Privacy Policy

We collect information you provide directly, information generated by your use of the Service, and information your devices send automatically.

a) Discord data from ticket channels

When a ticket is created in a server where the Bot is installed, we collect and persistently store the following data from ticket channels, in order to display conversations on the dashboard and generate transcripts:

• message content sent within the ticket channel or thread;
• attachment metadata (name, type and size); files are not downloaded or stored;
• Discord user IDs, usernames, display names and avatars;
• message IDs, timestamps, edits, deletions and reactions;
• opening-form answers, claims, transfers, closures, reopenings and ratings;
• channel and server identifiers.

For this, the Bot uses Discord's privileged Message Content intent. Because of how Discord delivers events, the Bot technically receives message events from the channels it can view, but only messages from channels or threads linked to open tickets are stored; messages sent outside tickets are never stored. The Bot does not request the Server Members or Presence intents: it does not maintain member lists or collect online status.

While a ticket is open, its messages may be shown in real time to authorized staff through the authenticated dashboard. When closed, the content is compiled into an HTML transcript accessible only to signed-in users.

b) Images uploaded through the website

The appearance customizer lets administrators upload a bot avatar and banner for their server. Those images are validated (size, format and shape) and stored on our own infrastructure; they are only served to authenticated users of the corresponding server and to Discord to apply them to the Bot's profile. We do not send them to third parties for moderation or any other purpose.

c) Server configuration data

When an administrator installs and configures the Bot we store server, channel, role and emoji IDs (metadata only), together with panels, ticket categories, forms, macros, FAQ entries, settings and the audit log. This data is associated with the Discord server, not with individual users.

d) Authentication data

When you sign in with Discord (OAuth2, identify and guilds scopes), Discord issues an access token and a refresh token. We store them encrypted at rest (AES-256-GCM) in our database: they are never sent to the browser nor written to logs. The web session uses an HttpOnly cookie holding an opaque identifier. We do not receive or store your Discord password or email address.

e) Automatically collected data

• web server and reverse-proxy logs (IP address, timestamp, URL, status code and user-agent), retained for a limited period for operational and diagnostic purposes;
• the cookies required for operation, described in section 14.

We run no web analytics or advertising and install no third-party tracking.

Tiqvo Bot is a general-purpose ticket management service and is not designed or authorized to collect special categories of personal data (health information, financial data, government IDs, ethnic origin, beliefs, biometric data or sexual orientation, per Article 9 GDPR and equivalent categories).

Because tickets allow free-form communication, users may voluntarily include sensitive information in their messages. We do not monitor content to identify such categories and do not use it for advertising, profiling or model training.

Administrator responsibility: those who install the Bot must instruct their community not to submit sensitive data through tickets unless an appropriate legal basis and safeguards exist.

• providing the ticket service and its history, including transcripts;
• showing open-ticket messages in real time to authorized staff;
• authenticating users and managing dashboard access via Discord OAuth;
• operating the Bot according to each server's configuration;
• sending the notices each server configures (closure log, transcript by DM and rating request);
• generating server activity statistics;
• auditing administrative actions and protecting the Service (security and abuse prevention);
• enforcing our Terms of Service, responding to requests and meeting legal obligations.

We do not use message content or any other personal data for advertising, commercial profiling or training artificial-intelligence models.

• Service providers: VPS hosting (OVHCloud) and Cloudflare (DNS, CDN and proxy in front of the Service). They process data only so the Service can operate.
• Discord Inc.: the platform the Bot runs on; its use is governed by Discord's own terms and policies.
• Authorities: when the law requires it, per section 5.

We do not sell, rent or share personal data, ticket messages, transcripts or Discord API data with third parties unrelated to the Service, except with the providers above strictly to operate it or when required by law. We do not share data for cross-context behavioral advertising or third-party marketing.

We may disclose personal information to authorities or other third parties if we believe in good faith that it is reasonably necessary to:

• comply with applicable law, regulation, legal process or enforceable governmental request;
• enforce our Terms of Service, including investigating potential violations;
• detect, prevent or address fraud, security or technical issues;
• protect the rights, property or safety of Tiqvo Bot, our users or the public;
• respond to an emergency involving danger to any person's life or physical integrity.

Where legally permitted, we will make reasonable efforts to notify affected users before or promptly after disclosure.

If you are in the European Economic Area or the United Kingdom, we process your data only with a valid legal basis under the GDPR:

• Legitimate interest (Art. 6(1)(f)): ticket and transcript data, server configuration, logs and essential cookies — based on administrators' interest in keeping support records and our interest in the security and operation of the Service.
• Performance of a contract (Art. 6(1)(b)): account and dashboard data needed to provide the Service to administrators who accept the Terms.
• Legal obligation (Art. 6(1)(c)): where applicable law requires it, including responding to lawful authority requests (section 5).

You may object to processing based on legitimate interest at any time (section 11); we will stop processing unless there are compelling legitimate grounds or the data is needed for legal claims.

The Service uses automated systems solely for operational purposes: rate limiting, anti-abuse controls and enforcement of the Terms. We do not use personal data for profiling, scoring or automated evaluation of personal aspects, and no decision that materially affects your access is made without human involvement.

