DashboardNoxBot Privacy Policy & Data Compliance
Last Updated: September 12, 2026
Effective Date: March 1, 2026
Data Controller: Vibhas Dutta
Contact: helpdeskprojectx1@gmail.com
1. Introduction
This Privacy Policy explains how NoxBot ("the Bot", "we", "us", "our") collects, uses, stores, shares, and protects information when you interact with our Discord bot. This document is designed to satisfy the requirements of:
- Discord Terms of Service (effective September 29, 2025)
- Discord Developer Terms of Service (effective July 8, 2024) and Discord Developer Policy
- Google Gemini API Additional Terms of Service (effective December 18, 2025)
- EU General Data Protection Regulation (GDPR) (Regulation 2016/679)
- US Privacy Laws including CCPA/CPRA and COPPA (as amended June 23, 2025)
By using NoxBot in any Discord server, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller Information
| Field | Details |
|---|---|
| Controller Name | Vibhas Dutta |
| Contact Email | helpdeskprojectx1@gmail.com |
| Discord Support | https://discord.gg/8GT69je84T |
| Website | https://noxbot.tech |
| Country of Operation | India |
For GDPR purposes, the data controller is responsible for determining the purposes and means of processing personal data collected through NoxBot.
Governing Law: This Privacy Policy is governed by the laws of India, consistent with the Governing Law & Jurisdiction clause in our Terms & Conditions — any dispute arising from this policy is subject to the exclusive jurisdiction of the courts of India, regardless of the rights described for specific regions (GDPR, CCPA) elsewhere in this document.
3. What Data We Collect
3.1 Data Collected Automatically from Discord
When NoxBot operates in a Discord server, it may access and process the following data provided by the Discord API:
| Data Type | Description | Purpose |
|---|---|---|
| Discord User ID | Your unique Discord snowflake identifier | User identification, memory association, analytics |
| Discord Username / Display Name | Your username or server nickname | Conversation context, chat history attribution |
| Guild (Server) ID | Unique identifier for the Discord server | Server configuration, per-guild data isolation |
| Channel ID | Unique identifier for the channel | Chat history tracking, feature routing |
| Message Content | Text content of messages sent in bot-enabled channels | AI chat responses, automod analysis, report processing |
| Message Attachments | Images attached to messages in bot channels | Image analysis via AI (when applicable) |
| Server Roles | Role information for permission checks | Command access control, staff role verification |
| Server Events | Scheduled events data | Event announcement features |
Per Discord Developer Policy Section 15: API Data is only accessed, requested, or used as necessary to provide the bot's stated functionality.
3.2 Data Derived by AI Processing
NoxBot uses AI to extract and store contextual information from conversations:
| Data Type | Categories | Retention |
|---|---|---|
| User Memories | Profile (timezone, preferred name, language, location), Preferences (communication style, likes/dislikes), Interests (hobbies, games, fandoms), Plans (deadlines, exams, appointments, future events), History (birthdays, past milestones), Expertise (skills, work/study areas) | Profile / Preferences: 180 days · Interests / History / Expertise: 365 days · Plans: 90 days, or 7 days after the dated event; renewed when re-mentioned |
| Server Memories | Events (tournaments, game nights), Moderation (warnings, violations), Culture (traditions, community vibe) | Events: 180 days · Moderation: 90 days · Culture: 365 days |
Important: Per Discord Developer Policy Section 21, message content obtained through the APIs is not used to train machine learning or AI models. NoxBot sends messages to the Google Gemini API solely for real-time inference (generating responses, analysis, fact extraction) — not for model training.
