Política de privacidade
Versão 2.2 · Atualizado em 16 de outubro de 2026
Este documento está disponível em inglês e em espanhol.
This policy explains which personal data Elith (the Discord bot and this website) processes, what for, on what legal basis, for how long, and what you can do about it. Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD) apply.
1. Data controller
The controller is the owner of Elith, identified in the Aviso legal. Contact for anything about privacy: support@elith.app. No data protection officer has been appointed because the law does not require one for this activity.
Inside each Discord server, its staff decide which modules are turned on and how they are configured. For questions about a specific action in a server (a warning, a ban, a ticket), go to that staff first.
2. What we process, what for and for how long
The data comes from Discord when you use a server where Elith is present or sign in to the dashboard; we do not obtain it from other sources. Only what an enabled module needs is stored, with the exception of the activity counters, which are kept in every server.
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Dashboard account: Discord user id, username, display name, avatar, language and date of last sign-in. We do not ask Discord for your email. | Signing you in and showing who made a change. | Performance of the service you asked for. | Until you ask us to delete it. |
| Session: an encrypted cookie holding your Discord id, name, avatar and the Discord access tokens (scopes “identify” and “guilds”). | Keeping you signed in and listing the servers you manage. | Performance of the service. | 30 days, or until you sign out. |
| Dashboard audit log: your Discord id, what you changed and when. | Letting a server see who changed its configuration; security. | Legitimate interest in accountability and security. | While Elith is in the server, then until deletion is requested. |
| Server data: id, name, icon, owner id, member count and the configuration its staff write (including message templates and word lists). | Running the modules the server turns on. | Performance of the service. | While Elith is in the server, then until deletion is requested. |
| Activity counters: per member and day, number of messages and minutes in voice. Never the content. | Activity statistics for the server staff, and roles by activity. | Legitimate interest of the server in knowing its activity. | 90 days. |
| Levels: Discord id, XP, level, message count, voice minutes, display name and avatar; achievements. | Rank cards, leaderboards and role rewards. | Performance of the service. | Until the server resets it or deletion is requested. |
| Moderation cases: id and name of the member and of the moderator, action, reason, duration and dates. Includes actions taken automatically. | A history the staff can review and explain. | Legitimate interest in keeping communities safe. | Until the server deletes the case or deletion is requested. |
| Tickets: who opened, claimed and closed them, form answers, rating, and the transcript (messages, author names, links to attachments). | Support inside the server and its history. | Performance of the service; legitimate interest of the server. | Until deletion is requested. |
| Things you write for a feature: reminders, AFK note, suggestions, polls and votes, giveaway entries, birthday (day and month; the year only if you add it). | Providing that feature. | Performance of the service. | Until you remove it with the feature’s own command where there is one, or deletion is requested. The AFK note is deleted with your next message. |
| Economy: virtual balance, inventory and streaks. | The economy module. | Performance of the service. | Until the server resets it or deletion is requested. |
| Invitations: who invited whom, with which invite, and join and leave dates. Roles and nickname at the moment of leaving, only if the server turned on role restore. | Invite tracking and giving roles back on return. | Legitimate interest of the server. | Until deletion is requested. |
| Other records a feature needs: starboard entries (author and message ids, never the content), verification attempts, owner of a temporary voice channel, temporary roles and who gave them, last person to count. | Providing that feature. | Performance of the service; legitimate interest of the server. | Temporary roles and voice channels until they end; the rest until deletion is requested. |
| IP address. | Limiting abusive requests to the site. | Legitimate interest in security. | 60 seconds, in memory. It is not written to our database. |
| Premium subscriptions: the server, the Discord id of whoever subscribed, the plan, its state and dates, and the ids Paddle gives the purchase and the customer; a log of the payment notifications received. Never your card, address or email. | Giving the server Premium, letting the buyer manage it, and keeping a record of the purchase. | Performance of the contract; legal obligation to keep commercial records. | While the subscription exists and six years after it ends. |
| Emails you send to support@elith.app. | Answering you. | Legitimate interest in answering whoever writes to us; your request. | Until the matter is closed, and up to one year after. |
3. Message content
Elith reads message content to apply the auto moderation, auto responses, levels and logs the server has turned on. That content is processed in memory and is not stored in our database, except in these cases: ticket transcripts, and what you write on purpose for a feature (suggestions, reminders, polls, AFK note, form answers).
