Privacy Policy

Last updated: 12 October 2026

1. Who we are

Ravenkeep (the Discord bot and this website, ravenkeep.gw2.com.ua) is operated by PE Pushnoi Roman Olexiyovych, a sole proprietor (фізична особа-підприємець, FOP) registered in Ukraine (“we”, “us”). For anything about your data, contact us at scaronbroadway@gmail.com.

Discord IDs (numbers that identify users, servers, channels, roles and messages) are personal data when they identify a user. We store as little as the service needs, listed completely below.

2. Two roles

Server content. A server's admins decide whether Ravenkeep logs their server and runs tickets there. For that content (log messages, ticket transcripts, form answers) we act on their behalf; the server's admins are responsible for having a reason to log and for telling their members. Log messages and transcripts are posted into the server's own Discord channels — they are stored by Discord and controlled by the server, not by us.
Our own users and customers. For dashboard logins, Premium purchases and our technical records, we decide how data is used and are responsible for it.

3. What we store in our database

About servers

Table	What it contains	Why	How long
`Guild (servers)`	Server ID; when Ravenkeep was first added; when it was removed (if it was).	To know which servers use Ravenkeep and to schedule deletion after removal.	While Ravenkeep is in the server; deleted 30 days after Ravenkeep is removed from the server (kept as an empty ID only if the server has billing records).
`GuildEvent (join/leave history)`	Server ID, “added” or “removed”, time.	Service statistics (how many servers join and leave).	Deleted 30 days after Ravenkeep is removed from the server.
`TicketConfig (ticket settings)`	Server ID; IDs of the staff roles, ticket category and transcript channel; the last ticket number; timestamps.	To run the ticket system as the server's admins configured it.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`Panel (ticket panels)`	Server, channel and message IDs; the title, description and colour written by the admins; the user ID of the admin who created it; whether the server had Premium when the message was last posted; timestamps.	To show the panel, and to update its message when Premium starts or ends.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`TicketType (ticket types on a panel)`	Button text, emoji, button colour and form questions written by the admins; the ticket channel name prefix; the IDs of its category and extra staff roles; its order on the panel; timestamps.	To show each type's button or dropdown option and form, and to create its tickets in the right place for the right staff.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`RoleConfig (auto-roles)`	Server ID; the IDs of the roles new members get; whether bots get them too; timestamps.	To give new members the roles the admins chose.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`RolePanel (role panels)`	Server, channel and message IDs (for a reaction panel on an existing message: that message's IDs); whether it uses buttons or reactions; the title, description and colour written by the admins; how it works (toggle, only one, verify); the ID of the role needed to use it; the user ID of the admin who created it; whether the server had Premium when the message was last posted; timestamps.	To show the panel, and to update its message (or Ravenkeep's reactions) when Premium starts or ends.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`RolePanelOption (roles on a role panel)`	The role ID; the button text, emoji, colour and dropdown description written by the admins; its order on the panel; timestamps.	To show each role's button, dropdown option or reaction and give members the role they pick.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`RoleReaction (who reacted on reaction role panels)`	Server ID; which role of which reaction panel; the user ID of the member whose reaction Ravenkeep handled; when.	So Ravenkeep notices what changed while it was offline (e.g. during an update): a reaction removed in the meantime takes the role back, and a role a moderator removed isn't given back. Button panels store nothing about who clicked.	Until the member removes the reaction, leaves the server, the role's emoji or the panel changes, or the panel is deleted; also with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request.
`Greeting (welcome and leave messages)`	Server ID; for the welcome message, welcome DM and leave message: whether it's on, its channel ID, and the text and embed written by the admins; the welcome card's design (background, its two lines of text, colours) and which uploaded picture is its own background; timestamps.	To greet new members and say goodbye as the admins set up. Nothing about the members who join or leave is stored — their name and avatar are used to draw their welcome card, which is sent to Discord and not kept.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`GuildModule (modules switched on or off)`	Server ID; which module (e.g. Tickets, Leveling) the admins switched on or off; when.	To run only the parts of Ravenkeep the server wants.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`GuildSettings (server settings)`	Server ID; the server's time zone; when Ravenkeep added its newest slash commands to this server only (during a staged launch); when it was changed.	To send scheduled messages and birthday wishes at the server's local time, and to show new commands only where they're available.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server. (/data delete clears the time zone.)
`ScheduledJob (timed tasks)`	What to do and when (for example: end a temporary ban, send a repeating message); the server ID; the IDs the task needs; failed tries and the last error.	So timed tasks happen on time and aren't lost when Ravenkeep restarts.	Until the task has run (a repeating one: until it's stopped); also deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`ModConfig (moderation settings)`	Server ID; the mod-log channel ID; whether members are DMed the reason and whether a reason is required; how long cases are kept; the last case number; timestamps.	To run moderation the way the server's admins chose.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`ModCase (moderation cases)`	Server ID; the case number; what happened (warning, timeout, kick, ban, unban, purge or note); the user ID and name of the member it's about; the user ID and name of the moderator (or that automod did it); the reason or note written by the moderator; its length and when it ends; whether the member was DMed; for a purge the channel and how many messages; the ID of the case's message in the mod-log channel; timestamps. Bans, kicks and timeouts done by hand in Discord are recorded too, with the moderator and reason from Discord's audit log.	So a server's moderators have a history of what was done and why, and so temporary bans end on time.	24 months, then deleted automatically — each server's admins can choose 3, 6, 12 or 24 months instead, or to keep them; the server's moderators can also delete a case earlier. A ban's case is kept while the member is still banned; if Ravenkeep can't check that (for example, it's no longer allowed to see the server's bans), until it can. Also deleted with /data delete, or 30 days after Ravenkeep is removed from the server. A member's request to delete their data does not delete cases about them: they're the server's safety record.
`AutomodConfig (automod and raid protection settings)`	Server ID; the actions ladder; exempt role and ignored channel IDs; the bad-word lists written by the admins; mention, spam and word-preset settings; the IDs of the AutoMod rules Ravenkeep made in Discord; join-gate and lockdown settings, the quarantine role ID, and whether a lockdown is on (until when, why); timestamps.	To protect the server the way its admins chose. Bad words, mention spam and spam are Discord's own AutoMod rules that Ravenkeep sets up — Discord checks those messages, not Ravenkeep.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`AutomodRule (Ravenkeep's automod rules)`	Server ID; the rule's kind (flood, repeated messages, capital letters, links, invites), name and settings (e.g. allowed websites); ignored channel and role IDs; timestamps.	To check new messages against the rules the admins made. Messages are checked as they arrive and not stored for this; Ravenkeep keeps only a short count of recent messages per member in memory (for floods and repeats).	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`AutomodStrike (automod strikes)`	Server ID; the user ID of the member who broke a rule; which rule; when.	To give the next step of the server's actions ladder (e.g. a timeout after three strikes).	30 days, then deleted automatically; also with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request.
`LevelConfig and LevelReward (leveling settings)`	Server ID; how much XP a message or a minute in voice gives and the cooldown; where level-ups are announced and the message text written by the admins; the reward roles and their levels; channel and role IDs without XP and with XP boosts; whether the public leaderboard page is on; the rank card's design (and its own background picture, like a welcome card's); timestamps.	To run leveling the way the server's admins chose.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`MemberXp (members' XP)`	Server ID; the member's user ID; their XP and level; how many messages earned XP and how many minutes in voice (counts only — not what they wrote or said); their display name and avatar ID at their last XP (for the leaderboards); whether they asked to be left out of the public leaderboard page; when they left the server (if they did); when it last changed.	To give XP, levels and role rewards, and to show /rank and the leaderboards. The server's admins can download the list of members' XP (user ID, name, XP, level) as a file on the dashboard. XP is counted in memory for up to half a minute before it's written. Ravenkeep never reads message text for this — only that a message was sent. If the server's admins switch on its public leaderboard page, the top members' names, avatars, levels and XP are shown there to anyone with the link; members can leave themselves out with /leaderboard-privacy.	While the member is in the server, and 90 days after they leave (so their XP is there if they come back), then deleted automatically. Also deleted when the server's admins reset XP, with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request.
`MemberXpBackup (a copy for “Undo reset”)`	When a server's admins reset everyone's XP: each member's XP, message and voice counts, name and avatar ID from before the reset; which reward roles the reset took away from them (if the admins chose that); when.	So the reset can be undone (XP and removed roles given back), and so the reward roles can be taken away bit by bit (Discord allows only a few role changes at a time).	24 hours after the reset, then deleted automatically (if roles are still being taken away, until that's done — at most a week). Also deleted when the reset is undone, with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request.
`SuggestionChannel, Suggestion and SuggestionVote (suggestions)`	Server ID; the suggestion channels and their staff role IDs, whether authors are told of decisions; each suggestion's number, the author's user ID and display name, the text they wrote, its status, the staff member's user ID and reason when decided, its message ID and vote counts; each vote: the member's user ID and whether it's up or down; timestamps.	To post suggestions, count one vote per member, and show staff decisions.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server. A member's own suggestions and votes are deleted at their request.
`Starboard and StarboardPost (starboards)`	Server ID; the starboard channel, its emoji, how many are needed, whether the author's own reaction counts, ignored channel IDs; for each starred message: its channel and message IDs, the ID of Ravenkeep's copy, and the count — never the message's text (the copy shows it in Discord).	To copy popular messages to the starboard, keep the count current, and delete the copy when the original is deleted.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`Giveaway and GiveawayEntry (giveaways)`	Server ID; the channel and message, prize and description, number of winners, the host's user ID, the end time, requirements (role IDs, level, account age, days in the server), bonus entries for roles, the winners' user IDs; each entry: the member's user ID and number of entries; timestamps.	To run the giveaway, check requirements when someone enters, and draw winners fairly (secure random numbers).	Until 30 days after the giveaway ended or was cancelled, then deleted with its entries. Also with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request (their entries; their ID is removed where they hosted or won).
`FeedSource and FeedFollow (social alerts)`	What servers follow: the YouTube channel ID, Twitch account name, subreddit name or feed address and its public title (and a subreddit's public icon), the IDs of posts already seen, when it was last checked and why a check failed (public data, shared by all servers following it); each follow: the server ID, channel ID, announcement text written by the admins, the role to ping, whether the admins marked a subreddit 18+, why the last post failed, and the user ID of the admin who added it; timestamps.	To announce new videos, streams and posts in the channels the admins chose — each source is fetched once for every server following it.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server. A source nobody follows any more is deleted.
`MessageSchedule (scheduled messages)`	Server ID; which saved message is posted, in which channel, and when (once, every so often, or on weekdays at a time); whether the previous copy is replaced; when it posts next and last posted, the last copy's message ID, how many were sent, why the last try failed (if it did); the user ID of the admin who made it; timestamps.	To post the server's saved messages at the times its admins chose.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server. Sent or missed one-time messages are deleted 30 days later.
`CustomCommand and CustomCommandConfig (custom commands)`	Server ID; each command's name, description, the phrases or patterns that trigger an auto-responder and the ones that stop it, the replies and role actions written by the admins, where it works and who may use it, its cooldown, how often it was used, and the user ID of the admin who made it; whether `!` commands and auto-responders are on, and the prefix; timestamps.	To answer /c, `!` commands and auto-responders the way the admins set them up. When a member uses one, Ravenkeep reads that message only to see whether it's a command or matches a phrase or pattern — the message isn't stored for this. Cooldowns are kept in memory for a short time.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`Reminder (reminders)`	Server ID; the user ID of the member who set it; the channel it was set in; the text they wrote; whether it goes by DM; when it's due; when it was set.	To remind the member at the time they chose (in that channel with a ping for them, or by DM).	Until it's sent (or the member cancels it), then deleted. Also with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request.
`Birthday and BirthdayConfig (birthdays)`	Server ID; the member's user ID and the day and month of their birthday — never the year; the server's wishes channel, the wish written by the admins, the birthday role and the hour; timestamps.	To wish members on their birthday (only they are pinged), give the birthday role for the day, and show /birthday upcoming.	While the member is in the server — deleted when they leave or run /birthday remove. Also with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request.
`StatCounter (stat counters)`	Server ID; the channel whose name shows the number, what it counts (e.g. members, boosts, a role's members, a member goal), the name written by the admins, whether it's switched on, the name last set and why the last rename failed (if it did); timestamps.	To rename the channel with the current number (at most every few minutes — Discord's limit). Only counts are used, never who the members are.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`TempVoiceHub and TempVoiceChannel (temporary voice)`	Server ID; the hub voice channels, the category for new channels, the name and member limit chosen by the admins; each temporary channel's ID, which hub made it and the user ID of the member who owns it; timestamps.	To create a voice channel for a member who joins a hub, let its owner manage it with /voice, and delete it when it's empty.	Temporary channels: until they're empty and deleted (also cleaned up when the bot starts). Hubs: While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`VerificationConfig (captcha verification)`	Server ID; the channel and message ID of the Verify panel; the role given when verified and the role taken away; picture or text question; timestamps.	To post the Verify panel and give the role to members who solve the captcha.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`BotProfile (bot profile, Premium)`	Server ID; the nickname and bio the server's admins gave Ravenkeep in their server, their uploaded avatar and banner pictures (see MessageImage), whether Discord shows it now, the avatar's Discord link, why the last change failed (if it did), the user ID of the admin who last saved it; timestamps.	To show Ravenkeep with the server's own name and pictures in that server (and on its log messages), and to switch back to Ravenkeep's normal look when Premium ends. The bot owner can see and reset these designs to enforce the Terms.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`GuildDailyStats (server analytics: daily totals)`	Server ID; the day; how many members joined and left, how many messages were sent, how many members wrote at least once (only the number: the member IDs used to count each member once stay in memory for that day and are never saved), minutes spent in voice, and the member count — counts only, never who or what.	To show the server's admins how their server is growing and how active it is (Analytics page).	12 months, then deleted automatically. Also with /data delete, or 30 days after Ravenkeep is removed from the server.
`GuildHourlyStats (server analytics: detail)`	Server ID; the hour; how many messages were sent, members joined and left, and minutes spent in voice in that hour, and messages per channel (the 10 busiest channels, by ID) — counts only, never who or what.	To show the server's busiest channels and busiest hours of the day on the Analytics page.	30 days, then deleted automatically (the day's totals above stay). Also with /data delete, or 30 days after Ravenkeep is removed from the server.
`Ticket`	Server ID; ticket number; the ticket type (ID and name); ticket channel ID; user IDs of the member who opened it, the staff member who claimed it (and when) and who closed it; with Ticket statistics on, when staff first replied and who (not what they wrote); status; open/close times; the close reason typed by staff; the member's answers to the panel's form questions (text).	To run tickets (who may see and close them, numbering, one open ticket per member) and to show the answers to staff.	Open tickets: while Ravenkeep is in the server. Closed tickets: deleted 12 months after they were closed (the transcript posted in the server stays in Discord). Also deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`LogConfig (log settings)`	Server ID; log channel IDs; which event types are switched off; IDs of ignored channels and roles; whether changes made on the dashboard are posted to the log channel; why logging stopped (if it did); timestamps.	To post the server logs the admins chose. A dashboard change is posted to the server's own log channel with the name of the admin who made it (e.g. “Ticket panel edited — by @admin”); Ravenkeep doesn't keep a copy.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`LogWebhook`	Log channel ID; ID and secret token of the webhook Ravenkeep created in that channel.	To post log messages into the log channel.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server.
`LoggedMessage (recent messages, for logs)`	In servers with logging on, for each member message in a logged channel: server, channel, message and author IDs; the send and edit times; and, encrypted, the text, the author's name and avatar link, and attachment file names (not the files).	So edit and deletion logs can show what a message said and who wrote it, also after the bot restarts. Messages from bots and in ticket categories, ignored channels or log channels (and, with Premium, from ignored roles) are not stored.	24 hours after the message was sent (30 days for servers with Premium), then deleted automatically; deleted straight away when the message is deleted; also with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request. Not included in backups.
`Message (saved messages)`	Server ID; the name, text, embed (title, description, colour, author line, footer, picture links) and link buttons written by the admins; where it's posted (channel and message ID); which uploaded pictures are attached; whether to publish it to followers; the user ID of the admin who created it; timestamps.	To post the message and update it in place when the admins edit it.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server. Also deleted when the admins delete the message (the copy already posted in Discord is removed too).
`MessageImage (uploaded pictures)`	Server ID; the message it belongs to (or that it's a welcome or rank card's own background, or the bot profile's avatar or banner); file type, size and dimensions; the user ID of the admin who uploaded it; upload time. The picture itself is a file on our server (not in the database), stored without hidden data such as camera details or GPS location (card backgrounds, avatars and banners are also cropped to their size), and shown only to people who manage that server.	To attach the picture when the bot posts or updates the message, to draw the server's welcome and rank cards, or to send the bot profile's pictures to Discord.	While Ravenkeep is in the server. Deleted with /data delete, or 30 days after Ravenkeep is removed from the server. Also deleted with its message, when it's replaced or removed, or 24 hours after upload if it was never saved in a message, as a card background or in the bot profile. The copy Discord stores with a posted message (or as the bot's picture in the server) is Discord's.

