Privacy Policy

Version 1.0 · Effective 4 November 2026 · Operated by ModoraLabs, a private individual in the Netherlands, as a non-commercial hobby project

1. Who is responsible

Nexobots is run by ModoraLabs, a private individual in the Netherlands, as a non-commercial hobby project. Even as a hobby project it follows the GDPR, and the operator is the controller of your personal data on Nexobots. For privacy questions and requests, contact [email protected].

2. What we collect and why

We log you in through Discord and ask only for your identity and email address. We don't see your Discord password, messages or servers. If you choose to list a server, we read its name, icon and member counts from its invite, and our bot checks who owns it. If you list a template, we read its channels, roles and creator from Discord. If you turn on vote messages, voters' usernames are posted to the Discord channel you chose. If you vote for a bot with a role reward, we use your Discord ID to give you that role in the developer's server, and keep a record until it runs out. A developer's vote webhook also gets how many days in a row you've voted for their bot. If you run a server check, we read that server's roles and bots, count how many people hold powerful roles, and store only that result. When you list something, its name, description and your username or Discord ID can appear in our public Discord log channel, and a reviewer's username appears on a review. If you send a bot's updates to your channel, we store the webhook URL you gave us until you remove it. We also fetch public top.gg statistics for listed bots from topstats.gg. For outreach, staff may keep a private list of bots and servers that could be listed, with their name, size and owner's Discord ID. It's never public. If we contact you, you can say no with one click, and we'll remember that so we don't ask again. Staff with a staff role in our Discord server are shown by name and avatar on the About page, unless they ask to be hidden.

Data	Source	Why	Legal basis (GDPR)	How long
Discord ID, username, avatar, the server tag you show on Discord, and anything you add to your profile, such as a banner, pronouns or location	Your Discord login	Running your account and showing your profile	Performance of a contract	Until you delete your account. Your Discord ID stays on the record, see section 6
Email address	Your Discord login	Telling you about your bot's review results	Performance of a contract	Until you delete your account
Session cookie	Set when you log in	Keeping you logged in	Performance of a contract	30 days, or until you log out
Partner application, and your partner listing if you're accepted: your name, email, Discord username and what you wrote. Your server's public description, images and links appear on the partners page; the rest stays with staff	You, when you apply	Deciding on your application and answering you	Legitimate interest (running the partner programme)	Until you delete your account
Beta invite: Discord ID and a staff note	Staff	Knowing who may use the site during the closed beta	Legitimate interest (running a closed test)	Until the invite is removed or you delete your account
IP address	Each request	Security and rate limiting; bot checks through Cloudflare Turnstile	Legitimate interest (security)	Used while handling the request. Up to 30 days in server logs
Salted hash of your IP, on each vote	When you vote	Detecting vote fraud	Legitimate interest (fair voting)	90 days, or until you delete your account
Votes	When you vote	Rankings, fraud checks, your own level and achievements, and telling a bot's developer who voted	Performance of a contract; legitimate interest (fair voting)	Kept after account deletion, without the IP hash
Level and achievements	Worked out from your votes, reviews, follows and listings	Showing your progress. Your level and voting achievements only show on your profile if you switch that on	Performance of a contract	Until you delete your account
Reviews	What you write	Showing them on the bot's page	Performance of a contract	Until you delete them or your account
Reports	What you send us	Handling them	Legitimate interest (safety)	24 months after we resolve them
Support tickets and sessions	What you send us	Giving you support	Performance of a contract	24 months after a ticket closes or a session takes place, also after account deletion
Bot listings	What you submit	Showing and reviewing your bot	Performance of a contract	Archived when you delete your account
Notifications	Things that happen on your account	Telling you about reviews, replies and bots you follow	Performance of a contract	90 days once read, 180 days at most, or until you delete your account
Bots you follow	When you press Follow	Your feed and notifications. Only the number of followers is public	Performance of a contract	Until you unfollow or delete your account
Profile details you add: bio, profile link, links, featured bot	What you enter	Showing your public profile	Performance of a contract	Until you change them or delete your account
Blacklist entries	Staff actions	Keeping the platform safe	Legitimate interest (safety)	24 months after they end
Audit log of staff actions	Staff actions	Accountability	Legitimate interest (safety)	Kept for as long as Nexobots runs, and can't be edited
Page views and invite clicks	Visiting a bot's page	Analytics for developers, counted per bot per day	Legitimate interest	Not linked to you
Site visits: the page, the site you came from, and a daily count of visitors	Your browser, when you open a page. Your IP address and browser type are turned into a code to count you once a day; the code is kept for two days and can't be linked between days. For a live count, it's also kept with the page you're on for up to an hour	Seeing how the site is used, as totals for our team	Legitimate interest	Not linked to you. Counts per page and per site for 120 days, daily totals for as long as Nexobots runs
Page-load timings	Your browser	Finding and fixing slow pages	Legitimate interest	Up to 30 days

