Legal
Privacy Policy
Effective:
AI Ticket Bot (“we”, “us”, “our”) is a Discord ticket bot and dashboard. This policy explains what data we collect, what we do with it, and what we never do with it.
We do not sell your data. We do not train external models on it.
1. Who is responsible for your data
AI Ticket Bot is currently operated as an independent project by a sole operator based in Romania. The operator acts as the data controller for personal data processed through the bot, the dashboard, and the marketing site. The operator is contactable at the email addresses below; postal address will be published when a registered legal entity is incorporated, and this section will be updated accordingly.
For privacy questions, data-rights requests, or any concern about how your data is handled, contact us at [email protected] (preferred for support and data-rights) or [email protected] (legal notices, business matters).
2. Data we collect
When you sign in via Discord
We authenticate you with Discord OAuth. Discord returns to us:
- Your public Discord user ID, username, display name, and avatar hash.
- A short-lived access token used solely to fetch the list of Discord servers where you have admin permissions, so we can show them in the dashboard.
We do not receive or store your Discord email, phone number, or password. We do not receive a list of every server you are a member of, only those where the Discord API tells us you have administrative scope.
Server configuration
When a server admin uses the bot, we store the configuration they create: panels, categories, tags, permission rules, embeds, blacklist entries, and audit-log rows that record administrative actions for accountability.
Ticket content and brain data
When a ticket is opened, we store the conversation transcript so server staff can review it, the AI can refer to it, and a human can audit it later. Transcripts shared through this site are reachable only via tokenized links and only after signing in as the person who opened the ticket or as the server’s staff; they are never publicly listed.
When your staff teaches the bot something with /ai train (the “brain”), the input is sent once to Anthropic’s API, which rewrites it into a normalized, structured form that the AI can use efficiently on later tickets. Only the rewritten, structured form is stored on our infrastructure; the original wording your staff typed is not retained. This is how brain knowledge persists across tickets without us holding raw staff training text.
Brain content and ticket transcripts sit on our own infrastructure. Anthropic sees ticket content at inference time and training input at the moment of the rewrite, both on a per-request basis with no retention on Anthropic’s side. Nothing is sent to OpenAI, Google, or any other AI provider.
Website chat widget visitors
On Premium plans and up, a server owner can embed our chat widget on their own website. When a visitor sends a message, the AI answers it, and if a human is needed the chat hands off to the server’s staff, in a private Discord thread or the dashboard. A web chat is handled as a real support ticket, so the same rules as any other ticket apply (see the ticket and AI sections above): the conversation is stored while it is open, a transcript may be saved when it closes, and it follows the server’s retention and deletion settings.
This site stores nothing about a widget conversation. Your browser keeps only a pointer to the chat (a reference id and a random, non-identifying session id) and a local copy of the visible history, on the website you are visiting. The conversation itself, and any transcript, live with the ticket, keyed to that session id. You can wipe the local copy at any time from the widget’s settings menu, and ask us to erase the stored conversation the same way.
The widget is anonymous by default and sets no advertising or tracking cookies. A server owner may optionally turn on “Sign in with Discord”, which lets a visitor sign in to keep their own chat history and lets the server’s staff see who they are; it is never required to use the widget. A visitor may also leave an optional email or handle so the team can follow up. We send no email from the widget, and use the contact only to reach back about that conversation.
Billing data
If you subscribe to a paid plan or buy a token pack, the payment processor (Stripe for card and bank-transfer payments, NOWPayments for cryptocurrency) handles your payment details. We never see your full card number or wallet private key. We do receive and store the customer ID, plan code, subscription state, last-four of the card brand, invoice IDs, and the country we determined for VAT purposes once VAT registration is in place.
Usage and analytics
On the public marketing site (aiticketbot.com) we use Google Analytics 4, and only after you grant Analytics consent through the cookie banner. We do not run analytics on the dashboard or inside the bot.
3. Where AI fits in (NEXUS and Anthropic)
Our AI commitment
Anthropic’s API touches your content in two situations, both per-request and with no retention on Anthropic’s side:
- At inference time. When a ticket is open, the conversation and the relevant brain entries are sent to Anthropic so the model can generate a reply.
- At training time. When your staff runs /ai train, their raw input is sent once to Anthropic to be rewritten into the normalized brain entry we store. We do not retain the staff’s original wording.
We use Anthropic’s standard API with the default no-training posture: Anthropic does not retain content from API traffic and does not use it to train their models. We do not send your data to OpenAI, Google, Microsoft, Meta, or any other AI provider. The only model provider we route inference through is Anthropic.
