This is a convenience translation. Only the German version is legally binding: Deutsche Fassung
Note: This Privacy Policy informs you about the processing of your personal data when you use our Discord bot and the associated website. Blanket statements such as "we do not store any personal messages" would be wrong: depending on the feature, we store or process messages, transcripts or short chat context.
Voice AI: If you or administrators on a server use or activate the voice AI, voice data may be transmitted to Google (Gemini / Google AI) for processing — details in section 4.7.
Information about your own website account: Privacy Center. Data processing for server operators: DPA.
The following information fulfils the statutory information obligations (Art. 13(1)(a) GDPR).
Julius Zeeck (KynxStudios)
c/o COCENTER
Koppoldstr. 1
86551 Aichach
Deutschland
Contact: support@kynxbot.de
Second contact channel: Discord support server
As a matter of principle, we only process personal data of our users to the extent necessary to provide a functional website and our content and services. Depending on the purpose, we base the processing on a contract with you, on legal obligations, on our legitimate interest or – where necessary – on your consent. The applicable basis is stated in the individual sections.
Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis.
Where processing is necessary for the purposes of the legitimate interests pursued by our business or by a third party, and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
Where we are legally obliged to process personal data (e.g. retention under commercial or tax law), Art. 6(1)(c) GDPR serves as the legal basis.
Note: Information on individual processing operations, recipients and storage periods can be found in the following sections. This corresponds to the information obligations under Art. 13 and 14 GDPR.
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR.
Storage period: The web server's access logs are deleted automatically after 14 days. Application logs of the bot backend are rotated with a size limit, are usually overwritten after a few days and are deleted at the latest each time the service is redeployed; they do not contain passwords or plain-text tokens.
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
When you use our Discord bot, we process the following personal data:
For the bot to function, we store the following server configurations:
/privacy → "In Web-Bestenliste verbergen" (hide in web leaderboard): they are then shown without name, avatar and ID and cannot be searched. Members can also leave leveling entirely via an opt-out role defined by the server. At a server admin's request we import levels and XP from another bot: either from the server's public MEE6 leaderboard (we only send the server ID to MEE6) or from an export file uploaded by the admin. We only take over user ID, XP and level; we do not store the file itself. Before the import we create a backup that is deleted after 7 days.Important: The ticket system may contain private messages and sensitive information. We store:
Data protection: Ticket content and transcripts are stored in our database exclusively for the functionality of the ticket system and are displayed in the dashboard only to the administrators of the respective server. We (the operators of KynxBot) do not access them – our platform administrators have no special technical access either. Exception: the server owner explicitly grants us access in the dashboard (access list, e.g. for support) and can revoke it there at any time. They are deleted by the server administrator, together with the other server data 60 days after the bot is removed, or when the server owner arranges for the deletion of their server data (see 8.2).
The following overview replaces blanket statements. "Temporary" means: processing for the current request or session, without a permanent message archive on our side.
