Privacy Policy

This Privacy Policy describes how HurixBot ("we") collects, uses, and protects the personal data of users of the Discord bot and the dashboard available at https://hurix.xyz.

We comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") as well as the French Data Protection Act (Informatique et Libertés) of January 6, 1978, as amended. We act as the data controller for the data described below.

We strictly limit collection to the data necessary for the operation of the Service. The information processed is:

• Discord identifiers: user ID, username, discriminator, avatar, locale (provided by Discord OAuth2 when connecting to the dashboard);
• Server identifiers: ID, name, icon, and the list of permissions of the connected user;
• Module configuration: settings chosen by administrators (channels, roles, messages, eligibility conditions, etc.);
• Activity data: XP, voice statistics, giveaway entries, opened tickets, transcripts, audit logs;
• Cookies and sessions: a session identifier (the hurixbot.sid cookie), HTTP-only encrypted, required to maintain your connection to the dashboard;
• Technical data: IP address, user-agent, request timestamps, retained for security and abuse-prevention purposes.
• Audience measurement data: pages viewed and time spent, referring website and campaign, device type, browser, operating system, language and country, linked to an anonymous per-tab identifier; clicks on the bot invitation, a Discord server or an external website, and opening of the checkout window;
• Contact form: the name, email address, subject, and message you send us, as well as your IP address at the time of submission, recorded for security and abuse-prevention purposes (spam, fraudulent use of the form).
• Third-party service credentials: the Pterodactyl API key and connection details you voluntarily provide to link a game server, stored encrypted;
• Subusers: the Discord ID, name, avatar, and delegated permissions of members that a manager adds to share access to their server's dashboard;
• Custom bot token: when you create a custom bot (Premium), the token of the Discord application you provide, stored encrypted, never displayed in clear text, and used solely to host and run your bot;
• Subscription data: the buyer's Discord ID, the server concerned, offer, billing period, amount, the subscription reference at Tebex or the order and payment references at PayPal, status and due date. Payment notifications sent by Tebex or PayPal are only used to update this information; we neither receive nor store your card details;
• Server forms: answers entered in a form published by a server, submission date, Discord account (ID, name, avatar) if you were logged in, and an irreversible hash of your IP address, used against abuse;
• Form reports: reason, details you enter, Discord ID if you are logged in, and an irreversible hash of your IP address;
• Server automations: ID and name of the member an automation concerns, content of the message that triggered it during a pending wait, variables the server stores for that member, and the run log;

We do not collect the content of users' private messages and do not process any Discord message outside of the features explicitly enabled (commands, ticket transcripts, anti-spam, etc.).

Your data is processed for the following purposes:

• Performance of the Service (commands, modules, dashboard) — legal basis: performance of a contract (art. 6(1)(b) GDPR);
• Authentication and security (OAuth sessions, rate-limiting, audit) — legal basis: legitimate interest (art. 6(1)(f));
• Moderation of forms published by servers (reviewing reports, fighting phishing and abuse) — legal basis: legitimate interest (art. 6.1.f);
• Running the automations set up by servers and fighting spam (quotas, suspending abusive scenarios) — legal basis: legitimate interest (Art. 6.1.f);
• Premium subscription management (activation, renewal, cancellation) — legal basis: performance of a contract and legal accounting obligations;
• User support (messages sent via the contact form) — legal basis: legitimate interest;
• Audience measurement and improvement of the Service (aggregated traffic statistics) — legal basis: legitimate interest (art. 6.1.f) for our anonymous internal measurement, which you can object to at any time; consent (art. 6.1.a) for Vercel Web Analytics, which can be withdrawn at any time.

• Module configuration: retained as long as the bot is present on the server, then deleted within a maximum of 30 days after its removal;
• Activity data (XP, logs, tickets): retained for a rolling 12 months, unless an early deletion is requested by the server administrator;
• OAuth sessions: a maximum of 7 days from the last activity;
• Technical security data: 6 months;
• Audience measurement data: 25 months maximum for our internal statistics; the fingerprint used by Vercel Web Analytics is renewed every 24 hours;
• Third-party service credentials: retained as long as the link exists; deleted when you remove the key, delete the linked game server, or remove the bot;
• Subusers: retained until the subuser is removed or the bot leaves the server;
• Custom bot token: retained as long as the custom bot exists, including when it is stopped at the end of a subscription; permanently deleted when you delete the bot;
• Answers to server forms: kept until the server deletes them (answer or form), or until we delete them in case of abuse or a justified request;
• Form reports: 12 months at most, and deleted along with the form concerned;
• Automations: run log for at most 30 days (5,000 lines per server), pending waits for at most 7 days, variables for 180 days after their last change;
• Subscription data: for the duration of the subscription, then 10 years, in accordance with legal accounting obligations. Orders whose payment was abandoned are erased after 7 days.

Your data is neither sold, rented, nor transferred to third parties for commercial purposes. It may, however, be processed by our technical processors, strictly governed by agreements compliant with article 28 of the GDPR:

• Discord Inc. (United States) — provision of the Discord platform and API;
• LordHosting (France) — hosting of the site, API, bot and database;
• Vercel Inc. (United States) — audience measurement (Vercel Web Analytics), only if you have accepted it;
• Cloudflare, Inc. (United States) — securing and routing the site's traffic;
• Tebex Limited (United Kingdom) — seller of Premium subscriptions and independent data controller for the data you provide at checkout (identity, email, billing address, payment data, IP address), under its privacy policy;
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — processing of payments made through PayPal and independent data controller for the data you provide at checkout (identity, email, address, payment data, IP address), under its privacy statement;
• Your Pterodactyl panel (a third party you voluntarily connect) — receives the console and power commands you initiate from the dashboard.