3.3 Data Generated by Bot Operations
| Data Type | Description | Retention |
|---|---|---|
| Chat History | A bounded window of recent messages per channel, and per user across servers | 72 hours (auto-expires) |
| Warning Records | Moderation warnings issued to users, including a copy of the flagged message text | 90 days (auto-deleted via TTL) |
| Ticket Transcripts | Support ticket content and metadata | 90 days after closure (auto-deleted via TTL) |
| Analytics Data | Aggregated usage counts (chat tokens, images, commands, violations) per guild | Daily/Monthly/Total aggregates |
| Automod Logs | Violation records, action taken, flagged message text | Per-user violation tracking in guild config, bounded and oldest-trimmed |
| Report Data | User reports including AI analysis | 90 days (auto-deleted via TTL) |
| Payment Records | Premium subscription transactions | Payment orders: 15 minutes · Payment history: as required by law |
3.4 Data We Do NOT Collect
- ❌ We do not collect passwords or authentication tokens
- ❌ We do not collect email addresses (unless voluntarily provided for support)
- ❌ The Discord bot itself does not collect IP addresses (the website's analytics services process IP-derived, non-identifying geographic region data — see Section 5.5)
- ❌ We do not collect direct messages (DMs) unless the bot is explicitly messaged
- ❌ We do not collect voice or audio data
- ❌ We do not collect data from channels where the bot is not present or enabled
- ❌ We do not collect protected health information, financial information, or other sensitive information (per Discord Developer Policy Section 16)
- ❌ We do not knowingly collect data from persons under 13 years of age (per Discord Developer Policy Section 16)
- ❌ We do not sell, license, or commercialize any API Data (per Discord Developer Policy Section 18)
4. How We Use Your Data
4.1 Core Bot Functionality
| Use Case | Data Used | Legal Basis (GDPR) |
|---|---|---|
| AI Chat Responses | Message content, chat history, user memories | Legitimate Interest / Consent |
| Automod (Content Moderation) | Message content, violation history, server rules | Legitimate Interest |
| Report Processing | Reported user's messages, violation history | Legitimate Interest |
| Ticket System | Ticket content, user ID | Contract Performance |
| AI Announcements | Source/target channel messages | Legitimate Interest |
| Event Announcements | Server event data | Legitimate Interest |
| Memory System | Conversation content → extracted facts | Consent |
| Web Search | User-provided search queries | Contract Performance |
| Weather Lookup | User-provided location string | Contract Performance |
4.2 Operational Purposes
- Analytics: Aggregated, non-personally-identifiable usage statistics per server (message counts, command usage, violation counts). Per Discord Developer Policy Section 15, any API Data used for improvement is aggregated or de-identified so it cannot be associated with or used to identify any individual.
- Rate Limiting: Temporary tracking of request frequency per user/server to prevent abuse.
- Premium Tier Enforcement: Checking subscription status to unlock/restrict features.
4.3 What We Do NOT Use Data For
- ❌ Targeted advertising — Prohibited by Discord Developer Policy
- ❌ Selling data to third parties — Prohibited by Discord Developer Policy Section 18
- ❌ Sharing data with ad networks or data brokers — Prohibited by Discord Developer Policy Section 17
- ❌ Contacting users outside Discord — Prohibited by Discord Developer Policy
- ❌ Profiling users or their relationships — Prohibited by Discord Developer Policy Section 16
- ❌ Training ML/AI models on message content — Prohibited by Discord Developer Policy Section 21
- ❌ Commercializing API Data — Prohibited by Discord Developer Policy Section 18
5. Third-Party Services & Data Sharing
NoxBot integrates with the following third-party services. Each service has its own privacy policy and terms. Every claim in this section has been checked directly against the cited provider's current, live policy text as of September 12, 2026 — quoted clauses are verbatim from the source linked beside them.
5.1 Google Gemini API (AI Processing)
| Aspect | Details |
|---|---|
| Service | Google Gemini API (text generation and embedding models) |
| Data Sent | Message content, conversation history, system prompts |
| Purpose | Chat responses, automod analysis, memory extraction, report analysis, announcement relevance scoring |
| Google's Data Use (Paid API) | Google does NOT use your prompts or responses to improve its products — "Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products" (Gemini API Terms — Paid Services). Prompts/responses are processed under the Data Processing Addendum for Products Where Google is a Data Processor, which lists "Gemini API Paid Services" among its covered products. Google logs prompts and responses for a limited period — this covers detecting/preventing violations of the Prohibited Use Policy, general safety/security of the service, and any required legal or regulatory disclosures, not abuse-detection alone. The Paid Services terms do not make any representation about human review of your prompts one way or the other. |
| Google's Data Use (Unpaid API) | Google MAY use submitted content and generated responses to provide, improve, and develop Google products and ML technologies. Human reviewers may read, annotate, and process API input and output, disconnected from your Google Account, API key, and Cloud project first. |
| EU/EEA/UK Users | Per the Gemini API Terms: for users in the European Economic Area, Switzerland, or the United Kingdom, the Paid Services data terms apply to all services, even those offered free of charge. Google does NOT use your data for model training regardless of tier. |
| Terms | Gemini API Additional Terms of Service |
Critical: NoxBot does NOT train any AI models. We send data to Google Gemini API for real-time inference only. Per Discord Developer Policy Section 21, we do not use message content to train machine learning or AI models.