| Type of data | Raw data | Purpose | Location | Duration | Deletion |
|---|---|---|---|---|---|
| Website account / OAuth | Discord ID, name, avatar URL, e-mail (if provided by Discord), rank, login times | Login, dashboard, Premium status | PostgreSQL users |
Until account deletion | Profile → Account & data (after 21 days) / support |
| Session | Session cookie, Discord access token in the session | Keeping you logged in, loading the server list | Session store | Session lifetime | Logout; additionally Discord "Authorised Apps" |
| Server configuration | Guild/channel/role IDs, texts, images, feature toggles | Operating bot features | PostgreSQL | As long as the bot is on the server; thereafter 60 days | Kick the bot (deletion after 60 days) or owner in the profile |
| Tickets | Metadata, messages, forms, transcripts | Support on the respective server | PostgreSQL active_tickets, ticket_transcripts |
Until the server admin deletes them; at the latest 60 days after the bot is removed | Server admin |
| Moderation | Presets, cases and logs where activated | Kick, timeout, ban, mod panel | PostgreSQL | Until the admin deletes them; at the latest 60 days after the bot is removed | Dashboard |
| Leveling | User ID, XP, level, season XP, coins, quest/shop progress, season winners; for imports from other bots: user ID, XP, level (source: MEE6 or the admin's export file) | Ranks, quests, shop | PostgreSQL guild_member_xp and others |
Until reset; at the latest 60 days after the bot is removed | Dashboard / kick the bot |
| Bot assistant context | Up to 10 most recent channel messages | AI answer with context | Only temporarily to the model, off by default | Duration of the request | Switch off |
| Voice AI audio | Live voice stream | Understanding speech and responding | Streaming to Google Gemini; no audio archive on our side | Session | End the session |
| Voice AI chat / image | Message or image content | Reading aloud, summarising, explaining images | Temporarily to Google, off by default | Duration of the request | Opt-in off |
| API keys | Name, prefix, hash, scopes — no plain-text secret after creation | Server integrations | PostgreSQL | Until revoked | Dashboard "Revoke" |
| Whitelabel | Bot token and app profile, where connected | Own bot instead of the KynxBot brand | PostgreSQL (protected) | Until disconnected | Dashboard |
| Community showcase | Server name, icon, texts, votes, likes, invite, reports | Public directory, notice and action | PostgreSQL | Until publication is switched off or a report has been reviewed | Dashboard / report button |
| Logs | Error texts and IDs, no secrets | Operation and troubleshooting | Server logs | Web server 14 days; application logs rotated | Automatic |
| Cookies / localStorage | Consent, language, session; after login your Discord profile (the Discord access token stays on our server in your session; the browser only holds a placeholder); locally stored AI chat histories of the website (only in your browser); caches for channel lists and the last selected server, unpublished drafts (e.g. updates) and running assistant tasks (technically necessary, § 25(2) TDDDG) | Website functionality | Browser | Up to 365 days / session | Banner / browser |
The data is processed in order to:
Transparency notice: As the bot operator, authorised administrators have, for technical reasons, access to server configurations and settings stored via our bot.
Purpose limitation: This access takes place exclusively for the following purposes:
Access rules:
Ticket content – special protection: Ticket messages, conversations and transcripts are not visible to bot administrators. Although this data is logged for technical reasons (for transcripts), it is accessible exclusively to the server administrators who use the ticket system on their server. Bot administrators have no access to private ticket content.
Who is responsible? For bot data we distinguish two cases:
For our own purposes the following apply:
Discord is a platform operated by a US provider. In addition to us, the respective server administrators on each Discord server may also decide on their own responsibility on user data within their community (e.g. moderation, logs, tickets). Where you view or process personal data there, the notices of these administrators and the Discord Privacy Policy also apply.
For the technical platform we use via the bot, we refer to Discord's provisions. Depending on the data context, Discord may act as an independent (joint) controller or as a processor within the meaning of Art. 28 GDPR; details are set out in Discord's terms and privacy documents.
Between the server operator and us as the technical service provider, our standard data processing agreement (Art. 28 GDPR) applies. This is a functional role model, not an individual review certified by a lawyer.
We use professional hosting and IT service providers to provide the website, bot backend and database. Data may also be processed in third countries (in particular the USA); where no adequate level of data protection exists there, this takes place only on the basis of appropriate safeguards within the meaning of the GDPR (in particular EU Standard Contractual Clauses or – where applicable – participation in the EU-U.S. Data Privacy Framework).
