Privacy Policy

Controller and scope

This Privacy Policy explains how the operator of the Splash service (operating under the name “Splash Studio”, based in Slovakia) handles personal information in its Discord bot, website, dashboard and connected features. Privacy and data-rights contact: support@splashstudio.net. The service is operated independently of Discord. This notice applies when you directly use Splash or when your activity in a server with Splash enabled is processed for a configured function.

Discord server administrators may separately determine their servers’ moderation purposes, configurations and retention. Depending on the particular processing, they may have their own duties to tell members about their use of bots. Paddle is a separate controller for its checkout and sales operations.

Information we receive

• Discord identity and server details: user and server IDs, username/display name, avatar reference, roles, authorization permissions, membership and relevant guild/channel identifiers when needed for access and features.
• Moderation and safety events: relevant member joins, account age indicators, actions, role/channel changes, audit-log metadata, incident identifiers, moderation reasons, limited event timestamps and outcomes used by enabled security rules.
• Message handling: where message-content access and filters are enabled, messages and associated metadata may be examined to apply AutoMod rules. The documented similarity system uses bounded hashed samples, not a permanent raw message history. Configured moderation log channels, ticket/report/appeal channels in Discord may contain user-supplied text under the server’s own retention controls.
• Account and preferences: server settings and revisions, browser-local sample settings, local preferences, account-linked session data and requests submitted to us.
• Optional Google Drive: connection status, limited app-accessible file metadata and encrypted OAuth tokens when you choose to connect; the existing integration can list eligible files and move a selected file to Trash after confirmation. It does not automatically back up or restore your Discord server.
• Optional Google Ads measurement: on public marketing and policy pages only, and only after you accept, Google receives page visits and related browser, URL/referrer, network and advertising measurement signals. The tag does not receive Discord API data. Your choice is stored in this browser for up to 180 days.
• Purchases: Paddle subscription and transaction identifiers, plan/add-on, period, status, entitlements and subscription management links needed to fulfil a purchase. Paddle collects and processes payment card and billing details; Splash does not ask for or store full payment-card numbers.
• Technical information: necessary request, diagnostic, anti-abuse and security data, such as request time, IP address and user agent, which may be processed by Cloudflare or hosting services to deliver and secure the website.

The exact categories depend on which features are enabled, permitted Discord intents and the data actually sent by those platforms. We do not request your Discord password.

Purposes and legal bases

• Contract and requested service (GDPR Article 6(1)(b)): provide authorized login, server selection, configuration, moderation functions, subscriptions and user-requested integrations.
• Legitimate interests (Article 6(1)(f)): protect the Service and participating communities against abuse, diagnose problems, prevent fraud and maintain a minimal operational/security audit, balanced against individuals’ rights.
• Legal obligation (Article 6(1)(c)): comply with applicable law and valid requests, preserve records where required and respond to enforceable legal duties.
• Consent (Article 6(1)(a)), where required: optional processing that genuinely requires consent, with the ability to withdraw it without affecting prior lawful processing. Discord/Google permission prompts also govern access to those platforms, but are not a blanket GDPR legal basis for every activity.

We do not sell or share Discord API data with data brokers, use it for third-party advertising or use Discord message content to train AI models. We do not make solely automated decisions producing legal or similarly significant effects under GDPR Article 22; however, a server administrator may choose automated Discord moderation actions with real community effects.

Who receives information

Information may be processed by Discord to receive events and execute authorized bot actions; Cloudflare for website delivery, security challenges and D1 storage; BisectHosting or our bot host for the Discord runtime and limited operational records; Google for the Drive connection when you enable it and for optional Google Ads measurement when you accept it; and Paddle for sales, invoices, tax, subscription management and refunds. Authorized server staff can see information posted to their configured Discord moderation, ticket, report or appeal channels.

We disclose information to competent authorities if lawfully required, and may use professional advisers or narrowly scoped providers under appropriate safeguards. We do not disclose Discord API data to advertising networks. Each independent provider also has its own terms and privacy notice: Discord, Cloudflare, Google and Paddle.