Transfers outside the European Union are governed by the EU–US Data Privacy Framework where the recipient is certified under it, or otherwise by the European Commission's Standard Contractual Clauses.

Data sent to Tebex is processed in the United Kingdom, a country covered by a European Commission adequacy decision. Tebex may use providers located in other countries, under the safeguards described in its privacy policy.

PayPal (Europe) is established in Luxembourg, in the European Union. It may have some data processed by other PayPal group companies located outside the European Union, under the safeguards described in its privacy statement.

The Custom Bot feature lets you host, on our infrastructure, a Discord bot that you own, using the token you provide. For the data that this bot processes on your server (messages, members, activity), you act as the data controller and we act as the processor within the meaning of article 28 of the GDPR, hosting and running the bot on your behalf and according to your instructions.

You are responsible for the lawfulness of the processing carried out by your custom bot, for informing your members, and for respecting their rights. We process this data solely to host and operate your bot, without using it for any other purpose.

Discord servers can publish forms on our website. For the answers collected, the server publishing the form acts as data controller and we act as data processor within the meaning of Article 28 of the GDPR: we host these answers and make them available to the server, without using them for any other purpose.

The server chooses the questions and how the answers are used, and must inform the people concerned. It can also have answers sent to a Discord channel of its choice. To exercise your rights over your answers, contact the server concerned first; if you get no reply, contact us. Never share a password, token or sensitive data in a form.

For handling reports and moderating forms, we act as data controller. We may close or delete an abusive form.

Discord servers can create automations that react to their members' activity. For this data, the server that sets up the automation acts as data controller and we act as processor within the meaning of Article 28 GDPR.

We keep this data only to run the scenarios, show the server their log and limit spam. To exercise your rights, first contact the administrators of the server concerned, or contact us.

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Right of access to the data concerning you;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure ("right to be forgotten");
• Right to restriction of processing;
• Right to portability of your data in a structured format;
• Right to object to processing based on legitimate interest;
• Right to set directives regarding the fate of your data after your death.

To exercise these rights, contact us at privacy@hurix.xyz, enclosing proof of identity if necessary. We respond within a maximum of one month.

For data held by Tebex, contact support@tebex.io directly.

For data held by PayPal, contact PayPal directly through its help center.

If you believe that your rights are not being respected, you may lodge a complaint with the CNIL.

We implement appropriate technical and organizational measures to protect your data against loss, theft, disclosure, or unauthorized alteration, including:

• TLS encryption of all communications;
• Storage of sessions via HttpOnly, Secure, and SameSite cookies;
• Hashing and encryption at rest of sensitive data;
• Encryption at rest (AES-256-GCM) of third-party service credentials (Pterodactyl API key) and custom bot tokens;
• Strict access control to databases, logging of administrator access;
• Daily encrypted backups with a 30-day rotation.

In the event of a data breach likely to create a risk to your rights and freedoms, we undertake to notify the CNIL within 72 hours and, where applicable, the data subjects concerned.

The Service is intended for users at least 13 years old, in accordance with Discord's Terms of Service (or the minimum age required in your country of residence). We do not knowingly collect data concerning children below this age. If you believe that a minor has provided us with personal data, contact us so that we can proceed with its deletion.

In accordance with article 82 of the French Data Protection Act (Informatique et Libertés) and the CNIL's recommendations, we distinguish two categories of cookies and trackers:

• Strictly necessary cookies (exempt from consent): the encrypted HttpOnly OAuth session cookie (hurixbot.sid), the anti-CSRF token, and the storage of your display theme and your consent choice. They are essential to the operation of the Service and are placed without prior consent.
• Internal audience measurement (exempt from consent, under the conditions set by the CNIL): a random identifier (stored in sessionStorage, deleted when the tab is closed) links the pages of a single visit. No IP address is kept (only the country is derived from it), identifiers in page URLs are masked, and these statistics are used by Hurix only: they are never combined with your account or any other data, nor shared. You can object with the button below.
• Vercel Web Analytics (subject to consent): an audience measurement service provided by Vercel Inc. that uses no cookies and stores nothing on your device. Visitors are distinguished by a non-reversible fingerprint computed from the request and renewed every 24 hours. URL parameters are stripped before sending, and we only receive aggregated statistics.
• Tebex payment window: when the purchase window opens, a script is loaded from Tebex's servers, which sends them your IP address. Trackers used during payment are covered by Tebex's privacy policy.
• PayPal payment: no PayPal script is loaded on our site; to pay, you are redirected to PayPal's website. Trackers used on PayPal's pages are covered by its privacy statement.

On your first visit, a banner allows you to accept or decline trackers subject to consent (Vercel Web Analytics), with equal ease in both cases. In the absence of a choice, no tracker subject to consent is placed. You can modify or withdraw your consent at any time via the "Cookie preferences" link at the bottom of each page. Your choice is retained for a maximum of 6 months.

This Privacy Policy may be updated to reflect legal, technical, or functional developments. The applicable version is always the one published on this page. In the event of a substantial change, we will inform you by a message on the dashboard or on our official Discord server.

For any question regarding this Policy or the management of your personal data, you may contact us:

• By email: privacy@hurix.xyz
• Through our contact form