Privacy Policy

This Policy explains which personal data Savitar (the Discord bot, dashboard and public pages) collects, why, who it is shared with, how long it is kept and what your rights are. It complements the Terms of Service.

Roles: for dashboard account data, payments and personal public profiles, Savitar acts as the controller. For server members’ data processed by features an administrator turns on (levels, logs, tickets, verification and so on), the server administrator determines the purposes and Savitar acts as a processor on their behalf.

a) Discord data received by the bot. IDs of servers, channels, roles, messages and users; server name, icon, banner and member count; roles and bot permissions; events such as members joining and leaving, voice channel joins, invite creation and application authorization.

b) Feature usage data for features enabled in a server:

• levels: XP, level and valid message count per member; voice minutes (when the feature is on);
• economy and store: balances, transactions, items, inventory, purchases and temporary roles;
• moderation: cases (warnings, bans, timeouts), reasons and who applied them;
• tickets: category, subject, form answers, participants and, when closed, the transcript (the ticket’s message content);
• verification: attempts, approvals and access codes (stored hashed where applicable);
• invites: which invite was used, who invited and when the person joined or left;
• giveaways and games: entries, winners and matches;
• server statistics: aggregated counts per day and hour (messages, commands, joins and leaves, voice minutes) and a join/leave record used to calculate retention;
• command usage: which command, when, in which server, by whom, whether it worked and, on failure, the technical error message.

c) Message content. The bot uses Discord’s “Message Content” privileged intent to award XP, run configured features and produce logs. Message content is processed in real time and, as a rule, is not stored in our database. Exceptions: ticket transcripts, messages configured by the administrator themselves (welcome messages, panels, scheduled messages) and logs the administrator chooses to send to a channel in their own server (those stay on Discord, under the server’s control).

d) Dashboard account (Discord sign-in). When you sign in we receive and store your ID, username, display name, avatar, avatar decoration, public badges (public flags), Nitro type and, if permitted, since when you have boosted servers where the bot is present. We also query your list of servers and permissions to show what you can manage; that list is not stored permanently. We request the identify, guilds and guilds.members.read scopes.

e) Public profiles. What you choose to publish: handle, name, bio, banner, color, links, interests, displayed servers and rankings, balance (if you allow it) and, for server profiles, description, invite, links, tags and rankings. We also count profile views.

f) Personal notes and reminders. Content you create yourself in the personal features of the bot and dashboard.

g) Premium payments. Order record: order ID, server, payer’s ID, amount, status, payment method reported by the processor, installments, receipt and dates. Card or bank account data is handled only by InfinitePay; we do not receive it.

h) Audit and security logs. Actions taken in the dashboard (who changed what and when) and Savitar team actions, for security, support and accountability.

We use data to: provide the features you or the server administrator turned on; authenticate and authorize dashboard access; display public profiles and stores; process Premium; prevent fraud, abuse and spam; provide support; comply with legal obligations; and improve the stability and security of the Service (for example from error logs).

Legal bases (LGPD, art. 7): performance of a contract and preliminary procedures (providing the Service you requested); legitimate interest (security, fraud prevention, aggregated statistics and improving the Service, always respecting your rights); consent (when you publish a public profile or enable options such as showing your balance or badges); and compliance with legal or regulatory obligations (for example payment records). We do not sell personal data and do not use it for advertising or to train third-party artificial intelligence models.

• Discord: the Service works through Discord’s API; what we send to Discord is subject to Discord’s policies.
• InfinitePay: processes Premium payments and receives the data needed for billing.
• Server administrators: see the data and reports of features in their own server (rankings, moderation cases, tickets, statistics and so on).
• Anyone on the internet: what you publish on public profiles, rankings and stores.
• Infrastructure providers (hosting, database, cache and network) that store and process data under our instructions.
• Authorities, when legally required or to protect rights, safety and the Service.

We do not sell or rent personal data.

We only use essential cookies: the login session cookie (httpOnly, signed) and temporary security cookies of the Discord sign-in flow. We also use the browser’s local storage for interface preferences (for example recently used emojis). We do not use advertising cookies or cross-site tracking.

• Server data: while the bot is in the server. If the bot is removed, everything is kept for 48 hours so it can be added back; after that, the server’s settings and data are permanently deleted.
• Ticket transcripts and history: available to the server’s staff in the dashboard until deleted or until the server is removed from Savitar.
• Dashboard account and public profile: while the account exists; you can disable the profile and request deletion at any time.
• Notes and reminders: until you delete them.
• Payment orders: for the period required by tax, accounting and consumer-protection law.
• Audit, error and command-usage logs: for a limited time necessary for security and support.

• People: edit or disable your public profile, hide badges and balance, delete notes and reminders, and sign out of the dashboard whenever you like. To delete your account and data, request it through the contact below.
• Administrators: adjust or turn off any feature in settings; remove the bot from the server (data is deleted after 48 hours) or request immediate deletion through the contact.
• Server members: for data processed by a server feature, talk to that server’s administrators first; you can also ask us to delete it.
• Revoke access: you can remove Savitar from the authorized apps on your Discord account (User Settings > Authorized Apps).

Under the LGPD (art. 18) and, where applicable, other laws such as the GDPR, you may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; deletion of data processed with consent; information about sharing; information about the possibility of refusing consent and its consequences; and withdrawal of consent. You may also object to processing based on legitimate interest.

We will respond within the period set by law. We may ask for information to confirm the request comes from the person concerned. You may also complain to Brazil’s National Data Protection Authority (ANPD) or to the authority in your country.

We adopt reasonable technical and organizational measures: encrypted connections (HTTPS), signed sessions, role- and permission-based access control, tokens and secrets kept out of code, hashed access codes, input validation and audit logs. No system is completely secure; in case of an incident posing relevant risk to data subjects, we will notify as required by law.

Discord and some infrastructure providers may process data outside Brazil. When that happens, we adopt or require safeguards consistent with the LGPD (for example contractual clauses and providers with adequate protection standards).

Savitar depends on Discord, which requires a minimum age of 13 (or higher under local law). We do not direct the Service to children nor knowingly collect data from anyone below the age to use Discord. If you believe we process a child’s data improperly, contact us and we will delete it. Teenagers’ data is processed in their best interest.

Processing by Discord and InfinitePay is subject to their own privacy policies. Links, images and content hosted by third parties and shown on profiles are the responsibility of whoever publishes them.

We may update this Policy. The last-updated date is at the top. Material changes will be communicated on the website, in the dashboard or through a bot announcement.

To exercise your rights, ask questions or request data deletion, use the contact below. That channel also receives communications intended for the person in charge of personal data processing (DPO).