4. Who else handles your data (sub-processors)
We rely on a small set of trusted sub-processors to operate the service. Each is listed below with its role, region, and own privacy policy. If we add a new sub-processor that processes user content, we will update this list before the change takes effect.
| Provider | Role | Region |
|---|---|---|
| Anthropic | AI model inference (via NEXUS). Processes message contents to generate responses. | United States |
| Hetzner Online GmbH | Hosting and database storage for the bot, dashboard, and NEXUS infrastructure. | European Union (Germany / Finland) |
| Cloudflare | CDN, DDoS protection, and DNS for the marketing site and API. | Global (EU edge nodes serve EU traffic) |
| Stripe | Card and bank-transfer payment processing for plan subscriptions and token packs. | European Union (Ireland) for EU customers |
| NOWPayments | Cryptocurrency payment processing for plan subscriptions and token packs. | European Union |
| Discord | Identity provider via OAuth. Bot platform. We receive only your public Discord ID, username, avatar, and the list of servers where you have admin rights. | United States |
| Google Analytics | Aggregate marketing-site traffic analytics. Only loaded if you grant Analytics consent. | European Union (Google Ireland) |
Where data is transferred outside the EEA (notably to Anthropic and Discord, both in the United States), the transfer is covered by the EU Standard Contractual Clauses included in those providers’ data-processing terms.
5. How long we keep data
We keep data only as long as we need it to operate the service or to comply with a legal obligation.
| Data | Free | Premium | Pro | Enterprise |
|---|---|---|---|---|
| Ticket transcripts | 90 days | 730 days | 730 days | 730 days |
- Bot removal from a server: when the bot is removed from a Discord server, all data associated with that server (panels, transcripts, brain content, blacklist entries, audit log rows tied to that server) is permanently deleted within 48 hours. The 48-hour window exists so an accidental kick can be reversed if you re-add the bot, but is not a retention promise: once the window closes, the data is gone.
- Account data: kept while your account exists. On account deletion, your identifying records are removed within 48 hours; see “Your rights” below.
- Audit logs: retained for up to 12 months for accountability, then purged. The dashboard’s “all time” audit view therefore shows at most this window.
- Ticket feedback ratings: the 1 to 5 star ratings and notes members leave when a ticket closes are retained for up to 24 months, then purged.
- Statistics and staff activity: the per-staff contribution data behind the dashboard’s statistics and leaderboard is retained for up to 24 months, then purged. Where the dashboard offers an “all time” range, it reflects at most the data still within these retention windows, not the entire history of the server.
- Billing records: retained for the period our tax obligations require (typically 5 years in Romania) for audit and accounting. Anonymized after the retention period ends.
- Marketing analytics: per Google Analytics 4 defaults, up to 13 months.
6. Your rights
Under the GDPR and equivalent laws, you have the right to:
- Access the personal data we hold about you.
- Have inaccurate or incomplete data corrected.
- Have your data deleted (the “right to be forgotten”).
- Restrict or object to certain processing.
- Export your data in a structured, portable format.
- Withdraw consent for analytics at any time through the cookie banner.
- Lodge a complaint with a supervisory authority. In Romania this is ANSPDCP; in any EU country you may use your local authority.
Logged-in users can self-serve export and deletion from Account settings in the dashboard. Both run immediately: the export includes your complete AI conversation history, and deletion permanently erases it (your id becomes a pseudonym and message content becomes unreadable) along with everything this site holds about you. Records we are legally required to keep (billing, up to 5 years) or need to prevent reward abuse (your vote and reward history, so an already-claimed reward cannot be claimed again) are retained. One honest caveat: facts a server’s staff taught their bot’s AI brain are that server’s knowledge base, not a per-user record; if one contains your personal data, ask the server’s staff to remove it or email us. For anything else the self-serve flow does not cover, email [email protected] from the address on file or from a Discord-verifiable channel and we will respond within 30 days, as required by law.
7. Cookies
We use cookies to make the site work and, only with your permission, to understand which pages help people the most. Full details, including a per-cookie table, live on the cookie policy page. You can change your choice at any time from that page.
8. Security
We protect data with HTTPS in transit, encrypted storage for sensitive configuration (webhook URLs, OAuth tokens), strict access controls on production infrastructure, and rate-limited API endpoints. No method of transmission or storage is 100 % secure; if we ever become aware of a breach affecting your personal data, we will notify affected users without undue delay and inform supervisory authorities as required by Article 33 of the GDPR.
9. Children
AI Ticket Bot is not directed at children under 13. Discord’s own Terms of Service require users to be at least 13 years old (or older where local law requires). If we learn we have collected data from a child under 13, we delete it.
10. Changes to this policy
We update this policy when the service changes in a way that affects how data is handled. The effective date at the top of this page reflects the last update. Material changes are surfaced via a dashboard notification and a re-prompt of the cookie banner where relevant. Continued use after the effective date constitutes acceptance.
11. Contact
For privacy questions, data-rights requests, or anything related to this policy:
- [email protected] for support and data-rights requests
- [email protected] for legal notices and business matters