Privacy Policy

Last updated: 13 October 2026

This policy describes the personal data processed by the Ammit Discord bot, its web portal (https://panel.ammitbot.com) and its website www.ammitbot.com, the reasons for this processing, how long the data is kept and your rights. It supplements the terms of service.

1. Data controller

The data controller is TyXe0 Digital, 70 AVENUE DE GRASSE, 06800 CAGNES SUR MER, FRANCE, SIREN 131471211.

Contact for any question about personal data: support@ammitbot.com.

2. Data processed and purposes

2.1 Portal account

• Discord account ID, name and avatar: identity of the account and the only way to sign in, proof of server ownership, link with subscriptions. At each sign-in, only the account's ID, name and avatar are read. When the account is created from the sign-up page, the email address is read too. The token issued by Discord is revoked immediately and is not kept. The avatar is shown in the portal, loaded from Discord.
• Email address (required): confirmations, subscription notices and reminders, invoices and credit notes, configuration link when Discord direct messages are closed. If you create your account from the sign-up page, Discord sends the address of your Discord account and states whether it is verified. This address is suggested in the form. You can change it. If you keep an address verified by Discord, no confirmation is requested. Another address is confirmed through a link.
• Optional contact details (first name, last name, company, address, postcode, city, country, phone): billing and exchanges with the publisher.
• Preferences: interface language, subscription notifications by email, consent to marketing communications, date the terms were accepted.

Ammit keeps no password: signing in to the portal goes through Discord only.

Purposes: performance of the contract (provision of the service, billing); consent for marketing communications, which can be withdrawn at any time in My account › Settings. No marketing communication is sent without this consent.

2.2 Sign-ins, sessions and actions on the portal

• Sign-in attempts (date, IP address, result, browser): protection against intrusions (temporary block after several failures), history viewable in My account › Security and connections.
• Open sessions (token fingerprint, IP address, browser, dates): keeping you signed in, closing a session remotely.
• Log of actions taken from the portal (date, action, server concerned, IP address): traceability of the configuration, security.

Purposes: legitimate interest of the publisher and of server owners in the security of the service.

2.3 Discord server data

For servers where Ammit is installed, the service processes, depending on the features enabled by the owner:

• the server's configuration (settings, channels and roles used, custom texts) and its history (author, date, value before and after);
• moderation records: sanctions (member concerned, moderator, reason, date, duration), team notes, tickets (opening questions, participants, status), reports (reason), appeals (member's text), approval requests, automod review queue, internal team comments;
• security alerts (type of detection, domain or measure taken, never the message content) and the fingerprints (SHA-256) of images blocked by the team, never the images;
• server events (arrivals, departures, roles, channels, automod actions, anti-raid);
• the content of deleted or edited messages, only if the owner has enabled the message log; the transcript of a ticket, only if the server has enabled it; the excerpt of a reported or reviewed message, only if the server has enabled it;
• statistics: number of messages per member, channel, day and hour, date of the last message, voice minutes per member, channel and day, and, if the server chose it, minutes per game or application — never the content of messages;
• enabled community tools: experience and levels, suggestions and votes, giveaway entries, away status, reminders, self-service roles;
• birthdays: day and month of birth recorded by the members themselves with /anniversaire, never the year, and the year of the last wishes, so as not to celebrate the same member twice;
• temporary voice channels: open channels (owner, admitted or excluded members) and, on a premium server, the owner's last settings for their next channel (name, number of places, lock, visibility);
• RSS, Reddit, Kick, X and Instagram announcements: addresses of the feeds and names of the followed accounts, IDs of items already announced. The bot reads this public content without passing on anything about the members;
• the economy of a premium server: each member's balance, total earned, date of the last daily reward, shop items, and transactions (reward, gift, purchase, adjustment by the team, with the member concerned, the amount and the reason). Earnings per message are not listed one by one;
• achievements: achievements obtained by each member and their date, custom achievements created by the team;
• external automations: address and secret of each webhook link, and a log of its last 50 calls (date, type of event, response code, duration). An outgoing link sends the summary of the server's events (for example "alice joined the server") to the address chosen by the owner, with the Discord IDs and names of the people concerned. The content of messages is never sent;
• backups of the server structure (roles, channels, permissions, settings), never the messages;
• the invites used by new members (code, inviter), for levels and anti-raid;
• for on-demand translation, the text of the message is sent to the translation service chosen by the publisher for the time of the translation; nothing is kept.