We keep information for as long as needed for the purposes described. Default periods (§68):

Each server can configure ticket and audit retention (90, 180, 365 or 730 days, or indefinite retention). Data is deleted automatically when the period ends.

• a server’s configuration is kept if the Bot is removed, to allow reinstallation without losing settings; an administrator may request its deletion at any time;
• administrators can delete tickets from the dashboard: deleting a ticket removes its messages, events, ratings and transcripts;
• daily backups cover the database, transcripts and configuration; they are deleted according to the VPS provider’s rotation policy;
• if Discord terminates or revokes our API access, or if the Service permanently ceases, data obtained from the Discord API will be deleted per its Developer Terms, with reasonable advance notice where possible.

We may retain certain information beyond these periods where required by law or to resolve disputes and protect our legal rights.

• all access to ticket data requires an authenticated Discord OAuth session;
• tickets and transcripts can only be viewed by authorized staff of the same server — per the roles configured by its administrator — and by the ticket creator through the authenticated link they receive by direct message;
• data is not public, not indexed by search engines and not accessible via guessable URLs;
• access is strictly scoped to each server: an administrator of one server can never query another server’s data;
• access to production data is restricted to the Service operators (technical superadministrators).

The Service is operated from the Republic of Chile and hosted on OVHCloud infrastructure. Cloudflare acts as DNS and CDN globally, and Discord processes data under its own policy, including in the United States.

For transfers from the EEA, the UK or Switzerland, the safeguards offered by those providers apply (Standard Contractual Clauses or other recognized mechanisms). You can request details at luisfernando.l@proton.me.

Depending on your jurisdiction, you may have the following rights:

• access: request a copy of the personal data we hold about you;
• rectification: correct inaccurate data;
• erasure: request deletion of your data, including your transcripts, subject to legal exceptions;
• restriction: limit processing in certain circumstances;
• portability: receive your data in a structured, commonly used format where the law requires it;
• objection: object to processing based on legitimate interest;
• withdraw consent where processing is based on it.

To exercise them, write to luisfernando.l@proton.me; we may ask you to authenticate with Discord or provide your user ID to verify your identity. Requests are free of charge; we will respond without undue delay and in any case within one month (extendable by two months for complexity).

If you believe our processing infringes data protection law, you may lodge a complaint with the supervisory authority of your habitual residence, workplace or the place of the alleged infringement.

We do not sell personal information, share it for cross-context behavioral advertising, or earn revenue from selling data. If you live in California or another state with its own privacy law (Virginia, Colorado, Connecticut, Utah and others), you may request confirmation, access, correction or deletion of your personal data by writing to luisfernando.l@proton.me. We will not discriminate against you for exercising your rights; if we deny a request you may appeal by replying with the subject line "Privacy Rights Appeal".

If you are in Brazil, the LGPD (Law No. 13,709/2018) grants you rights over your data: confirmation of processing, access, correction, anonymization or deletion, portability, information about the entities data is shared with, and consent revocation. To exercise them, write to luisfernando.l@proton.me; we will respond within 15 days (Article 19 LGPD).

We only use cookies required to operate the Service; none are for advertising or cross-site tracking:

You can manage cookies in your browser settings; disabling essential ones will prevent use of the dashboard. We run no analytics, so "Do Not Track" or "Global Privacy Control" signals change no behavior: there is nothing to switch off.

The Bot is only accessible through Discord, whose terms set the minimum account age. To use the Service you must be at least 13 years old, or the minimum digital consent age in your jurisdiction if higher. We do not knowingly collect data from children below that threshold; if we learn that we have, we will delete it. Parents or guardians: write to luisfernando.l@proton.me.

• encryption in transit (TLS) and Discord tokens encrypted at rest (AES-256-GCM);
• HttpOnly, Secure and SameSite=Lax cookies, plus security headers (CSP, X-Frame-Options, HSTS);
• strict per-server authorization on every query (multi-tenant isolation);
• daily backups of the database, transcripts and configuration;
• production-data access restricted to the Service operators.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

The data described in section 1 is obtained through Discord's API and is subject to its Developer Terms of Service and Developer Policy. We use it solely for the Service's stated functionality: ticket channel management, dashboard display, transcript generation and storage, server configuration and user authentication.

In accordance with Discord's Developer Policy, we do not:

• sell, license or commercialize data obtained through the API;
• share API data with advertising networks, data brokers or monetization services;
• use message content or other API data to train AI models;
• mine or scrape Discord data;
• contact users outside Discord using API data without their explicit permission;
• attempt to re-identify or reverse anonymized or pseudonymized data.

The Service may contain links to third-party websites. We do not control and assume no responsibility for their content or privacy policies; we recommend reviewing the policy of every site you visit.

We may update this policy to reflect changes in our practices or the law. We will post the updated version on this page and announce relevant changes at our website; for material changes that significantly affect your rights we will give at least 14 days' notice. Continued use of the Service after that notice constitutes acceptance of the updated policy.

To the fullest extent permitted by law, we shall not be liable for indirect, incidental or consequential damages arising from data processing under this policy, including loss of data or unauthorized disclosure. This limitation does not apply to liability that cannot be excluded under mandatory law, including mandatory liability under Article 82 GDPR, and is complemented by the limitation of liability in our Terms of Service.

For privacy inquiries, data-subject requests or to exercise any of your rights: luisfernando.l@proton.me.