5.1a Background AI Providers (Groq / OpenRouter / Nvidia)
| Aspect | Details |
|---|---|
| Services | Groq, OpenRouter, and Nvidia AI (chat-completion APIs) |
| Data Sent | The same categories of content as Section 5.1 (conversation snippets, system instructions) for low-stakes background tasks: rolling channel-summary compaction, memory-fact extraction, announcement relevance scoring, and event-hype generation. Never used for automod, report, or moderation verdicts, which go to Google Gemini only. For announcement relevance scoring specifically, the sender's Discord username (see Section 3.1) is included alongside each recent message so the AI can distinguish one person talking from several. |
| Purpose | Cost/latency optimization — these tasks try Groq first, then OpenRouter, then Nvidia, and only fall back to Google Gemini if all three are unavailable |
| Retention — Groq | By default, Groq does not retain inference request/response content, but does keep operational logs "for up to 30 days" for reliability and abuse monitoring "unless legally required to retain longer," under a Zero Data Retention setting Groq offers but NoxBot has not enabled. Groq's Data Processing Addendum prohibits Groq from using customer Inputs/Outputs to train or fine-tune models absent explicit instruction. |
| Retention — OpenRouter | OpenRouter's own Privacy Policy states OpenRouter itself does not use Inputs/Outputs for model training, but the underlying model provider a request is routed to "may retain and use your Inputs and Outputs for their own purposes," including training, depending on which model is selected — there is no blanket opt-out at the OpenRouter layer. |
| Retention — Nvidia | Nvidia's API Trial Terms of Service (not Nvidia's general consumer privacy policy, which does not govern this API) state Nvidia collects "User Content and Generated Content to improve NVIDIA products and services, including AI models." Nvidia sits third in this fallback chain, so content routed to it — including, for the announcement-relevance task, a Discord username — may be used by Nvidia under this clause. |
Which provider actually handles a given request is not user-controlled and varies by real-time availability — this is a resiliency fallback chain, not a routing preference.
5.2 Google Custom Search API
| Aspect | Details |
|---|---|
| Service | Google Custom Search JSON API |
| Data Sent | User-provided search queries only |
| Purpose | Web search functionality when users ask NoxBot to search the internet |
| Retention | Search queries are not stored by NoxBot beyond the immediate response |
| Terms | Google APIs Terms of Service (general terms) plus the Custom Search JSON API Additional Terms of Service (API-specific terms, which control where the two conflict) |
5.3 WeatherAPI.com
| Aspect | Details |
|---|---|
| Service | WeatherAPI.com REST API |
| Data Sent | User-provided location strings (city names, coordinates, zip codes) |
| Purpose | Current weather, forecasts, and historical weather data |
| Retention | Location queries are not stored by NoxBot. WeatherAPI.com's own Privacy Policy states personal information "shall not be kept for longer than is necessary for that purpose" but does not publish a specific retention window for query logs on their side |
| Terms | WeatherAPI.com Terms · WeatherAPI.com Privacy Policy |
5.4 Razorpay (Payment Gateway)
| Aspect | Details |
|---|---|
| Service | Razorpay Payment Gateway (Razorpay Software Private Limited) |
| Data Shared | Name, email address, phone number, payment details (card/UPI/banking), and Discord User/Guild ID metadata notes |
| Purpose | Secure processing of subscription payments, automatic recurring renewals, billing verification, and plan tier updates |
| Retention | Payment credentials and details are processed directly by Razorpay in compliance with their privacy guidelines. Transaction states, status, and metadata notes are logged securely in our database |
| Terms | Razorpay Privacy Policy |
5.5 Website Analytics Services
| Aspect | Details |
|---|---|
| Services | Google Analytics (Google LLC) & Vercel Web Analytics (Vercel Inc.) |
| Data Sent | Page view logs, device characteristics, referring site URLs, and geographic region (non-identifying) |
| Purpose | Monitoring website performance, measuring user navigation flows, and improving site layout/design |
| Retention | Vercel's Web Analytics Privacy Policy states "no personal identifiers that track and cross-check end users' data across different applications or websites are collected" and that data points (page views, custom events) are recorded anonymously; the per-visitor identification hash is discarded after 24 hours, though Vercel does not publish a fixed retention window for the aggregate analytics data itself. Users can opt out of these services by declining "Analytics Cookies" in the cookie consent settings |
