Privacy Policy for the Discord Bot "Nexus" and the Web Dashboard

This is a courtesy translation of the German „Datenschutzerklärung“. In the event of any discrepancies or ambiguities between this translation and the German version, the German version shall prevailLast updated: October 24, 2026

1. General Information & Controller

The operator of this Discord bot takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations (GDPR, BDSG) and this Privacy Policy.

Data Controller:

• Andreas Lindner

• Holunderweg 4
  89182 Bernstadt, Germany

• info@trynexus.de

2. Purpose and Legal Basis of Data Processing

We operate the "Nexus" bot via the official Application Programming Interface (API) of the Discord platform. Data processing is required to ensure the operation of the bot, server-side administration, and to deliver the modules and community features enabled by server administrators.

• Provision of Bot Features: The processing of server configurations, user IDs, and operational data is conducted on the basis of Art. 6(1)(b) GDPR (performance of a contract or pre-contractual steps) for users and administrators utilizing these features, as well as on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a secure, stable, and abuse-free service.

3. Categories of Processed Data in Detail

4. What Nexus Explicitly Does NOT Store

5. Special Case: Moderation Warnings

⚠️ Disciplinary records and warnings ("Warnings") are intentionally excluded from the automated self-deletion command (/delete_my_data).

• Legal Basis: Art. 6(1)(f) GDPR (legitimate interest of the server operator in enforcing community guidelines and safeguarding the server against repeated misconduct).

• Deletion: Moderation logs can only be deleted manually by authorized server moderators or server administrators.

6. Automated Deletion Routines & Data Security

• Leaving a Server: When a user leaves a server (or is kicked/banned), all personal records associated with that user on that specific server (levels, XP, warnings) are automatically deleted from the database.

• 7-Day Retention Grace Period: If the bot is removed from a server, all server-specific data is permanently and automatically deleted after exactly 7 days. This safeguard protects server setups against accidental kicks. If the bot is re-added within this window, the configuration can be restored.

7. Third-Party Data Import (MEE6 Level Import)

If a server administrator activates the import function for existing leveling stats (e.g., from MEE6), Nexus exclusively accesses the publicly viewable web leaderboard of that specific server.

• We only store the Discord User ID and accumulated experience points (XP) of members who are currently present on the server.

• Usernames, avatars, or data belonging to individuals who have already left the server are ignored and not written to the database.

• Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in providing an uninterrupted system transition requested by server management).

8. Nexus Premium & Payment Processing (Merchant of Record)

• Processed Data: To activate and manage premium perks for a server, we only store the Discord Server ID (Guild ID), the tier/access type, and the expiration date.

• Billing Administration: Subscriptions are sold via the native in-app purchasing framework operated by Discord Netherlands B.V. Discord acts as Merchant of Record, processing payments, collecting applicable taxes, and issuing invoices. We do not receive, process, or store financial or banking details.

• Legal Basis: Art. 6(1)(b) GDPR (contract performance).

9. Web Dashboard & Discord OAuth2

For server management via dashboard.trynexus.de, we utilize Discord's official OAuth2 protocol.

• Permissions (Scopes): We request only identify (User ID, name, avatar) and guilds (to verify on which servers you possess administrative permissions). Account passwords are never requested or handled.

• Technically Necessary Cookies: A transient session cookie is stored in your browser to maintain your login status (§ 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(b) GDPR). No third-party tracking, analytics, or behavioral profiling is conducted.

10. Data Processors & Third-Country Transfers

• Hosting Infrastructure: The MariaDB database and bot runtime are hosted on virtual servers provided by netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany). The data center is located in Germany. A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR is in place.

• Discord Platform: Technical operations require relaying command inputs and bot events through Discord Netherlands B.V. and Discord Inc. (USA). This transfer is essential for bot operations. Data transfers are covered by Standard Contractual Clauses (SCC) and the EU-U.S. Data Privacy Framework.

11. Data Subject Rights (Access, Deletion & Objection)

• Right of Access (Art. 15 GDPR): You may at any time request information regarding the personal data we store about you, the purposes of processing, and retention schedules.

• Right to Erasure (Art. 17 GDPR) & Rectification (Art. 16 GDPR): You have the right to request correction of inaccurate data or deletion of your data, provided no overriding legitimate interests (such as server moderation logs pursuant to Section 5) apply.

• Self-Service Erasure: You can immediately delete your server-scoped leveling and experience data (XP) on any participating server by using the /delete_my_data command.

• Informal Inquiries: For full data exports or erasure requests outside automated commands, an informal request sent to info@trynexus.de or via ticket on our official Discord support server is sufficient. Verification of your Discord User ID may be requested to establish identity.

• Right to Restriction of Processing (Art. 18 GDPR) and Data Portability (Art. 20 GDPR).

• Right to Object (Art. 21 GDPR): Where data processing is founded upon legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to processing on grounds relating to your specific situation.

• Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory data protection authority (for Baden-Württemberg: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany).