log.

Images of deleted messages. If the message log is on in a server, the Bot copies the images attached to messages (4 per message, 8 MB each at most) as soon as they are posted, on its own server. If the message is deleted, the image is reposted in the server's log channel, then the copy is deleted. An image removed as NSFW content is never reposted. Unused copies are deleted after 24 hours.

k) Levels, temporary voice channels, notifications and auto responses

If a server turns these tools on: for levels, each member's ID, XP, level and the time of their last gain (never the content of messages); for temporary voice channels, the opened channel, its owner and its settings (mode, whitelist and blacklist), and the settings a member chooses to save for their next channel; for notifications, the public YouTube, Twitch and TikTok accounts followed by the server and the last post seen for each. To know whether an account has posted, the Bot asks YouTube, TikTok and Twitch directly with only the account's public name: no member data is sent to them. Auto responses only keep the triggers and responses written by the server.

l) Presences (status and activity)

Discord sends the Bot the members' status (online, idle, offline), their custom status and the device they use. The Bot reads them when they change and does not keep them, with three exceptions:

• Trapped status: if the custom status contains a known scam link, the sanction and the link are written to the record, as for a message.
• Representative role (if the server turns it on): the role is given or removed depending on whether the server invite is in the status. Only the role changes, the status is not stored.
• Staff presence (if the server turns it on): for staff members only, the Bot keeps the total online time per day, with no login times, activity or custom status. These totals feed the Monday report and are deleted after 30 days.

An account that only uses Discord in a web browser can also get a few extra points on the verification risk score. This signal alone never triggers a sanction and is not stored.

3. Data processed by the Site

a) Logging in with Discord

When you log in: your Discord ID, username, display name, avatar and the list of servers you can manage (ID, name, icon, owner or not). The access token provided by Discord is kept encrypted with your session, and is only used to read your server list again so that servers where you just added Protector show up. It is erased when you log out or when the session expires, and Discord makes it unusable after 7 days. The session cookie only contains a random token, of which only a fingerprint is saved.

b) Dashboard

For each server where the Bot is present: name, icon, member count, module states and IDs of the people allowed to change protected modules. To build the settings forms, the Bot also sends the current value of every setting and the list of the server's channels and roles (identifier, name, category or colour). No messages, no members.

Change requests made on the Site: author, server, setting, requested value and result.

Statistics and lists. The Bot also sends numbers aggregated per day over 30 days (sanctions, automatic sanctions, blocked attacks, reports), with no reason, no username and no member ID; the server's banned words list; its role buttons (channel, role, text); its counters; and the list of its backups (name and date, never their content).

Welcome card background image. When you send one, it is stored outside any public page while the Bot downloads it (signed request) and scans it with its anti-NSFW filter. Its metadata (GPS position, device, date) is removed on reception. If refused, it is deleted at once; if accepted, it serves as a preview for the people who manage the server until it is replaced or removed. Until it is accepted, only the person who sent it can see it.

"They trust Protector" pledge. The owner of a server with at least 5,000 members can sign, from the dashboard, a pledge that allows the server's name, icon and member count to be shown publicly, with an optional testimonial and invite link. The Site keeps the pledge (server, owner ID, text, link, date, the team's decision and its reason). Nothing is public before the Protector team approves it; the server leaves the home page as soon as the Bot leaves it, and the owner can withdraw the pledge at any time, which deletes it.

c) User reports

When you send a report: your Discord ID and name, the reported account's ID, the category, your description, the links and context provided, and attached files (name, type, size, content).

• Files are stored away from any public page and are never served to the browser. Only the Bot can read them, through a signed request.
• Metadata of JPEG and PNG photos (GPS location, device, date) is removed on receipt.
• The Bot posts the report and its files in a private channel reserved to the Protector team on Discord, then the files are deleted from the Site.
• Protector does not tell the reported account who you are.

Images attached to a report made from Discord with the "Report user" command, and blacklist evidence, are hosted by the Site itself (see point j below). Imgur is no longer used.

d) Blacklist appeals

When you appeal a blacklist on the Site: your Discord ID and name, the text of your appeal and its status. The Bot collects it through a signed request, checks that your account is indeed blacklisted, then posts it in a private channel reserved to the Protector team. Only a status comes back to the Site (delivered, accepted, denied, not blacklisted): the reason and evidence of the blacklist are never sent to it.

e) Server builder

When you ask Protector to build your server: the server ID, your Discord ID, the description you write, the chosen goal, language and style, then the three proposed templates and the one you pick. To design the templates, the Bot sends your description (and nothing else about you) to Groq (United States), under the conditions described in point 5.