| Terms | Google Privacy & Terms · Vercel Web Analytics Privacy Policy |
5.6 Data Storage Providers
| Provider | Data Stored | Encryption | Source |
|---|---|---|---|
| Google Firebase / Firestore | Guild configs, tickets, warnings, analytics, payment history | Encrypted at rest and in transit | Firebase Security |
| Qdrant Cloud | Long-term memory vectors (user + server memories) | Encrypted at rest (AES-256) and in transit (TLS 1.2+) | Qdrant Privacy Policy · Qdrant Cloud Security |
| Redis (Upstash or similar) | Short-term chat history, cooldown states, rate limits | Encrypted in transit (TLS is enabled by default on all connections). Encryption at rest is available only as an opt-in add-on on the underlying provider's paid tiers and is not represented here as active by default | Upstash Security Docs |
| Cloudflare R2 | Archived application log files (operational logs — may include Discord user/guild IDs and error context; not full chat message content) | Encrypted at rest (AES-256-GCM) and in transit (TLS) | Cloudflare R2 Data Security |
Per Discord Developer ToS Section 5(c): We use commercially reasonable efforts to protect data, including encryption at rest and administrative/technical safeguards.
5.7 Error Monitoring — Sentry
| Aspect | Details |
|---|---|
| Service | Sentry (application error/crash monitoring) |
| Data Sent | Error stack traces and diagnostic context only — no message content is ever sent |
| Scrubbing | Before anything reaches Sentry, we strip: all Discord user/account identity (no user IDs sent), request cookies/headers/bodies, query strings on any URL, and any field that looks like a secret, token, password, or prompt/rulebook by name. This scrubbing is implemented in NoxBot's own Sentry SDK configuration — it is not a guarantee made by Sentry's privacy policy itself |
| Purpose | Detecting and diagnosing bugs and crashes |
| Retention | Per Sentry's published data retention periods: error events are retained 30 days on Sentry's free (Developer) plan, 90 days on paid plans |
| Terms | Sentry Privacy Policy · Sentry Data Retention Periods |
5.8 Data Sharing Summary
Per Discord Developer ToS Section 5(b), we share API Data only:
- With Service Providers (Google, Groq, OpenRouter, Nvidia, Qdrant, Redis provider, Razorpay, Analytics providers, Sentry, Cloudflare) who agree in writing to use data solely for NoxBot's functionality
- When required by applicable laws or regulations
- When a user expressly directs the sharing of their data
We do NOT:
- Share data with advertisers, ad networks, or data brokers (per Policy Section 17)
- Sell, license, or commercialize any API Data (per Policy Section 18)
- Share individual user data with third parties beyond what is described in this policy
6. Data Storage & Security
6.1 Data Retention Schedule
| Data Category | Storage | Retention Period | Auto-Deletion |
|---|---|---|---|
| Chat History (per channel) | Redis | 72 hours | ✅ TTL-based |
| Chat History (per user) | Redis | 72 hours | ✅ TTL-based |
| Guild Configuration | Firestore | Until bot is removed from server | Manual |
| Support Tickets | Firestore | 90 days after closure | ✅ Firebase TTL |
| Payment Orders | Firestore | 15 minutes | ✅ Firebase TTL |
| Payment History | Firestore | Duration required by law | Manual |
| Warning Records | Firestore | 90 days | ✅ Firebase TTL |
| Analytics (Daily) | Firestore | Rolling daily aggregates | Overwritten |
| Analytics (Monthly) | Firestore | Rolling monthly aggregates | Overwritten |
| User Memories — Profile / Preferences | Qdrant | 180 days, renewed when re-mentioned | ✅ Scheduled cleanup |
| User Memories — Interests / History / Expertise | Qdrant | 365 days, renewed when re-mentioned | ✅ Scheduled cleanup |
| User Memories — Plans | Qdrant | 90 days, or 7 days after the dated event | ✅ Scheduled cleanup |
| Server Memories — Culture | Qdrant | 365 days, renewed when re-mentioned | ✅ Scheduled cleanup |
| Server Memories — Events | Qdrant | 180 days, renewed when re-mentioned | ✅ Scheduled cleanup |
| Server Memories — Moderation | Qdrant | 90 days, renewed when re-mentioned | ✅ Scheduled cleanup |
| Automod Violation Logs | Firestore | A bounded number of entries per user | Oldest trimmed |
| Application Log Files | Local disk → Cloudflare R2 | 14 days locally, then archived to R2 | ✅ Local TTL + R2 lifecycle policy |
Per Discord Developer ToS Section 5(b): We promptly delete API Data when retaining it is no longer necessary for stated functionality, when a user requests deletion, or when Discord requests deletion.
