Privacy Policy — Sumarville
Effective date: 14 June 2026 Last updated: 10 November 2026
This Privacy Policy explains what personal data Sumarville (“the Bot”, “we”, “us”) collects, why we collect it, how it is used, and the rights you have under the EU General Data Protection Regulation (GDPR). By adding the Bot to a Discord server or interacting with it, you acknowledge the practices described here.
1. Who is responsible for your data
The Bot is operated by an individual based in the European Union (the “Bot Owner”), who acts as the data controller for the personal data described below.
- Privacy / data requests: [email protected]
- General support: Discord support server
The Bot Owner’s identity has been verified directly with Discord as part of the app-verification process.
2. What data we collect and why
The Bot only processes data that is necessary to provide its features (character sheets, role and nickname management, a session calendar, a food/lunch list, and NPC dialogue). All data is stored per Discord server and is not combined across servers.
| Data | When it is collected | Why |
|---|---|---|
| Discord User ID | When you create a character, or when you act as a Dungeon Master | To link a character to you and to assign roles |
| Server (Guild) ID | When the Bot is added to a server | To keep each server’s data separate |
| Character name | When you create a character | Stored on your character sheet; also set as your server nickname |
| Character avatar / picture URL | When you create a character | Displayed on your character sheet |
| Configured role & channel IDs | When a server admin runs the setup command | Bot configuration (which role is “Player”/”DM”, which channels to use) |
| Command input | When you use one of the Bot’s slash commands | To run the command. Not retained after processing, except where the input itself is the feature you requested (see below). The Bot does not read your other messages. |
| Feature content | When you submit it via a command | Calendar session dates, food/lunch entries, and NPC dialogue text you choose to store |
We do not collect: your email address, your real name, payment information, your Discord password, or presence/activity status.
3. Legal basis for processing (GDPR Art. 6)
We process your data on the basis of:
- Performance of a service / legitimate interest (Art. 6(1)(b) and 6(1)(f)) — you actively choose to use the Bot’s commands, and the data listed above is required to deliver the feature you requested. We only store what is necessary for that purpose (data minimisation).
You can withdraw from this processing at any time by deleting your character, asking a server admin to remove the Bot, or contacting us to request erasure (see Section 7).
4. How your data is used
Your data is used only to operate the Bot’s features for the server you are in. We do not:
- sell, rent, or trade your data;
- share it with third parties for advertising or analytics;
- use it to build a profile of you across servers.
Error monitoring. When a command fails, the Bot sends an error report to Sentry, which processes it on our behalf. A report contains the server (guild) ID, the name of the command, and technical details of the error; it does not contain your messages or character data. Sentry keeps error reports for at most 90 days.
The Bot runs on Discord’s platform; your use of Discord is also governed by Discord’s Privacy Policy.
5. Where your data is stored
Data is stored on infrastructure controlled solely by the Bot Owner, located in the European Union. Access is restricted to the Bot Owner. The database is encrypted at rest (SQLCipher, AES-256); the encryption key is kept separately from the database and the Bot’s source code.
Apart from error reports to Sentry (Section 4), no personal data leaves this infrastructure. Where Sentry processes data outside the EU/EEA, it does so under the EU Standard Contractual Clauses.
6. How long we keep your data
- Character, configuration, and feature data is retained for as long as the Bot is present in your server.
- When the Bot is removed from the server, its data is kept for 7 days, so that re-adding the Bot by mistake loses nothing, and is then deleted. Re-adding the Bot within those 7 days cancels the deletion.
- Deleted data may remain in encrypted backups for up to 30 days after deletion, after which those backups are destroyed.
- A verified erasure request (Section 7) deletes data sooner.
- Erasure requests are honoured without undue delay, and within 30 days of verification.
7. Your rights
Under the GDPR you have the right to:
- Access — request a copy of the personal data we hold about you;
- Rectification — correct inaccurate data;
- Erasure — have your data deleted (“right to be forgotten”);
- Restriction / objection — limit or object to how we process your data;
- Portability — receive your data in a structured, machine-readable format.
To exercise any of these rights, contact [email protected]. To verify your identity we may ask you to confirm the request from the Discord account associated with the data. You also have the right to lodge a complaint with your national data protection authority.
8. Children
The Bot is not directed at children. You must meet Discord’s minimum age requirement to use Discord and the Bot (at least 13 years, or higher where required by local law, e.g. 16 in some EU member states).
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Continued use of the Bot after a change constitutes acceptance of the revised policy.
10. Contact
Questions or data requests:
- Privacy / data requests: [email protected]
- General support: Discord support server