/imagine, video, music): Prompts are sent to Pixazo (Appy Pie LLP, India). We do not share any personal data with providers with whom no data processing agreement exists: before sending, our server checks each prompt (pattern matching and a checking model from Google or Anthropic, with whom a data processing agreement exists) and removes names, mentions, contact details and similar information or rejects the request. The provider only receives the anonymised text without user or server identifiers. Images and videos you upload yourself are not transmitted to these providers, only content generated by the bot itself – and not even that if it was created from your own upload (e.g. an edited photo). For this purpose we only store a fingerprint (checksum) of such results for 90 days, no content. We do not store prompts for the check; we only log the result (e.g. "anonymised"). We do not use free substitute services. Depending on the settings, Google (Imagen, Veo) also generates images and videos; a data processing agreement exists with Google, and uploaded images may also be processed there for editing.We label images, videos and audio created or edited with AI as "KI-generiert" ("AI-generated") in the Discord embed. In image files, we additionally write a machine-readable notice into the metadata (EXIF), e.g. "KI-generiert (AI-generated) – KynxBot". We do not write any personal data (such as user or server IDs) into the file in this process. The bot assistant, help chat and voice AI are recognisable as AI (Art. 50 EU AI Act).
Transparency: During a session, the panel in the channel shows the fixed notice "AI is listening" (server operators cannot change it). Anyone who joins the voice channel during a running session also receives a short notice with a mention in the channel chat. Wake word mode: even if the AI only responds to its name, everything said in the channel is transmitted to the AI provider and recognised (transcribed) there – this is the only way it can hear its name. It only answers after the wake word.
Summary: The voice AI relies on Google's "Gemini Live" or Gemini voice models. In this process, conversation content from the Discord voice channel (speech or the audio data technically required for it) is transmitted from our bot backend to Google via the Gemini API (or comparable interfaces of the respective Google AI offering) so that speech can be recognised, processed and returned as an AI response (including synthetic speech output).
Data subjects are in particular Discord users who speak in the same voice channel during an active voice AI session or whose voice signal is technically processed as well. Server administrators decide whether and how the voice AI is used on their server; they may provide additional information to their community (e.g. rules, topics in channels).
We are the operator of the KynxBot service and process the data insofar as it flows through our system. Google processes the transmitted content within the framework of the Google AI service we use (in particular Gemini). Depending on the data context, Google may act as a further controller or within the framework of a processing or sub-processing relationship; Google's respective privacy notices apply in this regard:
In particular, voice/audio data, the metadata required for the technical operation of the AI conversation (e.g. session/model reference, timestamps) and a list of those present in the voice channel (display name, Discord username and Discord ID of the members present) are processed so that the AI can address people correctly and assign commands to the right person. The sole purpose is to provide the voice AI feature (understanding speech and generating AI responses in speech/text).
We do not store any permanent audio archive recordings of voice AI conversations that can be played back for the purpose of documenting recordings. However, system-specific short-term buffers or technically similar intermediate states during streaming cannot be ruled out.
When a session starts, the control panel and the control embed clearly indicate that the AI is listening. Chat reading and image analysis remain off by default and are only sent to Google after express opt-in.
Google may also process data outside the EU/EEA (in particular in the USA). In this case, a transfer only takes place if a level of protection meeting the requirements of the GDPR is ensured (e.g. through EU Standard Contractual Clauses, an adequacy decision or other safeguards provided for in Art. 46 GDPR), insofar as these are offered by the respective provider.
Where we operate voice AI as part of the bot services provided, the processing is based on:
The legal bases mentioned in section 4.5 may additionally apply to processing by Discord.
Note for community servers: Depending on how your server is set up, notices from the server management as well as additional consents or permissions may also be required to inform members; as the bot operator, we have no direct influence on this.
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system.
We currently do not use any advertising tracking or analytics cookies that profile you across different providers via the website. The following are used in particular:
The legal basis for technically necessary cookies or comparable local storage (including storing your preference regarding the notice banner) is Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG (storage of and access to strictly necessary information) or § 25(2) no. 2 TDDDG for the documented storage of consent/objection.
Where we use optional non-essential cookies or similar technologies, the legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25 TDDDG.
