Privacy policy

Data controller

Elise Berthaut, the website's publisher (a private individual, see the legal notice). Contact: responsable-traitement@bot-canvas.com.

Data collected

Account: Discord ID, name and avatar, sent by Discord at login; date of last login; version of the terms accepted.

Bots: descriptions and answers entered by the user, generated code, bot token (encrypted), runtime logs.

Reports: reason, details and the reporting person's Discord account.

Recommendations (affiliation and referrals): the link the account was created with, passed on at Discord login (no cookie), and the number of visits to that link: a visit only records the link and the date, with no IP address or visitor identifier. An affiliate only sees totals, never the identity of the people they brought.

Technical data: IP address and connection logs of the site's server (date, page requested, browser), for security and abuse prevention.

AI form filling: the date of each request, for the daily limit. The text written is not stored by BotCanvas; it is however sent to the artificial intelligence provider, which may keep it (see “Recipients”).

Purposes and legal bases

Providing the service (creating, testing, hosting bots): performance of the contract (the terms of use).

Security, abuse prevention and handling reports: legitimate interest.

Linking an account to the link that brought it, to know who recommended the site: legitimate interest.

Recipients and processors

Discord (login and running bots); IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, phone +49 721 170 5522 (hosting the site and bots).

Artificial intelligence providers, which receive bot descriptions, form-fill requests, code and, for a bug fix, the error found in the bot's log (after automatic filtering that removes message content and members' names and IDs), never tokens: Mistral AI (France) and Groq (United States).

Transfer outside the European Union: to Groq (United States), under Groq's data processing agreement and the safeguards it provides (the European Commission's standard contractual clauses).

The free plans of some of these providers may keep requests and use them to improve their models. So don't write personal data (real names, addresses, numbers) in bot descriptions or in the “Fill in with AI” box.

Discord server members

On the servers where it is installed, a bot processes members' data (Discord IDs and names, messages, roles) as its owner asked it to. The bot's owner is the controller of this processing. When the bot runs on BotCanvas infrastructure, BotCanvas acts on the owner's behalf, as a processor (see the terms of use): it does not use this data for itself and erases the bot's logs and the data it stored (files, database) when the bot is stopped. For a bug fix requested by the owner, the error found in the log is sent to the artificial intelligence providers above, after automatic filtering that removes message content and members' names and IDs. The owner can download the data their bot stored before stopping it. If the bot's code sends data to other services (an artificial intelligence, another API), it is the owner's decision.

A server member who wants to exercise their rights contacts the bot's owner; they may also write to responsable-traitement@bot-canvas.com, and BotCanvas will pass the request on.

Retention

Account: until it is deleted, by the user from the My account page, or automatically after 3 years without login.

Bots: a bot's request, code and token are erased as soon as its owner deletes it, or with the account.

Bot logs and the data bots store (levels, tickets…): erased when the bot is stopped.

Closed reports: 1 year, then deleted automatically.

Dates of form-fill requests: 2 days.

Technical logs of the site's server: 12 months at most.

Nightly database backups, stored with the host (encrypted for the copy kept off the server): 30 days. Data erased from the site is therefore gone from backups within 30 days.

Cookies

The site only uses cookies needed for it to work: the login session and Discord login security (a few minutes). No advertising, analytics or affiliate cookies, so no consent is requested.

Your rights

You have the right to access, rectify, erase, object to, restrict and port your data, under the conditions and limits set by the GDPR. To exercise them: responsable-traitement@bot-canvas.com. Reasonable verification of your identity may be requested.

You will get an answer within one month. This may be extended by two months if the request is complex or requests are numerous; you are then informed within the first month.

You may set instructions on what happens to your data after your death (article 85 of the French Data Protection Act).

You can delete your account and bots yourself from the My account page.

You can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr/fr/plaintes.