Privacy policy

Who is responsible?

For your Foldy account and purchases, the controller is the publisher: Foldy, support@foldy.fr. For the content of archived servers (members' messages, names, avatars and roles), the controller is the server administrator using Foldy; Foldy processes it on their behalf (GDPR, Article 28).

Your account data

• Discord identity (ID, display name, avatar) received when signing in with Discord (“identify” and “guilds” scopes). We never receive your e-mail or password. Basis: contract.
• Encrypted Discord access tokens, to list the servers you administer when you open it. Basis: contract.
• Sessions (a hash of the session token and its dates). Basis: contract and security.
• Servers where you installed Foldy, your rights and consents. Basis: contract.
• Plan and payments (plan, duration, amount, date, invoice number). Your e-mail and payment details are collected directly by SellAuth, our payment provider. Bases: contract and accounting obligations.
• Security log of important actions, and technical server logs containing IP addresses. Basis: legitimate interest.

No data is sold or used for advertising or profiling.

Members of archived servers

On a server where the administrator installed Foldy, the bot copies readable messages, attachments, members' names, avatars and roles. Each member can refuse archiving with the /foldy optout command. Archives are private by default; an administrator may make an archive public, readable by anyone without an account from the “Discover” page. Any member appearing in a public archive can remove their messages and profile with the “Remove my messages” button (sign-in with Discord to verify it is them); removal is immediate for all public archives of that server.

Retention

• Account: while active; deleted after 3 years without sign-in, or on request.
• Sessions: 30 days after last activity. Security log: 12 months.
• Archives and backups: until deleted by a server administrator.
• Technical logs: a few days to a few weeks. Accounting records: 10 years, kept by our payment provider.

Recipients

Our host (hosting provider, France), Cloudflare (files stored in the EU), Discord Inc. (USA) and SellAuth (payments). Transfers outside the EU rely on an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses.

Your rights

Access, rectification, erasure, restriction, objection and portability. The “My account” page shows the data kept and lets you delete your account; otherwise write to support@foldy.fr. We answer within one month. You may lodge a complaint with the CNIL (www.cnil.fr) or your country's data protection authority.