Your browser loads avatars, server icons and emojis directly from the Discord CDN (cdn.discordapp.com, Discord Inc., USA). On the pages for stream and content notifications it also loads profile and preview images directly from Twitch, YouTube (Google), TikTok and Kick. The respective provider receives your IP address and technical browser data; we do not pass on any further data. The legal basis is our legitimate interest in a complete display (Art. 6(1)(f) GDPR); you use Discord anyway for login. Placeholder images with initials are generated on our own server.
You can change your cookie settings at any time via the cookie banner that is displayed on your first visit to our website (if activated). You can also manage and delete cookies in your browser settings.
Your choice in the cookie banner is additionally stored locally in the browser (e.g. by means of localStorage) so that your setting persists. The legal basis for this technically necessary storage of your decision is Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG (storage of the user's objection or consent).
You can contact us via the e-mail address provided or via the contact form (no login). With the form, we send your name (optional), e-mail address, subject and message by e-mail via the mail server of our e-mail provider (prepaid-host.de, data processor) to our support mailbox; the message is not stored on the website. To prevent abuse, we briefly count submissions per IP address in memory (hashed, at most one hour). We keep the e-mails as long as necessary to handle them, business correspondence for up to 6 years (§ 257 HGB).
The legal basis for processing data transmitted by e-mail is generally Art. 6(1)(f) GDPR (legitimate interest in handling your enquiry). If the e-mail is aimed at concluding or performing a contract, Art. 6(1)(b) GDPR may additionally apply. Art. 6(1)(a) GDPR only applies if you expressly consent to processing that goes beyond the communication.
For paid services, we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). When paying, you are redirected to a Stripe payment page. There you enter your payment details (e.g. card details, IBAN), name, e-mail address and billing address directly with Stripe; we do not receive your full payment details.
We receive from Stripe: a customer ID, the payment status, purchased services and amounts, invoice numbers, the billing address and, where applicable, your VAT identification number. We link this data to your Discord ID in order to unlock the purchased services, display invoices to you in your profile and manage subscriptions.
Stripe also processes data on its own responsibility, for example for fraud prevention and to comply with legal obligations (German Money Laundering Act – Geldwäschegesetz). A transfer to Stripe, Inc. in the USA is possible; it takes place on the basis of the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses. Further information: stripe.com/de/privacy.
Stripe Managed Payments / Link as seller: Depending on the settings, Link (a company of the Stripe group) processes the purchase as the seller ("merchant of record"). In that case, Link additionally receives your billing address and your country in order to calculate and remit VAT, issue receipts and process refunds. Link acts on its own responsibility in this respect; the privacy notices of Link or Stripe apply (link.com/privacy). As described above, we only receive the status, amounts and customer ID.
Age and consent confirmation: In the order dialogue, you confirm that you are of legal age or that your parents consent. We store this confirmation together with the order (time, version of the General Terms and Conditions) so that we can prove it. No ID document or date of birth is requested.
Premium vouchers: If you buy a voucher, we store the code with your Discord ID as the purchaser so that you can find it again in your profile. When the code is redeemed, we store who redeemed it and when; as the purchaser, you only see that it has been redeemed, not by whom.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (obligations under tax and commercial law) and Art. 6(1)(f) GDPR (fraud prevention, proof of consents).
We send you e-mails that are necessary for the performance of your contract or for the use of your account: a welcome e-mail after your first login, order confirmation with invoice, payment and renewal confirmations, notices of failed payments and cancellation confirmations. For this, we use the e-mail address of your Discord account or the address you provide in your profile or when paying. We keep a delivery log (recipient, type of e-mail, time, delivery status) in order to be able to trace delivery problems.
The e-mails are sent via the mail server of our e-mail provider prepaid-host.de, with whom a data processing agreement is in place. Legal basis: Art. 6(1)(b) GDPR; for the welcome e-mail and the delivery log, Art. 6(1)(f) GDPR (legitimate interest in functioning communication).
