Alchemist Privacy Policy

2. Key Information

• • We prioritize data minimization and only collect what's necessary for our services to function.
• • Your data is used solely to improve and maintain our services.
• • We do not sell your data, and we do not use it for advertising.
• • Third-party sharing is limited to essential service providers.
• • We never see or store your full payment card details.

3. Website and Dashboard Usage

• • Signing in to the dashboard uses Discord OAuth. We receive your Discord ID, username, avatar and the list of servers you can manage.
• • A login session is stored on our servers and in an essential cookie so that you stay signed in. Sessions expire automatically and are removed when you log out.
• • We count visits to this website and the dashboard with PostHog, without cookies and without storing anything on your device. Section 4 has the details. We do not use advertising cookies or any other tracking cookies.
• • Server configuration you change in the dashboard is saved to our database, because it has to persist for the bot to use it.

4. Web Analytics (PostHog, without cookies)

We would like to know how many people visit this website and the dashboard, which pages help them and where they get stuck. For that we use PostHog, a service of PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, in a mode that stores nothing on your device: no cookies, no local storage, no session storage. That is why there is no cookie banner. Our PostHog project is hosted in the EU (Frankfurt), and requests are sent through our own address brew.acmbot.xyz before they are passed on to PostHog.

• • What is collected: the pages you view, the buttons and links you click, how you arrived (referring website, campaign parameters in the link), browser, operating system and device type, screen size, and possibly your approximate location (country or city), derived from your IP address. In the dashboard we also record a few steps such as which server you open, whether you invite the bot and whether you start or finish a Server Pro checkout. When the bot is added to a server, our server also records that server's ID and which invite link was used (for example the one on Top.gg), without any information about you.
• • What is not collected: no name, Discord ID, email address or other account data, no session recordings, and no content you type into forms. Visits are not linked to your Discord account.
• • How visitors are counted: PostHog computes an anonymous hash from your IP address, browser details and a secret value that changes every day. That lets one visit be counted once, but you cannot be recognised on another day or on other websites. Your IP address is not stored.
• • Legal basis: our legitimate interest in understanding and improving our website and dashboard (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device beyond what your browser sends with every request, § 25 TTDSG does not require consent. You can object at any time by emailing us, or simply block brew.acmbot.xyz in your browser or ad blocker.
• • Retention and processing: events are kept for up to one year. PostHog processes the data on our behalf under a data processing agreement. See PostHog's privacy policy.

5. Discord Bot Features

• • Data about your Discord account which is publicly available (Discord ID, shared servers)
• • Server configuration data (IDs, settings, customizations)
• • Social media notification settings for YouTube and Twitch integration
• • Activity data used by bot features, such as experience points, levels, economy balances, owned items and achievements
• • AI Moderation, when a server enables it: message text is sent to OpenAI to be checked for harmful content. We do not store it; flagged messages are only reported in the server's chosen log channel.

Message logs. If a server's admins enable message logging, the bot records edited and deleted messages in that server: the message text (before and after, for edits), attachment file names, the channel, and the author's Discord ID, username, display name and avatar. These entries are posted to the server's log channel and saved in our database so the server's admins can review them in the dashboard. Only that server's admins can see them.

Member logs. With member logging enabled, joins, leaves, kicks, role changes and nickname changes are recorded the same way, including a member's join date and roles when they leave.

Ticket transcripts. When a ticket is closed and the server has transcripts enabled, the bot saves the ticket channel's messages (text, embeds, attachment links, and each author's name, avatar and roles) as a web page on cdn.acmbot.xyz. The page has a long random address that is only given to that server's staff and is not listed anywhere.

Online status and activity. The bot reads members' online status to show online counts in /serverinfo and the dashboard. If a server's temporary voice channels use the {activity} placeholder, it also reads the game the channel creator is playing when the channel is created. None of this is stored.

No AI training. We never use message content or any other Discord data to train AI or machine learning models.

