Introduction

Thank you for choosing EsportBot. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Discord bot services, website, and related services (collectively, the "Services"). Data Controller: Prepperen AS, Org. no. 932022869 Oestre Straetassvegen 36, 2436 Våler, Norway EsportBot is a brand of Prepperen AS ("we", "us", "our"). Contact: esportbot.eu@gmail.com Our role. Prepperen AS is the data controller for the processing described in this Privacy Policy. Discord server administrators are responsible for their own server's setup, membership, and content, and for informing their members about the tools they enable on their server. This Privacy Policy is information about how we process personal data. Your statutory data protection rights apply regardless of any agreement, and using the Services is not treated as consent to processing — where we rely on consent as a legal basis, we ask for it separately and explicitly.

1. Information we collect

1.1 Information You Provide We collect personal information when you: - Register or use our Discord bot services - Sign in to our dashboard - Contact us for support - Subscribe to our services - Use the Google Calendar integration
The personal information we collect may include: - Discord Account Information: Discord user ID, username, server IDs, channel IDs - Contact Information: Email addresses, names (if provided) - Payment Information: Payment method details (processed securely by third-party payment processors such as Stripe — we do not store full card numbers) - Google Calendar Data: When you connect Google Calendar, we access only calendars created by EsportBot and the events on those calendars (see Section 6) - Contact Form Data: Name, email address, and message content when you use the contact form on our website - Usage Data: Commands used, features accessed, interaction logs - Server Configuration: Server settings, preferences, custom configurations 1.2 Information Collected Automatically When you use our Services, we automatically collect certain information: - Discord Activity: Messages sent to the bot, commands executed, server interactions - Technical Data: IP addresses, device information, browser type, operating system - Usage and Error Logs: Feature usage patterns, error logs, performance metrics - Website Analytics: If you accept analytics cookies on our website, Google Analytics collects information about how you use the site (see Section 10)
1.3 Information from Third-Party Services - Google Calendar API: When you authorize the Google Calendar integration, we receive calendar data as described in Section 6 - Discord API: User and server information provided by Discord's API - Payment Processors: Transaction information from Stripe or other payment processors - Game and creator platforms: When you use the optional integrations described in Section 1.4, we receive information about you from those platforms
1.4 Game and Creator Platform Integrations These integrations are optional. They are only active if a server administrator enables the module and you choose to link your account. If you never link an account, none of the processing below happens to you. - Steam / CS2 ranks. You provide your Steam profile link or SteamID64. We store the resulting SteamID64 and query Leetify for the public rank data attached to it (Premier/CS Rating, Faceit level and elo, competitive and Wingman ranks). We store the returned rank values and when they were last refreshed. We do not receive your Steam password, your friends list, or your library. - PUBG ranks. You provide your PUBG in-game name. We store that name and the account id PUBG's official API returns for it, and we query that API for your public ranked tier and rating. We store the returned rank values and the refresh time. - Patreon membership sync. If you link your Patreon account, we receive your Patreon user id, the campaigns you are a member of, your pledge tier and the status of your membership (including whether a payment has been declined and any grace period). We use this only to grant or remove Discord roles on the server whose creator you support. We do not receive your payment card details. - Esport Arena Nordics. For servers using this integration, we exchange your Discord user id and your tournament division/registration status with the Esport Arena Nordics platform.
For each of these, unlinking your account stops further collection, and the stored identifiers and rank data are deleted as described in Section 4.

2. How do we use your information?

We process your information based on the following legal bases under the GDPR: - Contract Performance (Art. 6(1)(b)): To provide and maintain the Services you have signed up for Consent (Art. 6(1)(a)): Where you explicitly consent to specific processing (e.g., connecting Google Calendar, receiving marketing emails) - Legitimate Interests (Art. 6(1)(f)): To improve our Services, ensure security, and prevent fraud and abuse - Legal Obligations (Art. 6(1)(c)): To comply with applicable laws, such as accounting legislation
2.1 Service Provision We use your information to: - Provide, operate, and maintain our Discord bot services - Process transactions and manage subscriptions - Sync Discord events with Google Calendar (when authorized) - Send RSVP requests and manage team calendar events - Respond to your inquiries and provide customer support - Send administrative information, updates, and service notifications
2.2 Google Calendar Integration When you connect Google Calendar: - Purpose: To sync Discord events with Google Calendar and enable team calendar features Data Accessed: - Only calendars created by EsportBot in your Google account, and the events on those calendars (see Section 6 for the exact scope)
How We Use It: - Create and update events on EsportBot-created calendars based on Discord events - Display those events in our dashboard - Send calendar invitations to team members (for team calendar features) - Sync event changes between Discord and the EsportBot-created calendar - Data Sharing: Calendar data is only accessed with your explicit authorization and is not shared with third parties except as necessary to provide the service
2.3 Communications We do not currently send newsletters or marketing emails, and we do not use your data for advertising. If we introduce marketing communications in the future, we will only send them with your prior consent, and you will be able to opt out at any time. If you contact us through the contact form or by email, we use the information you provide to respond to and follow up on your inquiry (legitimate interest, Art. 6(1)(f)). Service-related notifications (e.g., billing, security, or material changes to terms) are not marketing and may be sent as part of providing the Services. 2.4 Legal and Security We may use your information to: - Detect, prevent, and address technical issues and security threats - Comply with legal obligations and respond to legal requests - Enforce our Terms of Service and protect our rights - Prevent fraud and abuse

