Privacy Policy

1. Introduction

This Privacy Policy explains our practices regarding personal data processed in connection with the Kelly Discord bot and website (together, the "Service"). It applies to everyone who uses the Service, whether as a server administrator or a member of a server where Kelly is installed. We process data in accordance with applicable data protection law, including the General Data Protection Regulation (GDPR) where it applies.

2. Information We Collect

Account information. When you log into the website through Discord OAuth, we receive and store your Discord user ID, username, display name, discriminator and avatar hash. We use this to show your profile in place of a login button.

Server configuration. When Kelly is installed on a server, we process server configuration data: server ID and name, channels where the bot is configured to act, roles used by features, and feature settings (filters, levels, logs, reactions, and similar).

Command and event data. To operate, the bot processes the commands sent to it, the messages required to evaluate filters and autoresponders, and moderation events (warns, mutes, kicks, bans, joins and leaves) together with the identifiers of the members involved.

Local storage. The website stores a signed session token in your browser's local storage so you stay logged in. This token contains the profile data listed above and expires after 7 days.

Automated logs. Our hosting provider may record standard access data, including IP addresses, request times and pages visited, for security and abuse prevention.

3. How We Use Information

We use personal data to:

(a) provide, operate and maintain the Service; (b) authenticate users and display profiles; (c) process commands and enforce server configurations; (d) respond to support requests; (e) prevent abuse, fraud and security incidents; (f) comply with legal obligations; and (g) improve the Service. We do not sell personal data, and we do not use it for advertising.

4. Legal Bases for Processing

Where the GDPR applies, we process personal data on the following bases: (a) performance of a contract, where processing is necessary to provide the Service you requested; (b) legitimate interests, such as operating and securing the Service; and (c) consent, where we ask for it, for example when you log in. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Sharing and Disclosure

We do not share personal data with third parties except in the following circumstances: (a) with service providers that host and operate the Service, including Cloudflare, which processes data on our behalf and under our instructions; (b) with Discord, to the extent necessary to provide bot functionality; (c) where required by law, regulation, or legal process; (d) to protect the rights, safety or property of the Kelly team or others; and (e) with your consent.

If the Kelly team is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, with notice provided where required by law.

6. International Data Transfers

Personal data may be transferred to and processed in countries other than the one in which you reside, including through hosting and infrastructure providers operating globally. Where required, we rely on appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, to protect transferred data.

7. Data Retention

Session tokens expire after 7 days. Server configuration and event data is kept while Kelly remains installed on the server and is deleted or anonymized after the bot is removed. Automated access logs are retained only as long as needed for security and abuse prevention. We retain personal data only for as long as necessary for the purposes described in this policy or as required by law.

8. Security

We implement reasonable technical and organizational measures to protect personal data, including signed session tokens, restricted access to production systems, and secret storage for Discord credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your own credentials safe.

9. Your Rights and Choices

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your personal data, to object to processing, to request portability, and to withdraw consent. If you are in the EEA, UK or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

To exercise these rights, contact us through the support server linked on the website. We will respond within a reasonable time, and within one month where required by law. We may ask you to verify your identity before acting on a request.

10. Children

The Service is not directed to individuals under 13 and we do not knowingly collect personal data from them. If you believe a child under 13 has provided us personal data, please contact us and we will delete it promptly.

11. Cookies and Local Storage

The website does not use advertising or analytics cookies. We use browser local storage to persist your signed session token and your language preference. You can clear this data at any time through your browser settings or by logging out.

12. Do Not Track

We do not respond to browser "Do Not Track" signals, as the Service does not engage in cross-site tracking.

13. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and, where practical, notify users through the website. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

14. Contact

Questions about this policy or requests to exercise your rights can be sent to the Kelly team through the support server linked on the website.