Webhook delivery records are kept for 30 days and show that a delivery happened, not the voter's identity. During the closed beta, logging in without an invite stores nothing about you.

3. Who sees your data

The public

Your profile (username, avatar, bots you own, and any bio, profile link or links you add), reviews you write, and the bots and servers you list are public. So are templates, emojis and stickers you share, and your membership of a team, once you've accepted the invite. A review shows whether you voted for that bot. If your bots get votes, your username appears on the developer leaderboard. Which bots you follow and how you vote isn't public: your place among voters is only shown to you.

Bot developers

When you vote for a bot, its developer can receive your Discord ID, through their vote webhook or our API. They also see your username and avatar in their list of recent voters. They must handle this under our Data Processing Agreement.

Our staff

Staff can see what they need for their role, such as a bot owner's review history or a ticket they're handling. Staff actions are recorded in an audit log. When staff report a technical problem, their browser version is saved with the report.

Service providers

Hetzner: hosting of our servers.
Cloudflare: network, security, the Turnstile challenge and storing uploaded screenshots. Your traffic passes through Cloudflare, and Cloudflare may process data outside the EEA.
Discord: login, DMs from our bot, and ticket threads if you use them.
An email provider: delivers emails about your bot's review results. Ask us which one we currently use.
GitHub: hosts our code and our notes on technical incidents. We don't put user data there on purpose, though a staff member's description of an incident ends up in those notes.

Our monitoring (metrics, logs and page timings) runs on our own servers. We don't sell your data, and we don't show advertising.

4. Cookies

We use one cookie, nexo_sid, which keeps you logged in. It's strictly necessary, so we don't need a cookie banner. Cloudflare Turnstile may also use its own strictly necessary signals to tell people from bots. We don't use advertising or tracking cookies.

5. Automated decisions

Automatic checks flag bots for human reviewers, and flag suspicious votes for moderators. Flagged votes, and votes from accounts younger than 7 days, don't count publicly. People make the decisions to approve or deny a bot and to blacklist an account.

Staff also see a trust score for bot owners, worked out from things like account age, past reviews and upheld reports. It prompts a reviewer to look closer. It decides nothing by itself, and it isn't public.

6. Your rights

Under the GDPR, you have the right to access, correct, delete and export your data, to restrict or object to our use of it, and to withdraw any consent.

Download my data: available in your dashboard. It gives you your profile, the bots you manage, votes, reviews, tickets, ticket messages, sessions, followed bots and notifications as a file.
Delete my account: available in your dashboard. See below for what this does.
Anything else: contact [email protected]. We reply within one month.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority in your country.

What deleting your account does

Your username, avatar, email and bio are removed, and your account shows as "Deleted user". Your Discord ID stays on the record, because tickets and staff records point to it.
Your staff roles, beta invite, profile details, notifications, followed bots, reviews, vote reminders, vote streaks and bot team memberships are deleted, and you're logged out.
Bots, servers and templates you own are archived and removed from search. Emojis and stickers you uploaded are deleted. Teams you own are deleted, and you're removed from any others.
Your votes stay, because they make up vote counts and fraud history, but their IP hashes are removed.
Support tickets, blacklist entries and audit log entries stay for the periods in section 2. We keep these for safety and accountability.

Bot developers hold their own copies of votes they've received. We can't delete those for you, but they must respect your rights under the DPA.

7. Security

We encrypt traffic in transit, store API tokens only as hashes, restrict staff access by role, and keep an audit log that can't be edited. If a data breach is likely to put you at risk, we'll tell you and the regulator as the law requires.

8. Changes

When this policy changes, we update its version and changelog below. We'll tell you about significant changes.