6.2 Security Measures
Per Discord Developer ToS Section 5(c), we implement the following security measures:
- Encryption in Transit: All data transmitted between NoxBot and cloud services uses TLS/SSL encryption
- Encryption at Rest: Firestore and Qdrant Cloud encrypt stored data at rest by default. Our Redis provider encrypts data in transit by default; at-rest encryption there is an opt-in add-on and is not represented as active unless separately confirmed (see Section 5.6)
- Access Control: Firestore Security Rules restrict document access. API keys and credentials are stored as environment variables, never committed to code
- Data Isolation: Guild data is strictly isolated — one server cannot access another server's data. User memories are isolated per user ID
- Credential Security: All developer credentials (API keys, tokens) are treated as confidential information and kept encrypted (per Discord Developer ToS Section 5(c))
- Cache Management: In-memory caches are bounded in both size and duration to prevent excessive data retention
- Incident Reporting: In the event of unauthorized access to API Data, we will promptly notify Discord and affected users as required by applicable laws (per Discord Developer ToS Section 5(a))
7. AI-Specific Disclosures
7.1 How AI Processes Your Messages
When you interact with NoxBot's AI features:
-
Input: Your message content is sent to the Google Gemini API along with:
- A limited window of recent conversation history from the channel
- Relevant long-term memories about you and the server
- Server-specific configuration (rulebook, moderation rules)
- System instructions (bot personality and behavior guidelines)
-
Processing: Google Gemini processes the input and generates a response. Under paid API terms:
- Your data is NOT used to train Google's AI models
- The Paid Services terms make no representation, either way, about human review of your prompts for product improvement (unlike the unpaid tier, which explicitly allows it — see Section 5.1)
- Prompts/responses are logged for a limited period for safety/security purposes, including detecting Prohibited Use Policy violations and any required legal or regulatory disclosures — not for abuse detection alone
-
Memory Extraction: After a response, a separate background process may analyze the conversation to extract notable facts (e.g., "User mentioned they live in Tokyo"). These facts are:
- Classified into predefined categories (profile, interests, preferences, etc.)
- Stored as vector embeddings in Qdrant (not as raw conversation text)
- Associated with your Discord User ID and the Guild ID
-
Output: The AI response is sent back to you in Discord
Clarification per Discord Developer Policy Section 21: We do NOT use message content obtained through the Discord APIs to train machine learning or AI models. Data sent to Google Gemini API is for real-time inference only — generating responses, analyzing content, and extracting facts. Google (under paid terms) also does not use this data for model training.
7.2 Automod AI Processing
When automod is enabled in a channel:
- Message content is analyzed by Google Gemini for policy violations
- The AI considers the message context, server rules, and the user's violation history
- The violation record (category, action taken, timestamp) is saved, along with a copy of the flagged message's text at the time of the violation, so staff reviewing a warning later can see exactly what was flagged
7.3 Report AI Processing
When a user report is filed:
- Recent messages from the reported user are gathered from the Discord channel
- These messages, along with the report reason and user's violation history, are sent to Google Gemini for analysis
- The AI provides a severity assessment and recommended action
- The analysis summary is logged to the server's report channel
7.4 AI Limitations
- NoxBot's AI may occasionally produce inaccurate, incomplete, or inappropriate responses
- AI-generated moderation recommendations are advisory — server staff retain final decision-making authority
- Memory extraction is probabilistic and may occasionally record inaccurate information
- Users can request deletion of any memories the AI has stored about them (see Section 8.3)
8. Your Rights
8.1 Rights Under GDPR (EU/EEA/UK Users)
If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights:
| Right | Description | How to Exercise |
|---|---|---|
| Right of Access | Request a copy of all personal data we hold about you | Contact us (see Section 17) |
| Right to Rectification | Request correction of inaccurate personal data | Contact us (see Section 17) |
| Right to Erasure | Request deletion of your personal data ("right to be forgotten") | Contact us (see Section 17) |
| Right to Restrict Processing | Request limitation of data processing | Contact us (see Section 17) |
| Right to Data Portability | Receive your data in a machine-readable format | Contact us (see Section 17) |
| Right to Object | Object to processing based on legitimate interest | Contact us (see Section 17) |
| Right to Withdraw Consent | Withdraw consent at any time where processing is consent-based | Contact us (see Section 17) |
| Right to Lodge a Complaint | File a complaint with your local Data Protection Authority | See your country's DPA website |
Response Time: We will respond to all data rights requests within 30 days of receipt.
