Privacy policy
Last updated: November 3, 2026
This policy explains which data USMAN Bot processes, why, for how long, and how to exercise your rights (GDPR, EU Regulation 2016/679, and the French Data Protection Act).
1. Data controller
Kazy
Contact : [email protected]
2. Data collected
| Data | Source | Use |
|---|---|---|
| Discord ID, display name, avatar, list of the servers you manage | Discord login (scopes identify and guilds) | Identify you in the panel and show you your servers |
| Server settings: channel and role IDs, display options, VRChat group ID | Entered in the panel | Make the bot work |
| Credentials of the dedicated VRChat account (username, password, 2FA secret), VRChat session cookies | Entered in the panel | Connect the bot to VRChat. Stored encrypted |
| IDs of the messages posted by the bot and the last log processed | Bot operation | Update messages without duplicates |
| Temporary bans (VRChat user ID, display name, end date, Discord author) | /tempban command | Unban automatically at the scheduled date. Deleted on unban, on purge or when the bot is removed |
| VRChat content displayed (names of banned users, moderators, members, group logs) | VRChat API | Display it in Discord. It is not kept by the Service beyond display |
| Contact form message (name, way to reply, subject, message, Discord account if logged in) | /contact form | Reply to your request. Sent to a private Discord channel of the team; not stored by the site, kept in Discord for as long as needed to reply |
| IP address, technical logs | Connection to the site | Security and abuse limiting (in memory, a few minutes). The host may keep logs |
3. Purposes and legal bases
- Providing the Service (login, configuration, bot operation): performance of the contract / terms of use.
- Replying to your requests (contact form): legitimate interest / pre-contractual measures; the form asks for your consent to the transmission.
- Security (rate limiting, abuse prevention, technical logging): legitimate interest.
- Legal obligations, if any: legal obligation.
4. Retention periods
- Login session: 3 days at most, or until you log out.
- Settings of a server: as long as the bot is on the server. They are deleted automatically when the bot is removed from the server, or at your request from the panel (“Delete all data”).
- IP address: in-memory counters, erased in under a minute.
5. Security
- VRChat passwords, 2FA secrets and VRChat cookies are encrypted at rest (AES-256-GCM); they are never sent back to the browser.
- HTTPS connection, strict security headers, HttpOnly / Secure / SameSite cookies, session tokens stored as hashes, protection against cross-site requests, rate limiting.
- Permissions are checked live with Discord on every action: losing the “Manage Server” permission cuts access immediately.
- No system is infallible; in the event of a data breach, the people concerned and the competent authority will be informed as required by law.
6. Recipients and processors
- Discord Inc.: OAuth2 login, bot operation and receipt of contact form messages (Discord’s policy).
- VRChat Inc.: API used with the dedicated account (VRChat’s policy).
- Host of the Service (for example Render Services, Inc.): storage and execution.
No data is sold or passed on to third parties for commercial purposes.
7. Transfers outside the European Union
Discord, VRChat and the host may process data outside the EU (notably in the United States). These transfers rely on the safeguards provided for by the GDPR (standard contractual clauses or the EU–US data protection framework) put in place by these providers.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set post-mortem directives.
- Access and portability: “Export my data” button in the panel (“Data and privacy” module), in JSON format.
- Erasure: “Delete all data” button in the same module, or simply remove the bot from your server.
- Other requests: write to [email protected]. We reply within one month.
You can lodge a complaint with the data protection authority of your country (in France: the CNIL).
9. Cookies
The site only uses strictly necessary or preference cookies: a session cookie after login (3 days), a temporary security cookie during the Discord login (10 minutes), and a lang cookie that remembers the language you choose (1 year). There are no advertising or audience-measurement cookies, so no consent banner is required.
10. Minors
The Service is intended for people who have the minimum age required to use Discord. It is not intended for children under 13.
11. Changes
This policy may be updated; the date is shown at the top of the page. In case of an important change, a notice will be given on the site.
This page is a translation. If the translation differs from the French version, the French version prevails.