Privacy Policy & Data Notice
Summary: TUD is an automated community administration and verification service operating on Discord. We collect only the data necessary to verify server members, manage support tickets, prevent malicious raids, and audit administrative staff actions. We never sell, monetize, or broker personal information, and we deploy only strictly necessary session cookies required for Discord authentication.
Data Controller & Scope
This Privacy Policy applies to the TUD Discord Application (the "Bot"), the Member Portal (/portal), the Staff Administration Dashboard (/dashboard), and associated verification and API endpoints (collectively referred to as the "Service").
The Service is operated by the TUD Server Administration. For inquiries, concerns, or data rights requests regarding your information, contact server management through a support ticket within the Member Portal or via direct inquiry in the official Discord server.
Information We Collect
We process the following categories of data when you interact with the Service:
| Category | Data Collected | Purpose |
|---|---|---|
| Discord Account Data | Discord User ID, username, discriminator, global display name, avatar hash, and server role memberships. | User identity verification, role-based access control, and permissions verification. |
| Access & Audit Logs | Authenticated login events, dashboard/portal tab navigation, timestamps, and client IP addresses. | Security auditing, investigating unauthorized account access, and monitoring administrative operations. |
| Inquiry & Support Records | Support tickets, custom questionnaire answers, staff complaints, role requests, and uploaded attachments. | Delivering customer support, processing requested community roles, and dispute resolution. |
| Moderation Records | Infraction logs (warnings, mutes, bans, kicks) and staff leave-of-absence (LOA) records. | Server safety, rule enforcement, anti-harassment, and administrative transparency. |
| Technical Data | Browser User-Agent, network IP, request paths, and session tokens. | Routing requests, maintaining secure authenticated sessions, and rate-limiting abuse. |
Legal Bases for Processing (GDPR & UK GDPR)
Under Article 6 of the General Data Protection Regulation (GDPR), we process your data under the following legal bases:
- Legitimate Interests (Art. 6(1)(f)): Processing is necessary for the legitimate interests of protecting our community against spam, ban-evasion, raids, and security breaches; maintaining an auditable trail of moderator and staff actions; and securing the Service against unauthorized intrusion.
- Contractual Necessity & Service Delivery (Art. 6(1)(b)): Processing is required to deliver the verification, support ticket, and self-service features you initiate when using the Bot and Portal.
- User Consent (Art. 6(1)(a)): Where you voluntarily choose to submit role requests, file staff complaints, or provide information in support tickets.
Cookie Policy & Transparency
VEIL enforces a strict, privacy-first cookie policy:
-
Strictly Necessary Session Cookie: When you sign in through Discord OAuth2, the Service sets a single, first-party HTTP-only session cookie (
connect.sid). This cookie stores an encrypted session identifier solely to authenticate your browser across requests. - No Advertising or Tracking Cookies: We do not use Google Analytics, advertising pixels, third-party beacons, or cross-site tracking scripts.
- Exemption from Consent Banners: Under Article 5(3) of the EU ePrivacy Directive and guidance from the European Data Protection Board (EDPB) and UK Information Commissioner's Office (ICO), cookies that are strictly necessary to deliver an explicitly requested service (such as user session authentication) are legally exempt from consent popups.
Data Sharing & Third Parties
We maintain strict internal boundaries regarding data access:
- No Sale of Data: We do not sell, rent, lease, or monetize your personal information to third parties, advertising networks, or data aggregators under any circumstances.
- Discord Inc.: The Service operates on the Discord platform. Data interactions are governed by Discord's Developer Terms of Service and Privacy Policy. When you authenticate via OAuth2, you interact directly with Discord's authorization endpoints.
- Role-Based Access: Sensitive data (such as staff complaints, IP addresses, and login audit trails) is protected by server role permissions. Server owners control access, and accused staff members are systematically restricted from viewing complaints filed against them.
Retention & Security Safeguards
Retention Windows:
- Access & Login Logs: Capped and automatically rotated via an automated FIFO (First-In, First-Out) storage engine to prevent indefinite data storage.
- Support & Complaint Transcripts: Preserved to allow users and server administration to review past resolutions and maintain accountability.
- Moderation & Ban Records: Retained indefinitely as necessary to enforce active server bans and safeguard the community against repeated violations.
Technical Safeguards: All data in transit is encrypted using modern TLS (HTTPS). Authentication cookies are configured with HttpOnly, SameSite=Lax, and Secure flags to defend against cross-site scripting (XSS) and cross-site request forgery (CSRF).
Your Legal Rights
Depending on your jurisdiction (including GDPR, UK GDPR, and California CCPA/CPRA), you possess the following rights regarding your personal information:
- Right of Access: You may request a copy of the personal data held about your account.
- Right to Rectification: You may request correction of inaccurate or incomplete information.
- Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal records, subject to our overriding legitimate interest in retaining active ban and security infraction records to prevent evasion.
- Right to Restrict or Object: You may object to the processing of your data based on legitimate interests.
To exercise any of these rights, open a support ticket in the Member Portal or contact server administration. Requests are processed within 30 days without charge.
Children's Privacy
The Service is strictly not directed to children under 13 years of age (or the minimum age of digital consent in your territory, such as 16 in certain EU jurisdictions), in full compliance with the Discord Terms of Service and COPPA. If we learn that personal data of an underage individual has been collected without verifiable parental consent, we will promptly delete the data and terminate associated accounts.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory modifications. The "Effective Date" at the top of this document indicates when the latest revision took effect. Continued use of the Service following modifications constitutes acknowledgment of the revised policy.