Privacy policy

Who is responsible?

For your Foldy account and purchases, the controller is the publisher: Papery, contact@papery.my. For the content of archived servers (members' messages, names, avatars and roles), the controller is the server administrator using Foldy; Foldy processes it on their behalf (GDPR, Article 28).

Your account data

• Discord identity (ID, display name, avatar) received when signing in with Discord (“identify” and “guilds” scopes, plus “guilds.join” to add you to the Papery Discord server at sign-in). We never receive your e-mail or password. Basis: contract.
• Encrypted Discord access tokens, to list the servers you administer when you open it. Basis: contract.
• Sessions (a hash of the session token and its dates). Basis: contract and security.
• Servers where you installed Foldy, your rights and consents. Basis: contract.
• Plan (current plan, Discord subscription identifier, end date). Payment is handled by Discord: your payment details stay with Discord. Bases: contract and accounting obligations.
• Security log of important actions, and technical server logs containing IP addresses. Basis: legitimate interest.

No data is sold or used for advertising or profiling.

Members of archived servers

On a server where the administrator installed Foldy, the bot copies readable messages, attachments, members' names, avatars and roles. Each member can use the /foldy erase command: after signing in with Discord, the “My data” page lists the archives they appear in (without letting them read them) and lets them immediately remove their messages, files and profile from all archives of a server; their future messages are no longer copied there. Archives are private by default; an administrator may make an archive public, readable by anyone without an account from the “Discover” page. Any member appearing in a public archive can remove their messages and profile with the “Remove my messages” button (sign-in with Discord to verify it is them); removal is immediate for all public archives of that server.

Retention

• Account: while active; deleted after 3 years without sign-in, or on request.
• Sessions: 30 days after last activity. Security log: 12 months.
• Archives and backups: until deleted by a server administrator.
• Technical logs: a few days to a few weeks. Accounting records: 10 years, kept by our payment provider.

Recipients

Our host (VeryCloud SAS, France), Cloudflare (files stored in the EU), Discord Inc. (USA, including subscription payments). Transfers outside the EU rely on an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses.

Your rights

Access, rectification, erasure, restriction, objection and portability. The “My account” page shows the data kept and lets you delete your account; otherwise write to contact@papery.my. We answer within one month. You may lodge a complaint with the CNIL (www.cnil.fr) or your country's data protection authority.