Log in
FeaturesDashboardDocs
Log in

Privacy policy

Last updated: 22 October 2026

This policy explains which personal data Inbox processes, why, and what rights you have under the GDPR. It covers the Discord bots, the website and the dashboard.

1. Controller

The controller is the operator named in the imprint. Contact for privacy questions: kiano@inboxbot.de.

Each Discord server that uses Inbox decides how tickets are used there. For ticket content, that server and we may be responsible together; we only process ticket data to run Inbox for that server.

2. Data from Discord servers

When Inbox is in a server, it stores:

  • server data: server ID, name, icon, owner ID, member count, and the settings made in the dashboard;
  • ticket data: ticket number, opener and staff user IDs, category, status, priority, form answers, private staff notes and ratings;
  • messages in ticket channels while a ticket is open: text, attachments (name, link, size), the author’s user ID, display name and avatar at that time, and edits and deletions, so a complete transcript can be made;
  • transcripts (HTML files) and share links created when a ticket closes;
  • server blacklists and an audit log of dashboard changes (who changed what, and when).

Inbox does not read messages outside ticket channels.

Our website shows the biggest servers that use Inbox (name, icon and member count) as a showcase. Server owners can turn this off at any time in the dashboard settings.

Legal basis: Art. 6(1)(b) GDPR (providing the service the server asked for) and Art. 6(1)(f) GDPR (our and the server’s interest in a working, traceable support system).

3. Website and dashboard

When you log in with Discord we ask only for the scopes "identify" and "guilds": your user ID, name and avatar, and the list of your servers with your permissions there, so we can show which servers you may manage. Your Discord access token is kept in an encrypted session cookie and is not stored in our database.

We use only necessary cookies: the login session, and your choice of language. Your theme choice is stored in your browser’s local storage. There is no tracking and no advertising cookies.

Our servers log technical data (IP address, time, requested page) to keep the service secure. These logs are deleted after 14 days.

Legal basis: Art. 6(1)(b) and (f) GDPR; § 25(2) TDDDG for necessary cookies.

4. Optional features

  • Payments (Pro and Business): handled by Stripe Payments Europe Ltd. We receive the subscription status, not your full card details.
  • AI assistant (off unless a server turns it on): in live categories, ticket messages and the server’s knowledge are sent to Google (Gemini API) to write answers. Google acts as our processor and does not use the data to train its models under the paid API terms.

5. Processors and transfers

We use hosting and storage providers that process data only on our instructions. Discord (Discord Inc., USA) receives everything you post on Discord anyway; Stripe and Google may process data in the USA. Transfers outside the EU rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

6. How long we keep data

  • Ticket messages, notes, form answers and transcripts of closed tickets, depending on the server’s plan: 30 days (Free), 1 year (Pro) or as long as the server uses Inbox (Business). After that a daily job deletes them; only the ticket number and its dates stay, for statistics.
  • When the bot is removed from a server, its data is kept for 30 days, so a re-added bot keeps its setup, and then deleted completely.
  • Server managers can download or delete all of their server’s data at any time in the dashboard (Settings → Privacy and data).
  • Dashboard audit logs: as long as the server uses Inbox.
  • Billing records: as long as tax law requires (up to 10 years).

7. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format. Where processing is based on legitimate interests, you can object at any time. Write to kiano@inboxbot.de; we answer within one month. To find your data we need your Discord user ID; we then send you a copy of it, or blank your messages in every server and remove your ratings and form answers. Security records (audit logs, blacklists) are kept where the law allows.

You can also complain to a data protection authority, for example the one where you live.

8. Children

Inbox is not meant for anyone below the minimum age Discord sets in their country.

9. Changes

We update this policy when Inbox changes. The date at the top shows the latest version.