The server owner decides which features are enabled and whether message content is kept; they are responsible for informing their members. The publisher acts as a processor for this processing, except for the data needed for the operation and security of the service.

2.4 Subscriptions and payments

• Subscriptions: plan, duration, dates (payment, activation, due date, activation deadline), renewal, covered server, transfers (date, origin and destination servers), gifted periods and gift codes used, limited offer the subscription comes from and free months, subscription or order IDs at Stripe or PayPal, history of events (payment, activation, transfer, reminder, stop, refund).
• Servers that have already had Premium (server ID, date): conditions of the limited offers, which can only be activated on a server that has never had Premium.
• Invoices and credit notes: number, date, customer details, lines, amounts, payment method and reference.

Payment is made with Stripe or PayPal: no bank data (card number, security code, PayPal account) is passed to Ammit or kept by it. For a refund, Ammit sends the provider the reference of the payment to refund, nothing else; a credit note is issued. Purposes: performance of the contract and accounting and tax obligations.

2.5 Communications

Transactional emails (address confirmation, change of address, invoices and credit notes, due date and activation reminders, refund) and Discord direct messages about the subscription. Subscription reminders and events by email can be turned off in My account › Settings; invoices, the acknowledgement of a stopped renewal and the notice before a renewal are always sent.

2.6 Public leaderboards

If a server owner publishes their leaderboard, the website www.ammitbot.com (www.ammitbot.com/classement/…) shows the server's top 100 members: rank, display name on the server, Discord avatar, level and experience. The global leaderboard (www.ammitbot.com/classement) shows, for the participating servers, the Discord name, avatar, total experience and number of servers concerned of the top 100 members.

These pages are not indexed by search engines. Avatars are loaded from Discord (cdn.discordapp.com). Any member can remove themselves from all public leaderboards, at any time, with the /classement-public command: Ammit then keeps their Discord ID in the list of opt-outs, as long as they do not change their mind. Their experience is still counted on Discord.

Legal basis: legitimate interest of the servers in running their community, with an immediate right to object (/classement-public).

2.7 Linked Twitch account

A member can link their Twitch account with the /twitch lier command or from the portal (My account › Security and connections). Ammit keeps the Twitch account's ID and name, and the date of the link. The token issued by Twitch is revoked as soon as the identity is read and is not kept.

The bot reads the public chat of the Twitch channels chosen by premium servers. Only messages from linked accounts count, to award experience. No message content is kept.

Legal basis: the member's request; they can unlink their account at any time with /twitch delier or from the same portal page.

2.8 Technical log and backups

The bot and the portal keep a technical operating log: start-ups, errors, security refusals. It may contain Discord IDs and, for some refusals, an IP address; it records neither the content of messages nor the pages viewed. Purpose: maintenance and security of the service (legitimate interest).

The database is copied regularly so that it can be restored after a failure. The copies stay on the publisher's servers and the oldest are deleted as new ones are made: 14 copies at most. Deleted data disappears from the backups when the last copy containing it is deleted.

2.9 Automatic measures on servers

Depending on the settings chosen by a server owner, the bot may take a measure against a member on its own: deleting a message, muting, kicking, banning or quarantining. It relies on rules (banned words, links, invites, known scams, mass arrivals) and on a risk score calculated from the member's recent messages (bursts, repetitions, mentions, links). These measures only apply on the server concerned. The member can appeal a sanction to the server's team, which can lift it ("Appeal the sanction" button in the direct message, if the server has enabled it).

3. Legal bases

• Performance of the contract: account, configuration, moderation, subscriptions, invoices.
• Legitimate interest: security of the service and the servers (sign-ins, logs, alerts, technical log, backups), public leaderboards.
• Legal obligation: keeping invoices.
• Consent: marketing communications.
• The person's request: linking a Twitch account, birthday recorded by the member.

4. Recipients and processors

The data is neither sold nor transferred. It is processed by the publisher and, for the needs of the service, by:

• Discord Inc.: the platform the bot runs on (server data passes through Discord, under Discord's policy), and display of avatars in the portal and on the public leaderboard pages;
• Stripe and PayPal: payment of subscriptions;
• Twitch Interactive, Inc.: linking of a Twitch account and reading of the public chat of the channels chosen by servers;
• the email delivery service chosen by the publisher, for transactional emails;
• the translation service chosen by the publisher, only for translations requested by a member;
• the services chosen by a server owner for their external automations (Zapier, Make, n8n, IFTTT or other): they receive the server's events under that owner's responsibility.