When a server turns on logging, deleted or edited messages are sent to the log channel its staff chose, inside Discord. That copy is kept by Discord and managed by the server.
4. Public leaderboards
A server's public leaderboard is off by default. If its staff turn it on in the levels module, it can be seen on a public page of this site (without signing in) with the display name, avatar, level, XP, message count and voice time of its members. The page is not indexed by search engines and the staff can turn it off again. If you do not want to appear, ask that staff or write to us.
5. Automated decisions
The auto moderation, anti-raid, anti-nuke and verification modules can delete messages, warn, time out, kick or ban an account automatically, applying the rules each server configures (for example, sending many repeated messages or joining with a very recent account). The effect is limited to that server. Every action is recorded as a case with its reason, and the server staff can review and reverse it; ask them or, if they do not answer, us.
We do not build profiles for advertising and we show no advertising.
6. Who receives the data
- Railway Corp. (hosting of the site, the bot and their databases), as a data processor.
- Discord Inc.: Elith runs inside Discord, which processes your account and your messages under its own privacy policy. The avatars and icons you see on this site are loaded from Discord's servers, which therefore receive your IP address.
- Music and alert sources (YouTube, SoundCloud, Twitch, Reddit, Bluesky, RSS feeds and the like): they receive the search or the address requested from our servers, without your Discord identity.
- Paddle.com Market Limited (United Kingdom), if you buy Premium: it sells it as merchant of record and processes your payment details (name, email, country, card) as an independent controller, under its own privacy policy. We only receive from it the state of the subscription and its ids.
- Cloudflare, Inc. (the domain's DNS and the forwarding of mail sent to support@elith.app), as a data processor.
We do not sell data or hand it to third parties for their own purposes. We use no analytics and no trackers.
7. International transfers
Railway's servers are in the United States. The transfer relies on the safeguards the GDPR provides: the European Commission's standard contractual clauses or, where the provider is certified, the EU-US Data Privacy Framework. Discord and Cloudflare also process data in the United States, and Paddle in the United Kingdom (covered by an EU adequacy decision), under their own safeguards.
8. When Elith leaves a server
If Elith is removed from a server, its data stops being used and is permanently deleted 30 days later, in case the server adds it back in the meantime. Only the Premium records are kept, for the period stated above. The server owner, or any member regarding their own data, can ask for it to be deleted sooner; we do so within one month at most.
9. Your rights
You can ask for access to your data, for it to be corrected or erased, object to its processing or ask for it to be restricted, and receive a copy in a commonly used format (portability). To exercise them write to support@elith.app giving your Discord user id and, if it concerns a specific server, which one. Do not include personal data in public messages: we will give you a private channel. We answer within one month at most and it is free.
Some things you can do yourself:
- sign out of the dashboard, which deletes the session cookie and revokes the access granted in Discord;
- delete your birthday (
/birthday remove) or your reminders (/remind delete); - withdraw your vote in a poll or your entry in a giveaway by pressing the button again;
- revoke Elith's access from Discord, in User Settings → Authorized Apps.
If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of your country.
10. Minors
Elith follows Discord's minimum age. In Spain you can consent to the processing of your data yourself from the age of 14; below that age you need the permission of a parent or guardian. We do not knowingly collect data from minors without that permission: if you think it has happened, write to us and we will delete it.
11. Security
Connections are encrypted (HTTPS), the session is stored encrypted and out of the reach of scripts, the databases are not reachable from the Internet, every dashboard action checks that you manage that server, and the bot asks Discord only for the permissions its modules use. If a security breach affected your data, we would notify the authority and the people affected as the law requires.
12. Cookies
This site only uses necessary and preference cookies. The detail is in the Política de cookies.
13. Changes
When this policy changes we will update the version and date above, and announce significant changes on the site.