8.2 Rights Under CCPA/CPRA (California Users)
California residents have the following additional rights:
- Right to Know: What personal information is collected, used, and shared
- Right to Delete: Request deletion of personal information
- Right to Opt-Out of Sale: We do NOT sell personal information — this right is automatically respected
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
- Right Regarding Automated Decision-Making: Right to opt out of automated decision-making technology used for significant decisions
8.3 How to Exercise Your Rights
You can exercise your data rights by:
- Discord Support Server: Contact us in our support server (https://discord.gg/8GT69je84T)
- Email: Send a request to helpdeskprojectx1@gmail.com
- Server Administrators: Can clear user warnings via
/warns clear @user
Per Discord Developer ToS Section 5(b), when a user requests data deletion, we will promptly delete the applicable API Data. We may need to verify your identity (Discord User ID) before processing requests.
9. Discord Compliance
9.1 Discord Terms of Service (effective September 29, 2025)
| Requirement | Our Compliance |
|---|---|
| Users must be at least 13 years old (Section 2) | ✅ We do not knowingly collect data from users under 13 |
| Third-party services must follow Discord's Terms (Section 6) | ✅ NoxBot complies with all Discord Terms, Community Guidelines, Developer ToS, and Developer Policy |
| No scraping without written consent (Section 9) | ✅ NoxBot only accesses data through official Discord APIs |
| No commercializing content/data obtained from Discord (Section 9) | ✅ We do not sell, license, or commercialize any data |
9.2 Discord Developer Terms of Service (effective July 8, 2024)
| Requirement | Our Compliance |
|---|---|
| Provide a privacy policy (Section 5a) | ✅ This document serves as our privacy policy |
| Comply with global privacy laws (Section 5a) | ✅ We address GDPR, CCPA/CPRA, and COPPA requirements |
| Only use API Data for stated functionality (Section 5b, Policy 15) | ✅ All data is used solely for bot features described herein |
| Delete data when no longer necessary or on user request (Section 5b) | ✅ We implement auto-deletion (TTL) and honor deletion requests |
| Encrypt data at rest (Section 5c) | ✅ All storage providers encrypt data at rest |
| No sharing API Data with ad networks or data brokers (Policy 17) | ✅ We never share data with advertisers or data brokers |
| No selling, licensing, or commercializing API Data (Policy 18) | ✅ We never sell or commercialize user data |
| No using message content to train ML/AI models absent Discord's express permission (Policy 21) | ✅ We do NOT train any models — Gemini API is used for inference only, and we have not sought or received such permission from Discord |
| No collecting data from users under 13 (Policy 16) | ✅ We rely on Discord's own age gate (min age 13) |
| No collecting sensitive data (Policy 16) | ✅ We do not collect health, financial, or other sensitive information |
| No profiling users or their relationships (Policy 16) | ✅ Memories are for personalization, not profiling or marketing |
| Report security incidents promptly (Section 5c) | ✅ We will notify Discord and users of any data breach |
| Delete all API Data upon termination (Section 9b) | ✅ Upon discontinuation, all cached/stored data will be deleted |
| No targeted advertising (Policy) | ✅ NoxBot does not serve advertisements |
| No contacting users outside Discord with API Data (Policy) | ✅ We never contact users outside of Discord |
10. Google Gemini API Compliance
Per the Gemini API Additional Terms of Service (effective December 18, 2025):
| Requirement | Our Compliance |
|---|---|
| Age requirement: 18+ for API developers | ✅ Bot developer is 18+ |
| API Clients must not be directed to users under 18 | ⚠️ Discord requires minimum age 13; NoxBot is a general-purpose server bot, not directed at minors specifically |
| Comply with Prohibited Use Policy | ✅ NoxBot does not generate illegal content, CSAM, or harmful content |
| Do not misrepresent AI as human | ✅ NoxBot is clearly identified as a bot in Discord |
| Do not reverse-engineer or extract model data | ✅ We only use the API as intended |
| Available regions only | ✅ Bot operates only in available regions |
| EU/EEA/UK: Must use Paid Services | ✅ EU/EEA/UK users' data is processed under Paid Service terms per Gemini API Terms |
11. Children's Privacy (COPPA Compliance)
NoxBot is not directed at children under the age of 13.