• Without the Builder Pass, three trials are offered in total, counted per account and per connection to prevent multiple accounts. For this, the Site keeps an irreversible fingerprint of your IP address (never the address itself), for one year.
• The description and templates are erased after 30 days; only the count (date, fingerprint) stays one year. "Delete all my data" also erases the description and templates and detaches the count from your account.
• The Builder Pass is a Discord purchase tied to your account: the Bot sends the Site a fingerprint of the accounts that own it, never a readable ID.

f) Ticket transcripts

When a server turns this option on, the transcript of a closed ticket is stored on the Site instead of travelling as a file: the ticket messages (author, text, embeds, name and size of shared files), the subject, the dates and the list of people allowed to read it. The files themselves are not kept, nor avatars, nor the staff internal notes.

• Reading requires a Discord login: only the person who opened the ticket, the ticket staff, the owner and the server managers can open it. A forwarded link shows nothing to anyone else.
• The reader's name is watermarked across the page, and the conversation hides itself when the window goes to the background. No technique can prevent a screenshot: these measures make it identifiable, not impossible.
• The transcript belongs to the server that archives it: it is kept for one year, then deleted automatically.

Incident reports. After a raid or a bot spam, the bot stores the incident report on the Site: ID and name of the attacking accounts and of those who added them, what Protector did to them, the timeline taken from the server's audit log and figures (messages deleted, channels and roles restored). No message content is included. Only the server owner, its managers and the Protector team can read it, after logging in with Discord.

g) Member profile

Someone who can manage a server can open, on the Site, the profile of a member of that server: their record (sanctions, reason, moderator, date), their arrivals and who invited them, the tickets they opened, and the lines of the server's event log that concern them (last 90 days). This data is not copied permanently to the Site: the Bot sends it when the profile is opened, and the Site erases it after 15 minutes. Only the person who requested the profile can read it.

• Every profile opened is written to an access log (who looked, which member, when), readable by the server owner and kept 90 days. It makes access accountable; it is not erased when the person who looked deletes their account, during those 90 days.
• For every request, the Bot checks again that the person can still manage that server.

h) Link check

The Check a link page works without an account. The Site keeps the submitted link, the report produced (the link's path, page title, signs found) and a fingerprint of your IP address, used only to limit the number of checks per hour: the address itself is not stored. Everything is erased after 24 hours.

• The page is read by the Site's server, never by your browser: no script of the checked page is run.
• Second opinion. The link is also sent to IPQualityScore (United States), which returns the domain's reputation (risk score, phishing, malware, domain age). Only the link is sent: neither your IP address nor any identifier. A link to an internal network or to an official domain is never sent. Avoid checking a link that contains personal information (a password reset link, for example).

i) Technical data

Like any website, the host's web server keeps technical logs (IP address, requested page, date, browser) for security and proper operation, for the period set by the host. The Site uses no audience measurement and no advertising tracker.

j) Blacklist evidence

Screenshots that justify a blacklist are stored on the Site, outside any public page, under a random name that cannot be guessed. Only the Bot can upload them, through a signed request; they are only displayed through a direct link, used by the Protector team. Image metadata is removed and the Site only keeps the image, its type, its size and a fingerprint used to avoid duplicates. Evidence is kept as long as it justifies a blacklist or is needed to handle an appeal against it; if the blacklist is lifted, the person concerned can ask for it to be deleted.

k) Protector team recruitment

When you apply to join the team: your Discord ID and name, your form answers (age, languages, time zone, availability, answers to the questions of the chosen section), the date, the status of the application and the team's votes. The Bot adds checks on your account (account age, blacklist, known sanctions). Only the leads of the Protector team can access it.

If the team invites you to take the inspectors' written assessment, the Site also keeps your answers, the time of each step, a fingerprint of your IP address (never the address itself) and the events needed for a fair assessment: leaving the page, copy and paste, reloading. The page tells you this before you start. This information is only used to evaluate the application.

l) Votes

When you vote for Protector on top.gg, top.gg sends the Site your Discord ID and the date of the vote, to credit rewards (a free Premium week, for example). The Site keeps the vote for six months.

