Privacy Policy

Lucas Fredriksson, operating as NordBots, is the controller for the processing described here. Contact for all privacy matters: [email protected].

• Account data from Discord. When you sign in with Discord we receive your Discord user id, username, email address, and avatar. We do not receive your Discord password. Sessions are stored server side and linked to your account.
• Billing data. Purchases are processed by Stripe. We store your Stripe customer id, what you bought, when, for how much, the subscription or payment status, and the related Stripe event records. Your card number never reaches our servers.
• License data. For paid Products we store your license keys, their status and history, and activation records. An activation includes a hardware or server identifier submitted by the plugin from the machine it runs on, an optional label, and last seen timestamps. License API requests are also logged with the requesting IP address for abuse prevention.
• Download records. Each gated download is logged with your account, the file, the time, your IP address, and your browser user agent string.
• Security and audit data. We keep rate limiting counters keyed by account or IP address, and an audit log of significant account, license, and billing events.
• Discord role data. If you are a member of our Discord server, our bot grants and removes purchase related roles on your Discord account there, and records those role changes.
• Legal acceptance records. When you accept the Terms of Service, we record which version you accepted, when, and from which IP address and browser, as evidence of the agreement.
• Correspondence. If you email [email protected] or contact us on Discord, we keep the correspondence.

We do not collect data from your game servers beyond the license validation described above, and we do not read your Discord messages outside direct interactions with us.

• To provide the Service, deliver purchases, issue and validate licenses, and sync Discord roles: performance of our contract with you (GDPR Art. 6(1)(b)).
• To prevent fraud, abuse, license sharing, and payment disputes, to rate limit, and to keep audit records: our legitimate interests in protecting a small first party store (GDPR Art. 6(1)(f)).
• To keep transaction records for tax and accounting: compliance with legal obligations (GDPR Art. 6(1)(c)).
• To answer support requests: performance of the contract and our legitimate interest in assisting users.

We do not use your data for advertising, we do not profile you, and no decision with legal or similarly significant effect on you is made solely by automated means. Automatic license enforcement (for example an activation limit being reached) follows directly from the terms of your purchase.

Strictly necessary cookies are always active: the session cookies that keep you signed in after Discord authentication (httpOnly, secure, expiring with your session) and the single cookie that remembers your consent choice for 12 months. We set no analytics and no advertising cookies.

A consent banner lets you accept or decline optional content. Declining changes nothing about signing in or purchasing. Accepting allows optional third party embeds to load: today that is the homepage video, served through the privacy enhanced youtube-nocookie player, which sets its own cookies under the Google privacy policy. If you decline, the player is replaced by a placeholder and loads only if you click it, which is your specific consent for that one embed. You can change your choice by clearing the consent cookie in your browser, after which the banner asks again.

We share personal data only with the processors and recipients the Service needs:

• Stripe, Inc., for payment processing, billing, and fraud prevention.
• Discord, Inc., for sign in and, if you join our server, for the role assignments described above.
• Cloudflare, Inc., for content delivery and file storage of the Products you download.
• Our hosting provider, which stores the database and runs the application.
• Authorities or other parties where disclosure is required by law, or where necessary to establish, exercise, or defend legal claims, including contesting payment disputes with our delivery and activation records.

We never sell personal data and never share it for third party advertising.

The Service is operated from and hosted in the United States. If you use it from the EEA, the UK, or elsewhere, your data is transferred to the United States. Where GDPR rules apply to a transfer, we rely on the safeguards our processors provide, such as certification under the EU-US Data Privacy Framework or standard contractual clauses.

• Session data: until you sign out or the session expires.
• Single use download tokens: five minutes.
• Download logs, license API logs, and rate limiting counters: kept only as long as needed for security and abuse prevention, then deleted or reduced to aggregates.
• Purchase, entitlement, license, and audit records: for the life of your account and afterwards for as long as tax law, accounting law, and the limitation periods for payment disputes require.
• Legal acceptance records: for as long as the agreement they evidence can be relevant to a claim, which is the limitation period after your last purchase.
• Account data: until you ask us to delete your account, subject to the records we must keep under the point above.

Subject to the conditions and exceptions in applicable law, you have the right to access the personal data we hold about you, to receive a copy in a portable format, to have inaccurate data corrected, to have data deleted, to restrict or object to processing based on our legitimate interests, and to lodge a complaint with your local data protection authority. California residents have corresponding rights under the CCPA, and we do not sell or share personal information as those terms are defined there.

To exercise any right, email [email protected] from the address linked to your account, or include enough information for us to verify you. We respond within the time the applicable law sets, one month under the GDPR. Deleting your account does not erase transaction and audit records we are legally required to keep, and revoking data needed to run a License ends the License.

We protect data with measures appropriate to a small first party store: encrypted transport everywhere, server side sessions, single use time limited download links, signed license responses, rate limiting, and audit logging of sensitive actions. No system is perfectly secure; if a breach affects your data in a way that creates a risk to you, we will notify you and the competent authority as the law requires.

The Service is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

We may update this policy as the Service evolves. The effective date above always reflects the current version, and material changes are announced on the Service. The Terms of Service govern your use of the Service itself.

Privacy questions and rights requests: [email protected]. NordBots is operated by Lucas Fredriksson.