3. Data sharing and disclosure

We do not sell your personal information. We may share your information only in the following circumstances: 3.1 Sub-processors The table below is the complete list of third parties that process personal data on our behalf, what they process, and where. It is kept current; material additions are announced as described in Section 12.
Discord Inc. Purpose: The bot platform itself — every command and interaction passes through Discord. Personal data processed: Discord user and server identifiers, and message content sent to the bot. Location: USA. Hetzner Online GmbH Purpose: Hosting of the bot, dashboard and primary database. Personal data processed: All data stored by the Services. Location: Germany (EU). Stripe, Inc. Purpose: Payment processing, subscription billing and invoices. Personal data processed: Name, email address, billing address, VAT number and payment method details. We never see full card numbers. Location: USA and Ireland. Google LLC Purpose: Google Calendar integration and website statistics through Google Analytics if you accept analytics cookies. Personal data processed: Calendar events on EsportBot-created calendars and website usage data. Location: USA. Supabase Inc. Purpose: Off-site storage of encrypted database backups. Personal data processed: Encrypted backup archives only. Backups are encrypted before leaving our infrastructure, the encryption key is not shared, and copies are deleted after 14 days. Location: EU region. Renderforest LLC Purpose: Hosting of the marketing website and its contact form. Personal data processed: Name, email address and message content submitted through the contact form. Location: USA and Armenia. Functional Software, Inc. (Sentry) Purpose: Application error tracking. Personal data processed: Stack traces and technical context. Personally identifying request data, such as headers, cookies and client IP addresses, is deliberately not sent. Location: USA. Better Stack (Better Uptime s.r.o.) Purpose: Uptime monitoring and the public status page. Personal data processed: Availability metrics only — no customer personal data. Location: EU. Leetify AB Purpose: CS2 rank lookups for the optional game-rank integration described in Section 1.4. Personal data processed: The SteamID64 you have linked. Location: Sweden (EU). KRAFTON, Inc. (PUBG API) Purpose: PUBG rank lookups for the optional game-rank integration described in Section 1.4. Personal data processed: The PUBG in-game name and account ID you have linked. Location: USA and South Korea. Patreon, Inc. Purpose: Membership synchronization for the optional Patreon integration described in Section 1.4. Personal data processed: Patreon user ID, campaign membership and pledge tier. Location: USA. Business customers who need a signed data processing agreement can request one at the contact address in Section 14. 3.2 Legal Requirements We may disclose your information if required by law or in response to: - Court orders, subpoenas, or legal processes - Government requests or regulatory requirements - Protection of our rights, property, or safety - Prevention of fraud or abuse
3.3 Business Transfers In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.

4. Data retention

We retain personal information only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. - Account Data: Retained while your account is active and for 30 days after account deletion - Google Calendar Data: Retained only while the integration is active; deleted without undue delay when you disconnect the integration - Transaction Records: Retained for 5 years as required by Norwegian accounting legislation (bokføringsloven) - Usage and Error Logs: Retained for 90 days for security and troubleshooting purposes - Contact Form Inquiries: Retained as long as needed to handle your inquiry, and no longer than 12 months after the inquiry is resolved - Game and Creator Integration Data: Linked identifiers (SteamID64, PUBG name and account id,
- Patreon user id) and the rank or membership data attached to them are retained while the link is active, and deleted when you unlink the account or the server disables the module - Data for servers the bot has left: All data belonging to a Discord server is deleted 90 days after the bot is removed from that server - Encrypted Backups: We keep encrypted database backups for 14 days, after which they are deleted automatically
When we delete your data, we use secure deletion methods. Because we keep encrypted backups for disaster recovery, data you ask us to erase may remain in a backup copy until that copy expires (at most 14 days). We do not restore erased data from backups except where we are legally required to, and a restore for any other reason re-applies your erasure request.