When a server starts the free Premium trial, the Bot keeps the server's ID, the ID of the person who started it and the trial dates, so that it can only be used once per server. The owner gets a private message the day before it ends, then when it ends.

m) Appeals and applications of a server

When a server opens its appeal or application page (Premium Plus plan) and you use it: your Discord ID, name and avatar, the server concerned, your answers (the sanction appealed and your explanation, or your answers to the server's form), the date and the status of the request. Only that server's team, meaning the people who can manage it, reads and decides on it; the decision, any message and the name of the person who decided are kept with the request. If the request is accepted, the Bot may lift your ban or mute, or give you a role, and lets you know by direct message. The server decides: Protector only applies the decision.

n) Halloween hunt

During the event, a game is recorded without an account: a random ID (kept in a cookie), the ingredients found, the start and end times, and a fingerprint of your IP address (never the address itself) to limit abuse. To claim the reward, you log in with Discord: the Site then keeps your Discord ID, the chosen server and the date, so that a reward is given only once per person and per server.

o) Hidden gift

The Site hides a gift that opens only once per person. To claim it, you log in with Discord; the Site then keeps your Discord ID, your username, the chosen server, the date, and irreversible fingerprints of your IP address, your browser and a device identifier kept in a cookie (never the address or the characteristics themselves). They are compared with those of gifts already opened and with those of the Site verification, to refuse a second account. Every attempt, accepted or refused, is logged with these fingerprints so the team can answer a complaint. This data is kept as long as the offer exists.

Protector API. For the API, the Site keeps, for your Discord account: a fingerprint of each of your keys (the key itself is never stored), its name, its creation and last use dates, and the number of requests and images of the month. Texts and addresses you send are analysed on the fly and not stored. An image you send is passed to the Bot, which analyses it on its own server, then it is deleted; only the verdict is kept for 24 hours. The blacklist is only looked up through fingerprints: the Site only answers yes or no, without reason or evidence. The Site only knows who holds the API Pass through fingerprints.

o) Web verification

When a Premium server verifies its new members on the Site, the verification page records, for your Discord account and for that server only: a fingerprint of a random identifier kept in a cookie in your browser (strictly necessary cookie, 1 year), a fingerprint of technical traits of your browser (screen, time zone, graphics card, rendering of an image), a fingerprint of your IP address and the date. None of these values is readable in plain text. They are only used to spot an alternate account, especially one of a banned member. They are compared with all verifications made on the Site, but a server's staff only learns about linked accounts that were verified on their server, are members of it or are banned from it; never your fingerprints, nor the other servers you went through. They are deleted after 180 days, or earlier from your account.

Premium Plus. On these servers, your IP address is also sent to proxycheck.io (United Kingdom), which says whether it goes through a VPN, a proxy or Tor. Only that result is kept, for 7 days at most.

p) Linked roles

If you link your account on the Linked roles page, Discord asks for your permission (identify and role_connections.write scopes). The Site then keeps your Discord ID, your username, an encrypted renewal token from Discord (AES-256-GCM), the values last sent and the dates of linking and update. It sends Discord only two values: whether your account is on Protector's global blacklist ("Verified by Protector") and the creation date of your account, deduced from your ID. Discord uses them to let you claim the roles that require them; the servers only see whether you meet their requirements.

About once a week, or when the blacklist changes, the Site renews the access with Discord to keep these values accurate. Everything is deleted when you unlink, when you delete your data from the Site, or as soon as Discord refuses the renewal (access revoked in Authorized Apps).

4. Data processed by the Support Center

The Support Center (support.protector-bot.com) hosts the online help and the requests sent to the Protector team. It is hosted by o2switch, in France, with its own database.

a) Login with Discord

To send a request, you log in with Discord. The Support Center receives your ID, username, display name, avatar and language, as well as the list of your servers, used only to choose the server a request is about and kept with your session. It never receives your password or your email address.

b) Requests

A request contains what you write: the type (question, problem, user report, blacklist appeal, Premium…), the subject, your messages and the form details (server concerned, module, ID of a reported or appealed account, steps to reproduce a bug, evidence). You can attach up to 5 files of up to 8 MB (images, PDF, videos), stored outside any public page and visible only to you and the team. A request can also be opened from Discord with a Bot command: the Bot then sends the same information. The Support Center also keeps the request history (status, priority, tags, person handling it, changes), your rating of the answer if you give one, and internal notes only the team can see. An account that abuses the form can be blocked.

c) Notifications

When the team replies or the status of your request changes, the Bot lets you know by direct message on Discord. The team receives an alert in a private channel of its Discord server, with the subject and a short excerpt of the request.

d) Automatic reply assistant

If no team member has replied after a set delay, a question or problem request may be read by an artificial intelligence assistant, which answers from the online help articles. It then receives the request type, your display name, your language, the name of the server concerned, the form details, the subject and the conversation, but not your attachments. This information is processed by an artificial intelligence provider located in the United States, which does not use it to train its models. The answer is signed as coming from the assistant; when it is not sure, it hands over to the team. Reports, appeals, payments and questions that require looking at your server or account are always left to a human.

e) Online help

Articles can be read without an account. The number of views and the "helpful / not helpful" votes are anonymous counters; to avoid counting the same person twice, the Support Center keeps a fingerprint of the IP address for 2 days at most, never the address itself.

