Effective date and last updated: November 6, 2026
SAC Bot is a Discord moderation bot with a web dashboard. We collect only the data needed to operate it: Discord identifiers, server configuration, activity logs and security data. Optional website analytics are used only after consent. When you explicitly use an AI assistant, the submitted question or selected support text is sent to OpenRouter and its selected AI model provider to generate a response. Do not include passwords, tokens, or authentication codes. We do not sell personal data. You can request access to, correction of, or deletion of your data at any time using the contact details in Section 15. This summary is provided for convenience and does not replace the full policy below.
This Privacy Policy explains how SAC Bot ("SAC Bot", "we", "our", or "us") collects, uses, stores, and protects personal data when you use our Discord bot and web dashboard (together, the "Service"). It applies to server members whose data is processed by the bot, to server administrators who configure it, and to users who sign in to the dashboard.
The Service is also subject to the Discord Privacy Policy, the Discord Terms of Service, and the Discord Developer Policy. By using the Service you acknowledge this policy.
SAC Bot is operated by SAC Bot by Eyal Eng ("we", "us", or "our"). For data processed on our own behalf, such as dashboard authentication and security logs, we act as the data controller. For moderation data processed on behalf of a Discord server, we generally act as a data processor (see Section 5).
Privacy contact: legal@mail.sac-bot.is-a.bot
To enforce moderation rules, the bot may receive the content of messages sent in servers where it is installed. Message content is processed only to the extent needed to apply the rules configured by the server and is not used for advertising or profiling. Where a moderation event is logged, the log may include limited information about the message that triggered it.
When you sign in to the dashboard through Discord OAuth, we collect session tokens, authentication timestamps, and IP addresses. For website support, Discord OAuth also requests access to your server list so you can select a server without entering its ID. The list is held in your browser session and in a signed, short-lived support session for selection verification; we store only the server you select with the resulting support ticket, not your full server list. Support tickets may also contain your messages, an optional post-resolution rating and comment, and staff-only operational notes or abuse reports. The bot may send you Discord direct messages about support events such as ticket receipt, a staff member joining, a new reply, or a status change; these messages can include the ticket subject and relevant reply or resolution text, and always include a link to the website support chat. Delivery status and retry metadata are stored with the support notification record. If Discord does not allow direct messages, the website support action remains available and staff are shown a delivery warning. We use these records to provide support, review service quality, and prevent misuse. A light/dark display preference may be saved in your browser storage. We use this information for the stated support and security purposes only.
For authorized staff, the website stores work assignments, internal suggestions and comments, and an audit log of staff actions. These records can include Discord user IDs, staff names, reasons, review notes, and timestamps. Authorized staff may review support messages and evidence to answer a request, investigate a reported service issue, or review an appeal. Staff-initiated direct-message audit entries record the recipient ID and staff action, but not the message body.
If you apply to volunteer with the SAC Bot team, Discord OAuth is used to verify your Discord account, account creation date, and membership in our support server. The eligibility check also searches for bot-access restrictions, support-access blocks, currently active restrictions or blocks, and data-deletion requests from the previous two years. A keyed, pseudonymous fingerprint of a data-deletion request is included in audit history so a request can still be detected after its operational record is anonymized; the eligibility check only matches requests from the previous two years, and the fingerprint does not disclose the request's contents. Fingerprint retention follows the staff audit-log retention described below. These checks are available to authorized managers for safeguarding review. A data-deletion request alone is not misconduct and does not automatically disqualify an applicant. Your answers, Discord user ID, application ID, eligibility snapshot, consent confirmations, review status, and staff review notes are stored in our shared staff database and may be sent through configured staff-operation notifications. Applications are reviewed by authorized managers. The role is unpaid and applying does not guarantee acceptance. Write your answers yourself without AI-generated or third-party-written responses. Do not include passwords, authentication codes, or other people's sensitive information.
When optional public-site analytics are enabled and you consent, Google Analytics 4 may process page views, referring pages, browser, operating-system and device categories, approximate region, and analytics cookie or online identifiers. It is not linked to Discord account identifiers by our analytics code.
We do not intentionally collect passwords, payment card details, or government identification, and we do not collect data unrelated to the operation of the Service.
Where the GDPR or similar laws apply, we rely on the following legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the bot and enforcing server moderation rules | Discord data, server data, message content | Performance of a contract; legitimate interests of server administrators and members in a safe community |
| Dashboard sign-in and access control | Authentication data | Performance of a contract |
| Website support and service feedback | Support messages, selected server, optional rating and comment | Performance of a contract; legitimate interests in service quality and abuse prevention |
| Optional public-site analytics | Page views and broad browser, operating system, and device categories; no name, Discord ID, or advertising profile | Consent |
| Security, fraud and abuse prevention | IP addresses, logs, session data | Legitimate interests |
| Improving and maintaining the Service; aggregated statistics | Usage data, logs | Legitimate interests |
| Compliance with legal obligations and legal claims | Any relevant data | Legal obligation; legitimate interests |
| Non-essential cookies, if any are used | Cookie data | Consent |
Statistics we publish are aggregated so that individuals cannot reasonably be identified. We do not use personal data to make decisions that produce legal or similarly significant effects on you, other than the automated moderation actions that a server administrator has configured (see Section 5).
