Privacy Policy

1. Who we are (the controller)

Vardoxen (operated from the United Kingdom) is the controller of the personal data described in this policy, for both the website and the Vardoxen Discord bot. This means we decide how and why your personal data is processed. For any privacy enquiry, or to exercise your rights, contact legal@vardoxen.tv or use our contact page.

2. The personal data we collect, why, and our lawful basis

We only collect the personal data we need to run the Service. The sections below set out what we collect, why, and the lawful basis under Article 6 of the UK GDPR on which we rely.

2.1 Discord sign-in and your account

When you sign in with Discord we receive your Discord ID, username, display name, avatar, email address, and your membership and roles in the Vardoxen server (OAuth scopes: identify, email, guilds, and guilds.members.read). We use this to create and operate your account and to determine your access level. Lawful basis: performance of a contract (these Terms), and our legitimate interests in operating member accounts.

2.2 Submissions

Submissions are shown publicly without your username or profile. Internally and privately, we store a reference to your Discord account, a one-way (hashed) version of your IP address, timestamps, the submission text and category, and the moderation status and audit history. We use this to operate and moderate the feature, enforce rate limits, prevent and investigate abuse, and block rule-breakers. Lawful basis: legitimate interests (running a safe community feature and preventing abuse). Full detail is in our Submissions Policy.

2.3 Patreon linking and the Wall of Support

Linking your Patreon account is optional. If you link it, we store your Patreon user ID, your pledge status, tier and amount, and your access and refresh tokens (encrypted at rest). We use this to grant the supporter (Vanguards) role and, if you are an active supporter, to feature your display name on the public Wall of Support (here and in our Discord) in the tier matching your pledge. A gifted total is shown only where you have asked us to display it. PayPal and TikTok supporters may be added manually. You can withdraw at any time by unlinking Patreon, which removes the role and takes you off the Wall of Support. Lawful basis: consent (for linking your Patreon and public recognition), and legitimate interests in recognising supporters; you can withdraw consent at any time without affecting earlier processing.

2.4 Giveaways, appeals, reports, and contact

If you enter a giveaway we store a reference to your Discord account and your entry count. If you submit an appeal, a report, or an introduction edit request, we store the details you provide and your account reference to handle it; some actions have Discord side effects carried out by the bot. If you contact us, we use your message and contact details to respond. Lawful basis: legitimate interests (operating these features and handling enquiries fairly), consent where you provide information voluntarily, and compliance with our legal obligations where a report concerns unlawful content.

2.5 Links and analytics

Outbound links use a tracked redirect that records only the link, a coarse referrer host, and an optional country. We do not store a raw IP address or a user identifier for link clicks. We also keep aggregate page-view counts per page with no per-user records, and use privacy-first, cookieless analytics that do not identify individuals. Lawful basis: legitimate interests (understanding, in aggregate, how the Service is used). See our Cookie Policy.

2.6 The Discord bot

The Vardoxen Discord bot processes Discord identifiers, message logs, and moderation, automation, birthday, and giveaway records for community safety and features. It also reads supporter and Patreon-link data from the shared database to display the Wall of Support and keep the supporter role in sync. See the Discord Bot Privacy Policy for detail. Lawful basis: legitimate interests (operating a safe community), and consent where you voluntarily provide information such as a birthday or introduction.

3. Where your data comes from

Most personal data we hold comes from you directly (for example, a submission or a contact message) or from your use of the Service. Some comes from third parties you choose to connect, namely Discord (when you sign in) and Patreon (when you link your account), in line with the permissions you grant them.

4. Recipients, hosting, and international transfers

We share personal data only as needed to run the Service. Our recipients are: Discord (authentication and community); our hosting and database provider, Railway, acting as our processor under a data processing agreement; and supporter and donation platforms (Patreon for account linking and supporter status, PayPal, and TikTok). Personal data is stored in the EU/EEA. We do not sell personal data and we do not use it for third-party advertising. Where any transfer outside the UK or EEA occurs, it is protected by an appropriate safeguard, such as a UK adequacy decision (or the EU equivalent) or the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses. We may also disclose personal data where required by law, to enforce our Terms, or to protect the rights, safety, and property of Vardoxen, our users, or the public.

5. Security

We take appropriate technical and organisational measures to protect personal data, including least-privilege database access, encryption in transit, encryption of sensitive secrets (such as Patreon tokens) at rest, keyed one-way hashing of IP addresses using a slow key-derivation function, rate limiting, access controls, and audit logging. No system can be guaranteed perfectly secure, but we work to protect your data and to limit who can access it.

6. Personal data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where required, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will inform you without undue delay.

7. How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes set out above, then delete or anonymise it. Our general retention periods are:

• Account data: kept while your account is active and deleted within 30 days of account closure, except where we must keep limited records longer for legal or audit reasons.
• Submissions: the submission and its moderation history are kept while displayed and for up to 12 months after removal, for audit and abuse-prevention; the hashed IP and account reference are kept for up to 12 months and then deleted.
• Patreon link data: kept while your account is linked and deleted promptly (within 30 days) when you unlink or your pledge ends.
• Wall of Support entries: kept while you are an active supporter or until you ask to be removed.
• Giveaway entries: kept for the duration of the giveaway and for up to 6 months afterwards to resolve disputes, then deleted.
• Moderation, reports, and appeals: kept for up to 24 months after the case is closed so that repeat behaviour and appeals can be handled fairly, then deleted or anonymised.
• Contact messages: kept for up to 12 months after your enquiry is resolved.
• Aggregate analytics and link counts: not linked to an individual and kept indefinitely in aggregate form.

Where a longer period is required by law, or data is needed to establish, exercise, or defend legal claims, we may keep it for that longer period.

8. Your rights

Under the UK GDPR you have the right to: be informed about how we use your data; access a copy of it; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and withdraw consent where processing relies on it. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see section 10). These rights may be limited where we have an overriding legal obligation or legitimate interest, for example to keep moderation and audit records. To exercise any right, contact legal@vardoxen.tv; we will respond within one month, and we will not charge a fee unless a request is manifestly unfounded or excessive.

9. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

10. Automated processing

We use automated checks (such as spam and abuse detection and rate limiting) to keep the Service safe. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing; moderation decisions involve human review, and you can appeal them through our appeals route.

11. Cookies

We use only strictly necessary cookies and privacy-first, cookieless analytics. For detail, see our Cookie Policy.

12. Children

The Service is intended for users aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows the latest version, and we will take reasonable steps to tell you about significant changes.