- Discord's own Terms of Service (Section 2) require users to be at least 13 years old
- We do not knowingly collect personal information from children under 13 (per Discord Developer Policy Section 16)
- If we become aware that we have collected data from a child under 13, we will take immediate steps to delete that information
- Under the updated COPPA Rule (effective June 23, 2025), we do NOT use children's data for AI training, behavioral advertising, or profiling
- Server administrators are responsible for ensuring their Discord server complies with age-appropriate content guidelines
Note regarding Gemini API Age Requirement: The Gemini API Terms require that API Clients are not directed towards individuals under 18. NoxBot is a general-purpose Discord bot not specifically directed at any age group. We rely on Discord's own age verification (minimum age 13) and recommend server administrators configure appropriate content settings.
If you believe a child under 13 has provided personal information to NoxBot, please contact us immediately.
12. International Data Transfers
NoxBot's infrastructure may process data in regions outside your country of residence:
| Service | Potential Data Location |
|---|---|
| Google Firestore | Google Cloud regions (US, EU, or as configured) |
| Qdrant Cloud | Cloud provider regions (configurable) |
| Redis Provider | Cloud provider regions (configurable) |
| Google Gemini API | Google's processing infrastructure (may be stored transiently in any country where Google maintains facilities, per Gemini API Terms) |
| Google Search API | Google's processing infrastructure |
| WeatherAPI | WeatherAPI.com servers |
| Groq | Groq's processing infrastructure (background tasks only) |
| OpenRouter | OpenRouter's processing infrastructure (background tasks only) |
| Nvidia AI | Nvidia's processing infrastructure (background tasks only) |
| Sentry | Sentry's processing infrastructure (scrubbed error reports only) |
| Cloudflare R2 | Cloudflare's global network (archived log files) |
For EU/EEA/UK Users: Where data is transferred outside the EU/EEA, we rely on:
- Google: Standard Contractual Clauses (SCCs), Data Processing Addendum, and Google Controller-Controller Data Protection Terms
- Groq / OpenRouter / Nvidia / Sentry / Cloudflare: Standard Contractual Clauses or equivalent safeguards under each provider's own terms
- Qdrant/Redis Providers: Standard Contractual Clauses or adequacy decisions where applicable
- Per Discord Developer ToS Section 11, we ensure all international data transfers comply with applicable laws
13. Data Breach Notification
In the event of a personal data breach:
- Discord Notification: We will promptly notify Discord and provide requested information regarding any unauthorized access or use of API Data (per Discord Developer ToS Section 5(a))
- EU/EEA/UK Users: We will notify the relevant Data Protection Authority within 72 hours of becoming aware of the breach (GDPR Article 33). If the breach poses high risk to your rights, we will also notify affected users (GDPR Article 34)
- California Users: We will notify affected users in accordance with California Civil Code § 1798.82
- All Users: We will post a notice in our support server and take immediate steps to mitigate the breach
14. Changes to This Policy
Governed by the same "Changes to Our Policies" rule stated in our Terms & Conditions — that section is the single source of truth for how we announce updates across the Terms and Conditions, this Privacy Policy, and the Refund Policy alike. In short, for this Privacy Policy specifically:
- The "Last Updated" date at the top will be revised
- Material changes will be announced solely in our official Discord support server — no other channel is used for policy update notices
- Continued use of NoxBot after changes constitutes acceptance of the updated policy
- For significant changes affecting how we process your data, we will provide at least 30 days' notice
15. Legal Basis for Processing (GDPR)
For users in the EU/EEA/UK, we process personal data under the following legal bases:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| AI chat responses | Legitimate Interest | Art. 6(1)(f) |
| Memory extraction & storage | Consent (implied by using AI features) | Art. 6(1)(a) |
| Automod content analysis | Legitimate Interest (server safety) | Art. 6(1)(f) |
| Report processing | Legitimate Interest (community protection) | Art. 6(1)(f) |
| Ticket system | Contract Performance | Art. 6(1)(b) |
| Analytics (aggregated) | Legitimate Interest (service improvement) | Art. 6(1)(f) |
| Payment processing | Contract Performance | Art. 6(1)(b) |
| Warning system | Legitimate Interest (server safety) | Art. 6(1)(f) |
| AI Announcements | Legitimate Interest (community engagement) | Art. 6(1)(f) |
| Event Announcements | Legitimate Interest (community engagement) | Art. 6(1)(f) |
| Web Search | Contract Performance | Art. 6(1)(b) |
| Weather Lookup | Contract Performance | Art. 6(1)(b) |
Legitimate Interest Assessment: We have conducted a balancing test for each legitimate interest activity and determined the processing is necessary and does not override user rights, given data minimization, user awareness of bot presence, proportionate retention with auto-deletion, and opt-out availability.
