Privacy Policy — DAB Bot

Last updated: 2026-10-24 · The Dutch version prevails in case of differences.

This policy explains what data DAB Bot ("the bot"), its web dashboard ("Studio"), the desktop app and the overlays process, why, how it is protected and how long we keep it.

1. Who is responsible

The controller is DAB Bot (Bjorn), Belgium, reachable at privacy@dabbot.eu. For member data that a server owner has the bot process (e.g. warnings, XP, tickets), the server owner is the controller and we are the processor — see the data processing agreement.

2. Who this applies to

  • Server owners and admins who log into Studio or the desktop app.
  • Members of a Discord server where the bot runs, when their activity triggers a feature.
  • Viewers and chatters on Twitch, YouTube or Kick of a streamer who connected their channel.
  • Buyers of a package or Market pack, and visitors of our website.

3. Data we process

Login

Through Discord login: your Discord ID, username, avatar and an encrypted OAuth token to list your servers. We never see or store your Discord password. Your language preference and any account settings.

Server settings

Everything an admin configures: moderation rules, leveling, welcome messages, custom commands, roles, automations (Canvas), embeds, statistics channels, overlays, widgets and per-command permissions.

Server member data

Tied to a Discord ID within that server, only for the features the server enables:

  • Moderation: warnings, moderation cases, reason, moderator and time; an activity log.
  • Leveling and economy: XP, level, coins, streaks, inventory, boosts, achievements.
  • Birthdays (day and month, year optional) and reminders (deleted once delivered).
  • Tickets (including the messages in the ticket), application forms (your answers), suggestions and votes, starboard, polls, giveaways, quotes, the mailbox and verification.
  • Anonymous chat: the message is shown anonymously, but we store internally who sent it so moderators can handle abuse.
  • Tournaments (teams, matches, scores) and Game Capture (video is relayed live, never recorded).
  • Wheel of Fortune and Team Picker: entrants (Discord or Twitch name) and results.

Regular Discord messages are not stored. Automod checks messages in memory and only stores something when a warning is logged.

Streaming integrations (Twitch, YouTube, Kick, Spotify)

When a streamer connects an account: channel ID, name, profile picture and an encrypted OAuth token; channel stats (followers, subs, viewers); live events (follows, subs, raids, bits, rewards) with the viewer's name; a limited chat log (about 200 messages per server, auto-pruned) for the live chat, the moderator panel and multichat; chat commands, counters and quotes; and song requests (title and who asked). We do not build per-viewer analytics.

Live Alerts

For each streamer a server follows: the public channel name, display name, profile picture, chosen categories and the last announced stream or video ID. This is public information; the streamer does not need to connect anything.

Uploads, overlays and the Market

Images and sounds you upload, and overlays you build, are stored on our server and reachable publicly through a hard-to-guess link (they are shown in OBS). Don't upload personal or sensitive data. Sharing something on the Market shows the server or creator name; reviews show your Discord name.

AI features

Questions to /support and the AI helper in Studio are processed by an AI model we run ourselves on our own server; they are never sent to a third-party AI provider. With /search we send your search term to DuckDuckGo and Wikipedia.

Payments

Packages and Market packs are paid through Stripe or PayPal. We store the customer and subscription ID, package, status and the data accounting law requires (name, address, VAT number if given, amount). We never see your card or PayPal details. We send you a receipt or invoice as a Discord DM.

Technical data

  • Server logs with your IP address, requested page and time, for security and debugging. They rotate automatically and are overwritten after a short time.
  • For staff: a login journal with a hashed IP address, its first two blocks and the browser, to spot suspicious logins.
  • Error reports from the bot and site with technical details (no message content).

4. Cookies and local storage

We only use strictly necessary cookies: dab_session keeps you logged in, and two short cookies (10 minutes) secure the Discord login. In your browser we only store preferences such as your language and panel layout. We use no analytics, ads, tracking pixels or third-party cookies, so we don't ask for cookie consent.

5. Why and on what basis

  • Performance of the contract: running the bot, Studio, integrations, overlays and your package.
  • Legal obligation: keeping invoices and payment records (Belgian accounting law), handling reports of illegal content.
  • Legitimate interest: security, preventing abuse, fixing errors and moderation.

We don't sell data and don't use it for advertising or profiling.

6. Third-party services

  • Discord (US) — login and all bot features.
  • Twitch (US), YouTube / Google (US), Kick (Australia) — integrations and live status.
  • TikTok — we only read public profile pages for Live Alerts.
  • Spotify (Sweden) — "now playing" and song requests.
  • Stripe (Ireland/US) and PayPal (Luxembourg) — payments.
  • Billit (Belgium) — invoicing and bookkeeping.
  • Hetzner Online (Germany) — hosting and encrypted backups. Our own data is stored in the EU.
  • Public data sources without personal data: Cfx.re (game server status), 7TV, BetterTTV and FrankerFaceZ (emotes), GamerPower (free games), DuckDuckGo and Wikipedia (/search).

7. Transfers outside the EU

Discord, Twitch, Google/YouTube, Stripe and PayPal may process data in the United States, and Kick in Australia. These transfers rely on the EU-US Data Privacy Framework (for certified companies) or the European Commission's standard contractual clauses. You can request a copy of these safeguards at privacy@dabbot.eu.

8. YouTube API Services

DAB Bot uses the YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and the Google Privacy Policy also applies to that data.

We read channel data (name, ID, profile picture, subscribers), live and video status, live chat and moderation events, only to show the features in Studio. We share this data with no one and keep the stats as long as the connection exists. Disconnecting in Studio deletes your token and channel data. You can also revoke access at any time in the Google security settings.

9. Security

OAuth tokens (Discord, Twitch, Kick, YouTube, Spotify) and secret keys are stored encrypted (AES-256-GCM). All traffic uses HTTPS. Backups that leave the server are encrypted. Staff need two-factor authentication, and can only open a customer's server with a one-time code from that customer. We report a data breach to the supervisory authority within 72 hours, and to the people affected when the risk is high.

10. How long we keep data

  • Twitch, YouTube and Kick chat log: about 200 messages per server, older ones are deleted automatically.
  • Reminders: deleted once delivered.
  • Server logs with IP address: rotating, a few days.
  • Internal logs: 90 days; warnings, errors and the audit log 1 year. Staff login journal: 1 year.
  • Backups: daily, kept 14 days and then overwritten.
  • Invoices, receipts and payment records: 7 years (Belgian accounting law).
  • Everything else: until an admin removes it in Studio, or until you ask us to erase a server's data after the bot was removed.

11. Your rights

Under the GDPR you have the right of access, rectification, erasure, portability, restriction and objection.

  • On the Account page you can download all your data, log out everywhere and delete your account yourself.
  • Admins can edit or delete most server data themselves in Studio.
  • For anything else, email privacy@dabbot.eu. We reply within one month. If it concerns data a server keeps about you, we also forward your request to that server owner.
  • You can lodge a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels) or the authority in your own country.

12. Children

Discord requires you to be at least 13 (or the minimum age in your country). We don't knowingly collect extra data from children below that age. To buy something you must be 18 or have a parent's permission.

13. Changes

When features change we update this policy and the date at the top. We announce significant changes in Studio.

14. Contact

Questions about privacy or your data: privacy@dabbot.eu — DAB Bot (Bjorn), Belgium.