5. Your rights under GDPR

If you are located in the EEA (including Norway) or the United Kingdom, you have the following rights: 5.1 Right of Access You have the right to request access to your personal information and receive a copy of the data we hold about you. 5.2 Right to Rectification You have the right to request correction of inaccurate or incomplete personal information. 5.3 Right to Erasure ("Right to be Forgotten") You have the right to request deletion of your personal information when: - The data is no longer necessary for the original purpose - You withdraw consent and there is no other legal basis - The data has been unlawfully processed - Erasure is required for legal compliance
5.4 Right to Restrict Processing You have the right to request restriction of processing when: - You contest the accuracy of the data - Processing is unlawful but you do not want erasure - We no longer need the data but you need it for legal claims
5.5 Right to Data Portability You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit it to another controller. 5.6 Right to Object You have the right to object to processing based on legitimate interests, and to object at any time to processing for direct marketing purposes. 5.7 Right to Withdraw Consent Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. 5.8 How to Exercise Your Rights To exercise any of these rights, please contact us at: Email: esportbot.eu@gmail.com Subject Line: "GDPR Data Request - [Your Right]"
We will respond without undue delay and at the latest within one month. We may need to verify your identity before processing your request.

6. Google Calendar API data usage

6.1 Scope of Access When you authorize the Google Calendar integration, we request only the following OAuth scope: https://www.googleapis.com/auth/calendar.app.created — access limited to calendars created by EsportBot This means EsportBot can only see and manage calendars — and events on those calendars — that EsportBot itself has created in your Google account. EsportBot cannot read, edit, or delete your other calendars or their events. 6.2 How We Use Google Calendar Data To create, update, and delete events on EsportBot-created calendars as part of Discord event synchronization - To display those events in our dashboard - Calendar event data is stored temporarily in our database to enable synchronization - EsportBot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it. 6.3 Your Control You can revoke Google Calendar access at any time through: - Our dashboard settings - Your Google Account security settings (https://myaccount.google.com/permissions)
Revoking access stops all calendar data collection, and we delete stored calendar data without undue delay. 6.4 Google's Privacy Policy The Google Calendar integration is also subject to Google's Privacy Policy: https://policies.google.com/privacy

7. Data security

We implement appropriate technical and organizational measures to protect your personal information: - Encryption: Data in transit is encrypted using TLS/SSL - Access Controls: Access to personal information is limited on a need-to-know basis - Secure Storage: Data is stored in access-controlled databases on EU-based infrastructure - Security Reviews: We perform security reviews and address vulnerabilities as part of ongoing development - Incident Response: We have procedures for detecting, handling, and — where required by the GDPR — notifying security breaches. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. International Data Transfers

Our Services are hosted within the EU/EEA. Some of the sub-processors listed in Section 3.1 are based outside the EEA — Discord, Google, Stripe, Sentry, Renderforest, Patreon and the PUBG API — which means your information may be transferred outside the EEA. When data is transferred internationally, we ensure appropriate safeguards are in place: Adequacy Decisions: Including the EU–U.S. Data Privacy Framework, where the provider is certified Standard Contractual Clauses: EU-approved standard contractual clauses with service providers where needed.

9. Children's privacy

Our Services are intended for Discord users, and Discord requires users to be at least 13 years old (or older where local law requires). We do not knowingly collect personal information from children below Discord's minimum age. Purchases require you to be at least 18 years old or have the consent of a parent or guardian, as described in our Terms of Service. If you become aware that a child below the applicable minimum age has provided us with personal information, please contact us and we will delete it.

10. Cookies and tracking technologies

Dashboard: Our dashboard uses only strictly necessary cookies (login sessions and security). Website: Our marketing website uses: - Strictly necessary cookies — required for basic functions such as security and accessibility; always active. - Analytics cookies (Google Analytics) — set only if you accept them in the cookie banner. They help us understand how the site is used so we can improve it. - Our website embeds YouTube videos in privacy-enhanced mode (youtube-nocookie.com): YouTube does not set cookies when the page loads, but may set cookies if you choose to play a video, subject to Google's Privacy Policy. We do not use marketing or advertising cookies. You can change or withdraw your cookie choices at any time through the cookie settings on the website, and you can also control cookies through your browser settings. Withdrawing consent is as easy as giving it. Disabling strictly necessary cookies may prevent you from logging in to the dashboard.

11. Third-party links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

12. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The updated version will be indicated by a revised "Last Updated" date at the top of this page. We will notify you of material changes by: - Posting a prominent notice on our website - Sending an email notification (if you have provided your email) - Displaying a notice in our Discord bot or dashboard
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Your right to lodge a complaint

If you believe we have violated your privacy rights, you have the right to lodge a complaint with a data protection authority: - Norway: Datatilsynet — https://www.datatilsynet.no - Other EU/EEA Users: Your local data protection authority (list available at: https://edpb.europa.eu/about-edpb/board/members_en) - UK Users: Information Commissioner's Office (ICO) — https://ico.org.uk
We encourage you to contact us first at esportbot.eu@gmail.com so we can address your concerns directly.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Email: esportbot.eu@gmail.com Subject: Privacy Policy Inquiry

15. Additional Information for Specific Jurisdictions
15.1 California Residents (CCPA) If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA): - Right to know what personal information is collected - Right to delete personal information - Right to opt out of the sale of personal information (we do not sell your data) - Right to non-discrimination for exercising your rights
15.2 Brazilian Residents (LGPD) If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), which are similar to the GDPR rights outlined in Section 5.

Privacy policy