16. Cookies & Tracking
NoxBot the Discord bot does not use cookies at all. The NoxBot website (noxbot.tech) uses two categories, both disclosed and controllable via the cookie consent banner shown on your first visit:
- Essential cookies (always on, not optional): secure, encrypted session cookies (such as
guild_perms) used solely for authentication and managing your dashboard permissions. - Analytics cookies (optional, on by default, can be declined at any time): used by the website analytics services described in Section 5.5 (Google Analytics, Vercel Web Analytics). You can turn these off via the "Analytics Cookies" toggle in the cookie consent banner without affecting your ability to use the site.
We do not use advertising or third-party profiling cookies of any kind.
17. Contact Us
For any privacy-related questions, data access requests, or concerns:
| Method | Details |
|---|---|
| helpdeskprojectx1@gmail.com | |
| Discord | https://discord.gg/8GT69je84T |
| Website | https://noxbot.tech |
For EU/EEA/UK users wishing to lodge a complaint, you may also contact your local Data Protection Authority (DPA).
18. Summary — What We Store, What We Use, What AI Processes
What We Store
| Category | Specific Data | Where | How Long |
|---|---|---|---|
| Guild Config | Moderation settings, channels, staff roles, wordlists, AI rulebook, ticket config, subscription tier | Firestore | Until bot removal |
| Chat History | Recent messages (role, content, author, timestamp) | Redis | 72 hours |
| User Memories | AI-extracted facts (interests, preferences, profile) | Qdrant | 180–365 days by category, renewed on re-mention |
| Server Memories | AI-extracted facts about the community | Qdrant | 90–365 days by category, renewed on re-mention |
| Tickets | Ticket content, user ID, status, timestamps | Firestore | 90 days post-closure |
| Warnings | Warning reason, source, timestamp, issuer, flagged message text | Firestore | 90 days |
| Analytics | Aggregated counts per guild | Firestore | Daily/Monthly rolls |
| Payments | Transaction records | Firestore | As required by law |
What We Use It For
| Data | Used For |
|---|---|
| Discord User ID | Identify users, associate memories, track warnings |
| Message Content | Generate AI responses, moderate content, extract memories |
| Chat History | Provide conversational context to AI |
| User Memories | Personalize AI responses across sessions |
| Server Memories | Maintain community context for moderation and chat |
| Guild Config | Apply server-specific bot settings |
| Analytics | Monitor usage, enforce tier limits, bot performance |
What AI (Google Gemini) Processes
| Data Sent to AI | Purpose | Retained by Google? |
|---|---|---|
| User message text | Generate contextual response | Paid: logged briefly (see below) |
| Chat history (a limited window) | Conversation context | Paid: logged briefly (see below) |
| User/server memories | Personalization context | Paid: logged briefly (see below) |
| System instructions | Bot personality / behavior | Paid: logged briefly (see below) |
| Reported user messages | Moderation analysis | Paid: logged briefly (see below) |
| Channel messages | Automod content analysis | Paid: logged briefly (see below) |
| Announcement content | Relevance scoring | Paid: logged briefly (see below) |
| Conversation extracts | Memory fact extraction | Paid: logged briefly (see below) |
Under Google's paid API terms: Your data is NOT used to train Google's AI models. Google logs prompts/responses for a limited period for safety/security purposes — this covers detecting Prohibited Use Policy violations and any required legal or regulatory disclosures, not abuse detection alone (see Section 5.1). The Paid Services terms make no representation about human review of your prompts. For EU/EEA/UK users, these paid terms apply regardless of the tier being used.