For announcements, the bot also queries Kick, X (X Corp.) and Instagram (Meta Platforms) to read public content: live streams, posts and publications of the followed accounts. It passes on no member data to them.

The data is hosted by the publisher, in France. Discord Inc. and Twitch Interactive, Inc. are established in the United States; Stripe (Stripe Payments Europe, Limited, in Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., in Luxembourg) may process data in the United States. These transfers rely, depending on the provider, on the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) or on the Commission's standard contractual clauses.

The data may also be disclosed to judicial or administrative authorities that request it within a legal framework, and used by the publisher to defend its rights in court.

5. Retention periods

• Portal account and contact details: until the account is deleted.
• Sessions: closed after 3 days of inactivity, and no later than 30 days after they were opened.
• Sign-in attempts: 90 days.
• Log of portal actions: kept for the traceability of servers; the IP address is erased after 90 days.
• Technical log: 30 days.
• Database backup copies: 14 copies at most, the oldest deleted as new ones are made.
• Server events: 30 days.
• Message statistics: 90 days; voice and game statistics: one year.
• Ticket transcripts and message excerpts: 90 days; automod review queue: 30 days at most.
• Moderation records, configuration and structure backups: as long as the bot is on the server, according to the owner's settings.
• Birthday: until it is removed by the member or the server's team, or until the member leaves. After a removal, only the year of the last wishes remains, until the following 1 January.
• Temporary voice channels: deleted as soon as they are empty; remembered settings: until the member leaves the server.
• Balances, shop items and achievements: as long as the bot is on the server, like experience. A member leaving does not erase them.
• Economy transactions: 90 days.
• Webhook call log: the last 50 calls of each link, erased with the link.
• Opt-out from public leaderboards: as long as the member does not change their mind.
• Linked Twitch account: until it is unlinked.
• Subscriptions and payment history: duration of the subscription, then 5 years (limitation period).
• List of servers that have already had Premium: as long as the service offers Premium.
• Invoices and credit notes: 10 years (accounting obligations), even after the account is deleted.

6. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, under the conditions laid down by the General Data Protection Regulation and the French Data Protection Act.

From the portal:

• My account › Personal information: correct your contact details and your email address;
• My account › Settings: change your preferences and withdraw your consent to marketing communications;
• My account › Security and connections: close a session, unlink your Twitch account;
• My account › Data and deletion: export your account data (JSON file) and delete the account. Deletion immediately erases the email address, contact details, preferences, sessions and sign-in history; the configuration of servers stays in place (it belongs to the server) and invoices are kept for the legal period.

On Discord: /anniversaire retirer erases your birthday, /classement-public removes you from public leaderboards, /twitch delier unlinks your Twitch account.

For any other request, or for the data of a server you are a member of, write to support@ammitbot.com. Requests about a server's data can be sent to its owner, who decides its settings.

Requests are free of charge. An answer is given within one month, which may be extended by two months for a complex request; you are then informed. If there is reasonable doubt about your identity, proof may be requested, for example, for a server member, proof that they hold the Discord account concerned. You can also set instructions on what happens to your data after your death (article 85 of the French Data Protection Act).

You can lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL, www.cnil.fr).

7. Security

Exchanges with the portal are encrypted (HTTPS). Signing in goes through Discord: Ammit keeps no password. Session tokens are stored as hashes: a copy of the database does not allow a session to be taken over. Cookies are protected (HttpOnly, SameSite), pages apply a strict content security policy, repeated sign-in attempts are blocked and access to servers is checked on the server side on every page. Provider keys never appear in the pages.

8. Cookies

The portal only uses technical cookies: a session cookie, a form protection cookie, a cookie remembering the language chosen before signing in, and three temporary cookies, for the time of a sign-in with Discord (10 minutes), of the account creation (15 minutes) or of the linking of a Twitch account (15 minutes). No audience measurement or advertising cookie is used; no consent is therefore requested for cookies. The website www.ammitbot.com sets no cookies.

9. Minors

The service is intended for people who meet Discord's age requirements. The publisher does not knowingly collect data from people under the required age; report any such situation to support@ammitbot.com.

10. Changes

This policy may be updated; the date appears at the top of the document and a substantial change is announced on the portal.

11. Contact

Data controller: TyXe0 Digital, 70 AVENUE DE GRASSE, 06800 CAGNES SUR MER, FRANCE. Email: support@ammitbot.com.