6. Paid add-ons and payments

Dashboard purchases. Payments on our dashboard are processed by Stripe Payments Europe Ltd. Stripe receives your name, email address, billing address and payment details. Card data is entered on Stripe's own hosted checkout page and never reaches our servers. We store your Discord user ID, and for Server Pro also the ID of the Discord server the subscription is for, together with the Stripe subscription reference, so we can grant the benefits to the right account or server and manage the subscription. Stripe also acts as an independent controller for its own purposes; see Stripe's privacy policy.

Discord purchases. If you buy an add-on inside Discord, Discord processes the payment under its own privacy policy. Discord sends us the purchase record (your Discord user ID, the server ID for server subscriptions, the product, and the subscription period) so we can deliver what you bought.

Fraud prevention. To protect against payment fraud and card testing we use Stripe Radar, which evaluates your payment using data such as your IP address, email address and device signals, and we limit how often one account or one network address can start a checkout. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in preventing fraud.

Support-server role. If you hold an active paid add-on that includes a role on our support server and you are a member there, we assign you that role.

Retention. Purchase records are kept for as long as needed to manage your subscription, handle refunds and disputes, and meet our statutory retention duty for invoices (ten years under German commercial and tax law).

7. Legal Bases for Processing

• • Performance of a contract (Art. 6(1)(b) GDPR) — operating the bot and dashboard for you, and providing and billing Premium subscriptions.
• • Legal obligation (Art. 6(1)(c) GDPR) — keeping invoices and payment records for the periods German tax and commercial law require.
• • Legitimate interests (Art. 6(1)(f) GDPR) — keeping the service secure, preventing abuse and fraud, and diagnosing errors so we can fix them.
• • Consent (Art. 6(1)(a) GDPR) — where you explicitly enable an optional feature, such as connecting a YouTube or Twitch account, and for the optional web analytics described in section 4. You may withdraw consent at any time.

8. Data Collection and Storage

• • The bot runs on a secured VPS in Germany at netcup
• • We use a secured MySQL database for core functionality data
• • Images for announcements are stored securely on our KVM server with proper hashing
• • Data is collected through:
  • • Discord API
  • • Top.gg API
  • • YouTube API (Google Privacy)
  • • User interactions and commands
• • Service providers that process data on our behalf:
  • • netcup GmbH (Germany) — hosting
  • • Stripe — payment processing and fraud prevention
  • • OpenAI — AI moderation and chat features, where enabled
  • • PostHog Inc. — cookieless web analytics, EU hosting (section 4)
  • • Error monitoring and performance monitoring tools, used to diagnose faults

9. International Data Transfers

• • Our servers and database are located in Germany.
• • Some of our service providers — including Discord, Stripe, OpenAI and PostHog (a US company, although our analytics data is hosted in the EU) — may process data outside the European Economic Area, particularly in the United States.
• • Where this happens, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

10. Security

• • All servers and databases are protected from public access
• • We implement industry-standard security measures
• • While we strive for maximum security, no system is 100% secure

11. Data Retention and Deletion

• • Removing the bot deletes your server's configuration
• • Message logs, member logs and ticket transcripts are kept until a server admin or the affected user asks us to delete them
• • Database backups are kept for seven days
• • Invoices and payment records are an exception: German tax and commercial law (§ 147 AO, § 257 HGB) require us to keep them for up to ten years. We cannot delete these on request, but we do not use them for any other purpose.
• • To request data deletion, either:
  • • Join our support server
  • • Email us at [email protected]

12. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• • Access — ask what data we hold about you. You can also use the /mydata command in Discord.
• • Rectification — have inaccurate data corrected.
• • Erasure — have your data deleted, subject to the retention obligations described above.
• • Restriction and objection — limit or object to processing based on our legitimate interests.
• • Data portability — receive your data in a machine-readable format.
• • Withdraw consent — at any time, without affecting processing already carried out. Web analytics (section 4) is not based on consent; you can object to it instead, as described there.
• • Complain to a supervisory authority — you may lodge a complaint with your local data protection authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

Contact Information

• • Join the support server and create a ticket
• • Contact the developer .ddominik
• • Email: [email protected]
• • Use /mydata command in Discord to view your data