Server administrators decide which moderation rules the bot applies and are responsible for informing their members and having a lawful basis for that moderation. Automated actions such as warnings, mutes, or bans are triggered by rules configured by the server. If you believe an automated action was mistaken, please contact the moderators of that server, who can review and reverse it. You may also contact us at the address in Section 14.
We keep personal data only for as long as necessary for the purposes described in this policy.
| Data | Retention period |
|---|---|
| Server configuration and moderation settings | While the bot is installed, and up to 30 days after it is removed |
| Bot activity and moderation logs | Up to 90 days, unless a shorter period is configured by the server |
| Session tokens | Until the session expires or you sign out |
| IP addresses and security logs | Up to 30 days |
| Optional Google Analytics 4 data | Event-level retention is controlled by the Google Analytics property (2 months by default); aggregate reports may be retained longer. Analytics cookies expire according to the property's configuration. |
| Website support requests, chats, ratings, uploaded support evidence and Discord DM notification records | Retained while needed for support operations, accountability, and dispute review. An approved account-data deletion request removes and verifies exact matching records in the bot's operational document and guild-data stores, including messages and uploaded evidence attached to the user's support conversations. Internal staff backup archives are also scrubbed and verified. Separate legal, abuse-prevention, audit, provider, or staff-created export records may be retained or require separate handling. |
| Staff workspace records and audit entries | Retained while needed for team operations, accountability, and dispute review; no automatic deletion schedule is currently configured |
| Volunteer staff applications and review history | Retained while needed for recruitment, team operations, and accountability; contact support to request review or deletion |
| Pseudonymous data-deletion-request history fingerprint | Retained in staff audit logs and internal backup-verification receipts; eligibility checks only match requests from the previous two years, and the fingerprint contains neither the request reason nor the Discord ID |
| Staff activity and Discord webhook delivery records | Retained while needed for team operations and troubleshooting; records contain limited action metadata and delivery status, not support message contents |
We may retain data for longer where required by law or to establish, exercise, or defend legal claims. Data is deleted or irreversibly anonymized when the applicable period ends.
To request deletion, open a private support request under “Request deletion of my data.” A specialist will discuss the request with you. If an approval request is sent, you must approve it in the Discord direct message before any deletion begins. Processing is scheduled no earlier than 30 days after that approval request is sent; you may cancel it before processing starts. We send reminders before the scheduled date and a completion notice after verifying that no matching records or support-evidence objects remain in the covered operational stores and internal staff backup archives. This process does not remove data held by Discord, external providers, or separate exports, and it does not override records we must retain by law.
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We disclose data only in these circumstances:
Our providers may process data in countries other than your own, including outside the European Economic Area and the United Kingdom. Where required, we rely on appropriate safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses.
We apply technical and organizational measures designed to protect personal data, including:
No system is completely secure. If a personal data breach occurs that is likely to result in risk to you, we will notify the competent authority and affected users without undue delay and as required by applicable law.
Depending on where you live, you may have the right to:
To exercise these rights, email legal@mail.sac-bot.is-a.bot or contact us through our Discord server. Please include your Discord User ID so we can locate your data. We may need to verify your identity, and we aim to respond within 30 days. Objecting to or restricting certain processing may limit your ability to use parts of the Service.
California residents. Under the CCPA/CPRA you may request to know, delete, or correct your personal information. We do not sell or share personal information as those terms are defined by that law, and we will not discriminate against you for exercising your rights.
Israel. If Israeli privacy law applies (Protection of Privacy Law, 5741-1981), you have the right to request access to, correction of, or deletion of your personal data (Sections 13 and 14 of the law). To exercise these rights, email legal@mail.sac-bot.is-a.bot or contact us through our Discord server. Please include your Discord User ID so we can locate your data. We may need to verify your identity, and we aim to respond within 30 days. We will handle your request in accordance with Israeli privacy law and applicable regulations.
The public site uses a consent-gated Google Analytics 4 integration to measure page views and report broad browser, operating-system, and device categories. It may also process referring pages, approximate region, and analytics cookie or online identifiers. We use these reports to understand which information is useful and whether the site works across common devices. We do not use this analytics setup for advertising, cross-site profiling, or to identify you by your Discord account. The analytics tag is loaded only after you choose Accept in the consent banner; choosing Decline prevents analytics from loading. You can reopen Privacy choices using the site footer to change your selection. Setting a browser to block cookies or local storage may prevent your choice from being remembered.
We use cookies and local storage for the following purposes:
You can delete or block cookies in your browser settings, but the dashboard may not function correctly without necessary session storage. You can withdraw optional analytics consent at any time using Privacy choices in the site footer; this stops future analytics loading and removes analytics cookies where the browser permits.
Discord requires users to meet a minimum age (13, or higher where local law requires). The Service is not directed to children under that age and we do not knowingly collect their personal data. If we learn that we have collected data from a child below the applicable minimum age, we will delete it promptly. If you believe this has occurred, please contact us.
We may update this policy from time to time. The "last updated" date at the top shows the most recent revision. For material changes, we will provide notice through Discord or our website, where practicable at least 14 days before they take effect. Continued use of the Service after the effective date means you accept the updated policy.
For questions about this policy or to exercise your rights, please contact us: