Legal
Privacy Policy
How Nimbus handles personal data. Written for the GDPR and the Norwegian Personal Data Act, in plain language.
Last updated: 29 August 2026
01Who is responsible
The operator of Nimbus, based in Norway, is the data controller for the personal data processed through the bot and this dashboard. You can reach us at nimbus.legal@proton.me.
This policy follows the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven). Where a server administrator uses Nimbus to process their members' data (for example moderation cases or ticket transcripts), the administrator is the controller for that content and we act as a processor on their documented instructions.
02What we collect
Account data. When you log in with Discord we receive your Discord user ID, username, avatar and the list of servers you can manage. We never receive your Discord password or email beyond what Discord's OAuth flow shares.
Server configuration. Settings your administrators save: ticket panels, automod rules and banned-word lists, leveling configuration and role rewards, giveaway and poll definitions, embed templates, log channel routing and module toggles.
Operational content. Data created when the features run: moderation cases and the moderator who filed them, ticket transcripts, giveaway entries and winners, poll votes, XP and level records, and log events the server has chosen to record.
Technical data. Standard server logs — IP address, browser type, timestamps and error traces — used to keep the service secure and to debug problems.
03Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the service | Art. 6(1)(b) — performing the contract: running the bot and dashboard you asked for. |
| Security and abuse prevention | Art. 6(1)(f) — legitimate interest in keeping the service safe and rate-limited. |
| Debugging and reliability | Art. 6(1)(f) — legitimate interest in fixing errors and monitoring uptime. |
| Legal obligations | Art. 6(1)(c) — where Norwegian or EU law requires us to retain or disclose records. |
We do not use your data for advertising, we do not build marketing profiles, and we do not sell personal data to anyone.
06International transfers
We aim to keep personal data within the EU/EEA. Where a provider processes data outside the EEA — for example Google, when fonts are loaded — the transfer relies on an adequacy decision or on standard contractual clauses approved by the European Commission.
07How long we keep data
- Server configuration is kept while the bot is in the server and deleted or anonymized within 30 days of the bot being removed.
- Moderation cases and ticket transcripts are kept until the server's administrators delete them or the server's data is removed.
- XP, giveaway and poll records follow the same rule as server configuration.
- Technical logs are rotated and deleted within 90 days.
- Backups roll off within 30 days, so deleted data disappears from backups on the same cycle.
08Your rights
Under the GDPR you can, at any time:
- request access to the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict or object to processing based on legitimate interest;
- receive your data in a portable, machine-readable format (portability);
- withdraw consent where processing is based on consent.
Email nimbus.legal@proton.me to exercise any of these. We respond within 30 days. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet, or to your local supervisory authority in the EEA.
09Security
Traffic is encrypted in transit, session tokens are httpOnly and never written to localStorage, and access to production systems is restricted to the operators. No method of transmission or storage is perfectly secure, but we design for the worst case and patch promptly.
10Children
Nimbus is not directed at children under 13, and Discord's own minimum age applies. In Norway the age of digital consent is 13; we do not knowingly collect data from anyone below that threshold and will delete it if we learn we have.
11Changes and contact
Changes to this policy are posted on this page with an updated date. Material changes are announced through the dashboard before they take effect.
Data protection contact: nimbus.legal@proton.me. Replace this address with your monitored legal inbox before launch.