About dashboard users and customers

Table	What it contains	Why	How long
`WebSession (dashboard logins)`	A SHA-256 hash of your login cookie (not the cookie itself); your Discord user ID, display name and avatar ID (updated when you change them on Discord); your Discord access token, encrypted (AES-256-GCM); when the login expires.	To keep you logged in and to ask Discord which servers you can manage.	Until you log out or the login expires (Discord logins last about 7 days); expired logins are deleted automatically.
`Subscription (Premium)`	Server ID; Paddle subscription and customer IDs; status; monthly or yearly plan; price ID; end of the paid period; whether it's canceled; the Discord user ID of the buyer; timestamps.	To turn Premium on for the right server and to let only the buyer manage it.	As long as required by accounting and tax law (billing records are not removed by /data delete).
`PremiumInterest (“Notify me when Premium opens”)`	Server ID; the Discord user ID of the admin who pressed “Notify me when Premium opens” on the dashboard; when.	To let the server know when Premium upgrades open.	Until Premium upgrades open and the server has been told; also deleted with /data delete, 30 days after Ravenkeep is removed from the server, or at a user's request.
`PaddleEvent (billing notifications)`	Every notification Paddle sends us: its type, time and how we handled it, plus its full content — Paddle customer, address and transaction IDs, amounts, currency, country, and the payment method type with the last four card digits (never the full card number), and our custom data (server ID, buyer's Discord user ID).	Proof of what was paid and when; handling each notification only once; troubleshooting.	3 years after it arrives, then deleted. (Paddle, the Merchant of Record, keeps the billing records themselves.)

4. What we process but don't store

Recent messages (text, author, attachment names and links) in servers with logging on, also kept in memory: at most 50 per channel, for up to 1 hours, lost whenever the bot restarts. An encrypted copy is stored for a limited time too — see LoggedMessage in section 3. Messages in ticket categories, ignored channels and log channels, and messages from bots, are not logged or stored.
Member lists (names, roles, join dates, whether they still have to accept the server's rules) of servers with logging or auto-roles on, in memory: to show what changed in member logs, and to give auto-roles to members who joined while Ravenkeep was restarting or who accept the rules later.
Discord's audit log, read to show which moderator did something.
Ticket transcripts are built in memory when a ticket closes and sent to the server's transcript channel and to the member who opened the ticket. We keep no copy.
Reactions on reaction role panels (who reacted with which emoji) are read from Discord to give or take the role, and when the bot starts, to catch up on what changed while it was offline (compared with RoleReaction in section 3). The IDs of the panel messages are kept in memory.
Members who join or leave during a mass join (a mention or name each, at most 10per server, for up to a minute) so they can be welcomed in one message instead of flooding the channel. Welcome DMs are sent on the server's behalf with the text its admins wrote; we keep no copy.
Welcome cards: to draw a new member's card, Ravenkeep downloads their avatar from Discord and uses their name and the server's member count. The card is drawn in memory, sent to Discord and not kept. On the dashboard, the preview is drawn the same way with your own name and avatar.
Rank cards (/rank) are drawn the same way from the member's avatar, name, level and XP, sent to Discord and not kept.
Captcha challenges (Verification): the code or sum a member has to solve, their user ID and how many tries are left, kept in memory for at most 5 minutes. The picture is drawn in memory, shown only to them and not kept. Nothing about the answer is stored — only the role is given.
Analytics: to count how many members wrote on a day (each only once), Ravenkeep keeps their user IDs in memory until that day is over on the server's clock and its number is saved (at most an hour after midnight) — the IDs are never saved; only the number is.
Channel and role lists shown on the dashboard, cached in memory for about a minute.
Messages between the website and the bot pass through Redis on our server and are not stored.