We only send news and announcements if you expressly subscribe to them (Art. 6(1)(a) GDPR). We use the double opt-in procedure: after signing up, you receive an e-mail with a confirmation link; only then are you subscribed. As proof of your consent, we store the time of sign-up and confirmation as well as your IP address in pseudonymised (cryptographically hashed) form. You can unsubscribe from the newsletter at any time via the link in every e-mail or in your profile; your consent is then deemed withdrawn with effect for the future. After you unsubscribe, we keep your address on a suppression list for up to three years in order to be able to prove that consent was given (Art. 6(1)(f) GDPR).
Children and young people: To subscribe to the newsletter you must be at least 16 years old or have your parents' consent (Art. 8 GDPR); you confirm this when subscribing. The same applies to purchases (confirmation in the order dialog). Discord's own age limits apply to the use of Discord itself.
If you submit a cancellation via "Verträge hier kündigen" ("Cancel contracts here"), we store the information from the form (name, e-mail, contract, type of cancellation, requested date, message) and the time of receipt in order to carry out the cancellation and confirm receipt to you (Art. 6(1)(b) and (c) GDPR, § 312k BGB – German Civil Code).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation – e.g. by e-mail to support@kynxbot.de, in the Privacy Center or in Discord with /privacy. We will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You may object to receiving newsletters at any time without giving reasons.
Source of the data (Art. 14 GDPR): We receive data of server members who do not use our website (e.g. Discord ID, name, roles, messages to the bot) from Discord when the bot is used on a server. After login, we receive your profile and server list from Discord.
Obligation to provide data (Art. 13(2)(e) GDPR): You are not obliged by law or contract to provide us with data. Without the Discord login we cannot offer you the dashboard; without an e-mail address we cannot send invoices or newsletters; without the data that Discord transmits to the bot, bot features cannot be used on a server.
Every data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed.
Every data subject affected by the processing of personal data has the right to obtain from the controller, at any time and free of charge, information about the personal data stored about them. For your own website account, the Privacy Center is available – there you can download all data stored for your Discord ID in machine-readable form via "Vollständige Datenkopie (JSON)" ("full data copy"; Art. 15(3), Art. 20 GDPR; credentials such as tokens excluded). The complete inventory of all types of data can be found in section 4.1.5.
Every data subject affected by the processing of personal data has the right to obtain the rectification without undue delay of inaccurate personal data concerning them.
Every data subject affected by the processing of personal data has the right to obtain from the controller the erasure of personal data concerning them without undue delay.
Deletion of bot data: You can submit a request directly in Discord with the /privacy command (available on every server with KynxBot – even without a website account; it shows what is stored about you, provides a full data copy at the push of a button and informs the server operator about a deletion request), in the Privacy Center, via our Discord support server or by e-mail to support@kynxbot.de. You can delete your account yourself in your profile under "Konto & Daten" ("Account & data") (carried out after 21 days, can be cancelled until then). Server configurations and ticket transcripts of a community server are deleted by the respective server administrator; after the bot is removed, they are deleted automatically after 60 days.
Every data subject affected by the processing of personal data has the right to obtain from the controller restriction of processing.
Every data subject affected by the processing of personal data has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format.
Every data subject affected by the processing of personal data has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them.
Every data subject affected by the processing of personal data has the right to withdraw consent to the processing of personal data at any time.
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR).
The authority competent for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.
We do not carry out solely automated decision-making within the meaning of Art. 22 GDPR (including profiling) that produces legal effects concerning you or similarly significantly affects you.
During your visit to the website, we use transport encryption via TLS (Transport Layer Security) in conjunction with the highest level of encryption supported by your browser.
We use the following technical measures to protect your data:
We only store your data for as long as is necessary to provide the services or as required by statutory retention obligations:
This Privacy Policy is currently valid and was last updated in November 2026. Due to the further development of our website and services or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy.
Last updated: November 2026