Privacy
Last updated: May 2026
This Privacy Policy transparently describes what data Valiente processes to deliver its features (music, moderation, leveling, economy, and web dashboard). We guarantee that no personal data is ever sold or rented to third parties.
1. Data Collected & Purposes
All persistent data is hosted in MongoDB Atlas with encryption at rest (AES-256) and TLS in transit.
| Category | Data Processed | Purpose (Legal Basis) |
|---|---|---|
| Discord Identity | Discord User ID, Discord Guild ID | Associate settings, levels, and inventory to the correct account without storing passwords or emails. |
| Leveling & XP | XP count, Level, message activity timestamp | Render rank cards (/rank), calculate server leaderboards, and award role rewards. |
| Economy | Wallet balance, bank balance, inventory items, command cooldowns | Power server mini-game features (daily, work, shop, blackjack, gambling). |
| Achievements & Badges | Stats counters (messages, voice minutes, reactions, unlocked achievements) | Compute achievement criteria and track tier progress. |
| Birthdays | Day and month of birth (year optional) | Send automated birthday celebration messages on the configured channel. |
| Moderation & Logs | Mod logs (warn reason, moderator ID, timestamp, ban history) | Maintain server discipline and provide audit trails for staff. |
| Support Tickets | Ticket channel ID, creator ID, status, optional HTML transcript | Facilitate private member-to-staff support within the server. |
| Guild Configuration | Channel IDs (logs, welcome), Role IDs (autoroles), enabled module flags | Store administrator preferences for module behavior. |
| Web Dashboard Sessions | Encrypted session token containing Discord user ID (14-day expiry) | Authenticate users securely on the web dashboard via Discord OAuth2. |
2. Third-Party Integrations
Valiente connects to the following external APIs solely to provide core features:
- Discord API: Core messaging, guild administration, and OAuth2 login.
- MongoDB Atlas: Encrypted database hosting with strict network isolation.
- Public Music Sources: Audio stream resolution with no listener data transmitted.
- GamerPower API: Public promotional gaming feed without user data sharing.
- Top.gg & Bot Lists: Inbound vote webhooks to award in-game currency.
- Cloudflare: Edge reverse proxy, anti-DDoS, and TLS termination.
3. Security Measures
We implement robust security controls to ensure data integrity and confidentiality:
- HTTPS / TLS Encryption: All web traffic is strictly encrypted in transit using TLS 1.2+.
- Strict Access Control: Dashboard server management strictly enforces Administrator or Manage Server permissions.
- Abuse Protection: Aggressive rate limiting and hardened Helmet.js CSP headers.
- Secret Management: All credentials and API tokens reside exclusively in encrypted environment variables.
4. Data Retention
- Active Data: Retained as long as the bot remains on the server or the account is active.
- Web Sessions: Automatically invalidated and purged after 14 days of inactivity.
- Deletion on Request: All server and user records are permanently purged within 30 days upon request.
5. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR - EU 2016/679), you possess the following rights:
- Right of Access: You may request a machine-readable export of all data stored about you.
- Right to Rectification: You may correct inaccurate records (e.g., updating birthday information).
- Right to Erasure (Forget Me): You can demand permanent deletion of your data from our database.
- Right to Object: Server administrators can disable specific data collection modules at any time.
All privacy requests are processed within a maximum of 30 calendar days.
6. Contact & Support
For any privacy-related inquiry or to exercise your GDPR rights, contact us at:
- Email : [email protected]
- Discord Support : discord.gg/V6fR2RKgU4