How long information is kept

We keep personal information only for its stated purpose and applicable legal or security requirements. Server configuration may be retained while the server uses Splash and is needed for its operation. Encrypted website login sessions expire after up to eight hours. The documented bot’s minimal local action journal generally retains records for 30 days; event counters and similarity samples are temporary rather than indefinite raw-message archives. Paddle and other legally necessary purchase records may be retained longer under statutory accounting, tax and dispute obligations. Connected Google tokens persist until disconnection, revocation or an applicable deletion process; no Google Drive file is deleted just because you disconnect.

Data posted in a Discord channel is subject to that channel’s or Discord’s retention and deletion controls, not solely Splash’s local storage. Cloudflare and other infrastructure providers have their own limited security-log and backup schedules. After a valid deletion request, we remove data that is no longer needed, subject to lawful exceptions, technical backup rotation and relevant security obligations.

Cookies, browser data and security

The Service uses strictly necessary security/session cookies for Discord login, sign-in state and anti-abuse checks; these are not advertising cookies. Browser-local storage may keep visual preferences and separate sample configuration or backup previews on the device. Clearing browser data can remove samples, but it does not necessarily remove server-side account or subscription records. Cloudflare Turnstile may process device and network signals to distinguish automated traffic from legitimate use. Google Ads measurement runs only on public marketing and policy pages after you choose “Accept optional measurement.” If you withdraw a prior choice, the loaded tag receives denied consent updates; pages opened afterward honor the denial and do not load the tag. “Privacy choices” lets you change or withdraw that choice, which is saved in this browser for up to 180 days. Google may process measurement information under its own privacy terms. Our site does not use Discord API data for behavioral ad tracking.

We use measures such as short-lived encrypted sessions, encrypted connection tokens, restricted service credentials, access checks and verified payment webhooks. No system is infallible; report suspected privacy or security issues to the contact below.

International processing

Discord, Paddle, Cloudflare, Google and hosting providers may process personal information outside Slovakia or the European Economic Area. Where the GDPR requires transfer protections, applicable transfer mechanisms may include European Commission adequacy decisions or Standard Contractual Clauses with any necessary supplementary safeguards. Ask us for information relevant to a particular transfer.

Your rights and choices

Depending on your location and applicable law, you may request access, correction, deletion, portability or restriction of your personal information, object to processing based on legitimate interests, withdraw consent where that is the basis, or complain to a supervisory authority. EEA users can contact the Slovak Office for Personal Data Protection or their competent local authority. We may need to verify identity and assess exemptions before completing a request, and will respond within applicable legal deadlines.

For the website, open Account settings while signed in and select Request data deletion. This creates a request for manual review; it is not immediate automated erasure. You can also email support@splashstudio.net for access, correction, objections and other rights. Discord members who do not have a Splash website account may email directly with the relevant user/server context. Do not send passwords or tokens.

Removal, third-party files and subscriptions

Removing the bot from a Discord server stops new events from that server being received through that installation, but existing records may still require deletion or limited lawful retention. Signing out expires your website session; it does not delete server records, Paddle subscriptions, or data held independently by Discord. Disconnecting Google prevents further access with the disconnected authorization but does not erase your files from Google Drive. Request deletion separately if appropriate.

To stop recurring Paddle billing, use the cancellation link on your Paddle receipt or Paddle Buyer Support. A Splash data-deletion request does not itself cancel billing.

Age and sensitive information

Splash is intended for users who meet Discord’s applicable minimum age and all relevant local requirements. We do not knowingly seek data from children below those limits, or seek sensitive personal information for general moderation. Do not submit health, payment-card or other sensitive data to tickets, reports or general bot commands unless a specific lawful function clearly requires it. If you believe data was collected contrary to these requirements, contact us.

Updates to this notice

We will update this policy when our actual processing, providers or applicable obligations change, with effective-date changes and additional notice or consent where law requires. We will not silently expand Discord API data uses beyond purposes allowed by Discord’s rules. The most recent policy is posted at splashstudio.net/privacy.

Contact and complaints

Privacy, deletion, security and data-rights requests: support@splashstudio.net. We may need to confirm the relevant account or Discord server to protect other people’s data. For payment information controlled by Paddle, consult Paddle’s Privacy Policy and its buyer-support tools.