5. Data analyzed but not kept

To moderate, the Bot analyzes message content and images in real time to detect spam, phishing, NSFW content or hate speech. This content is processed in memory then discarded, except for the cases described in section 2. Only a short description of the offense may appear in a sanction's reason. Image analysis runs locally, without sending anything to a third party.

Contextual analysis by a third party (optional). When the administrator enables the AI Moderation module, the text of a message may be sent to Groq (United States) to assess its context, or to the operator's AI provider if one is configured. On Premium servers, Perspective API (Google) may assess whether a message is sexually explicit, sent with the "do not store" option.

• Only messages already flagged by local filters are sent, never whole conversations.
• No image is sent.
• The module is not enabled by default. A local classifier takes over if the third-party service is unavailable: in that case, nothing leaves.

Checking a link with /scan. For a link, the Bot opens the page in an isolated browser, on its own server and cut off from its internal network, then sends you back a screenshot. Only the link address is used; the page and the screenshot are not kept after the reply.

6. What we do not collect

• We neither read nor store your private messages, apart from commands you deliberately send to the Bot.
• We do not track your activity for advertising and sell no data.

7. Cookies and local storage

The Site only uses strictly necessary cookies, which require no consent. Details are on the Cookies page. The Support Center likewise uses a session cookie, an anti-forgery token, two temporary cookies during the Discord login and a cookie that remembers your language; during the Halloween event, the Site also keeps the ID of your game and, if you win, a cookie that records it for one year.

8. Legal bases

• Legitimate interest of the operator and servers in protecting themselves against abuse (raids, scams, illegal content): moderation, blacklist, reports, technical logs.
• Performance of the service you request by adding the Bot or logging in to the Site: configuration, dashboard, session.

9. Retention periods

10. Recipients and providers

Data is shared with no third party, except where required by law and with the following providers:

• Discord Inc. (United States): platform the Bot runs on, and login service for the Site. See Discord's privacy policy.
• o2switch (France): hosting of the Site and its data.
• Groq (United States) and Google (Perspective API): optional analysis described in section 5, on servers that enable it.
• Contabo GmbH (Germany): hosting of the Bot, its database and the isolated /scan browser, on a server located in the European Union.
• top.gg (United States): voting platform, which sends the Site the votes described in section 3 l).
• proxycheck.io (United Kingdom): VPN, proxy and Tor check of IP addresses during web verification, described in section 3 o).
• IPQualityScore (United States): second opinion on links submitted for checking, described in section 3 h).
• Artificial intelligence provider (United States): automatic reply assistant of the Support Center, described in section 4 d), when it is enabled.

Some of these providers are located outside the European Union; transfers rely on the safeguards these providers put in place.

11. Security

The Bot and its database are hosted on a private server dedicated to Protector, whose administration is only reachable with an encrypted key; no public page or service is open on it: the Bot contacts the Site through signed requests, and the /scan browser runs in an isolated compartment, without privileges and without access to the internal network. The Site enforces HTTPS, protects every action with an anti-forgery token and applies a strict content security policy. Since no measure guarantees absolute security, we encourage you to protect your Discord account (see the security tips).

12. Your rights

Under the GDPR, you have the right of access, rectification, erasure, restriction and objection. To exercise them, write to eza@protector-bot.com or support@protector-bot.com, or contact eza_official on Discord, with your Discord ID. You may also file a complaint with the CNIL or your local data protection authority.

From the My data page, you can also, without contacting us: download everything the Site keeps about you (JSON file), delete your reports, close your sessions on every device, or delete all your data from the Site.

If you were reported, you can ask for access to the data about you; some information, such as the identity of the reporter, may be withheld to protect the rights of others.

13. Minors

The Service is intended for users who have reached the minimum age required by Discord: 13 years old, or higher where Discord sets a higher age in your country. We do not knowingly collect data from children below that age.

14. Changes

This policy may be updated. The date is shown at the top of the page; important changes are announced on the support server.

Informational document, not legal advice.