5. Technical records and backups

Web server logs: IP address, time, page requested and browser, for security and troubleshooting. Kept 14 days.
Application logs: events such as “added to server X” and error details, which can include server, channel and user IDs. Rotated automatically when they reach their size limit (typically a few weeks to a few months).
Error alerts: error details (which can include IDs, never passwords or tokens) are sent to a private Discord channel only we can read.
Database backups: a full copy of the database every day, stored on our server and in our Google Drive, each kept 14 days. Deleted data therefore disappears from backups within 14 days.
Uploaded pictures (saved messages) are files in a private folder on our server, not part of the database backups; deleting them removes them straight away.

6. Cookies

We use only two cookies, both needed for logging in. No analytics, advertising or tracking cookies.

rk_session — keeps you logged in to the dashboard (until you log out or the login expires, about 7 days).
rk_oauth_state — protects the “Log in with Discord” step against forgery (10 minutes).

When you open the Premium checkout, Paddle's checkout may set its own cookies (see Paddle's privacy policy). If you bought Premium for a server, that server's Premium page loads Paddle's script as soon as you open it and gives it your Paddle customer ID, so Paddle Retain (part of Paddle) can show you billing notices there, such as a failed payment.

7. Who else processes data

Discord — the platform Ravenkeep runs on (Discord Privacy Policy).
Paddle (Paddle.com Market Ltd) — our reseller and Merchant of Record for Premium. Paddle processes payments, invoices, taxes and refunds and collects your name, email, billing address and payment details itself; we never see your full card number (Paddle Privacy Policy).
OVHcloud (OVH SAS) — hosts our server in France (EU).
Cloudflare — protects and delivers this website; sees visitors' IP addresses and requests.
Google — stores copies of our database backups (Google Drive).
YouTube, Twitch, Reddit and RSS sites — for social alerts, Ravenkeep's server fetches public data (new videos, live streams, posts) from YouTube (Google), Twitch, Reddit and the feed addresses server admins choose. These requests come from our server and carry no personal data about you.

Some of these providers may process data outside the EU/EEA and Ukraine; they use safeguards such as the EU Standard Contractual Clauses. We never sell personal data and never use it for advertising.

8. Legal bases (GDPR)

Contract — providing Ravenkeep to the servers that use it and Premium to customers (Art. 6(1)(b)).
Legitimate interests — security, preventing abuse, fixing errors, backups and service statistics; and, for server logs, the server's interest in moderating its community (Art. 6(1)(f)).
Legal obligation — keeping billing records (Art. 6(1)(c)).

9. Deleting data

Server admins (Manage Server) can delete all of their server's data at any time with /data delete. Messages already posted in the server's channels stay there; the server can delete them in Discord.
When Ravenkeep is removed from a server, the server's data is kept for 30 days (in case it's added back) and then deleted automatically.
Closed tickets are deleted 12 months after they were closed. The transcript posted in the server's transcript channel stays in Discord; the server can delete it there.
Subscriptions are kept as long as accounting and tax law requires, even after the above. Paddle's billing notifications (PaddleEvent) are deleted 3 years after they arrive.

10. Your rights

Under the GDPR and Ukraine's Law “On Personal Data Protection” you can ask us to access, correct or delete your personal data, to restrict or object to its use, or to receive it in a portable format. Email scaronbroadway@gmail.com from any address and tell us your Discord user ID; we may ask you to confirm you control that Discord account (for example by sending us a direct message). We reply within 30 days. When you ask us to delete your data, we delete your logins and remove your user ID from ticket records and from ticket and role panels; we keep billing records only as the law requires. Moderation cases about you (for example a warning or a ban in a server) are kept for as long as that server keeps its cases (24 months unless it chose otherwise; a ban's case while the ban lasts): they're that server's safety record, which its moderators manage — ask them to delete a case.

Content posted in a server's channels (log messages, transcripts) belongs to that server — ask its admins or Discord to remove it. You can also complain to a data protection authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the authority of the country you live in.

11. Children

Ravenkeep is for people who meet Discord's minimum age in their country. We don't knowingly collect data from younger children.

12. Security

The website uses HTTPS only. Login cookies are stored as hashes, Discord tokens are encrypted, and the database and Redis only accept connections from our own server. Only the operator has access to the server and backups.

13. Changes

When this policy changes we update the date at the top. For significant changes we also announce them in our support server (join here).

See also the Terms of Service and the Refund Policy.