Who runs this?

• Company: Kamilake OÜ
• Registry code (registrikood): 17543398 (registered at Tartu Maakohtu registriosakond)
• Address: Sepapaja tn 6, 15551 Tallinn, Estonia
• Email: privacy@kamibot.app
• Service: Kamibot — a Discord bot + web dashboard (kamibot.app)

Kamilake OÜ is the "controller" as defined by the GDPR (EU 2016/679) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

What information do we collect?

Kamibot handles the information it receives in three broad groups: what we store, what we glance at and let go, and what we never receive at all.

① Information stored on Kamibot's servers

This is information we keep so your settings are still there when you come back.

• Discord user ID — a numeric ID used to link to your settings. Not your name or email, just an identifier.
• Login credentials (OAuth access/refresh tokens) — kept so you don't have to log in every time. Stored encrypted, and discarded immediately when you log out.
  💡 Alarmed by the word "token"? The token used for account hijacking and scams on Discord is the user token, which Kamibot never receives (and can't). What Kamibot keeps is an OAuth token, which only works within the scopes shown on the permission screen when you logged in (identify email guilds). It cannot send DMs/messages on your behalf, add/remove friends, change your password, or make payments. If you're unsure, you can revoke access with a single click anytime in your Discord authorized apps settings.
• TTS settings — the voice, speed, and similar settings you chose.
• Keyword alert settings — the list of words you asked to be DMed about.
• Per-guild (server) bot settings — settings a server admin created in the dashboard. Stored tied to the server ID.
• Session metadata — security information like your last login time. Used to block suspicious access.
• Bot command usage logs — a short record of which command was used and when. For abuse tracking and debugging.

② Information only shown on screen, not stored

Every time you open a settings page, we ask Discord again, and when you close the page nothing remains on Kamibot's servers. It was a pattern we stumbled on while trying to save storage, but it turned out to be a model example of the "data minimization" the GDPR recommends.

• Username / global name / avatar hash — fetched fresh each time to show your profile in the page header.
• List of joined guilds — for the "which server did I add this bot to?" jump buttons at the bottom of the settings page.
• Email — only when 2FA verification (e.g. token-hijack protection) is needed, we fetch it from Discord at that moment, verify, and discard it immediately. Email never enters Kamibot's database.

In GDPR terms this counts as "processing" but not "storage." So the retention period is effectively zero seconds, and even if Kamibot's DB were somehow leaked, this information wouldn't be exposed.

③ Information Kamibot never receives

• Passwords (handled by Discord. Kamibot neither sees nor receives them)
• Payment information (the service is free, so there are no payments at all)
• Ad/analytics trackers — we don't use things like Google Analytics, Meta Pixel, or Mixpanel
• Location tracking, advertising IDs, device fingerprinting

Why? (purpose & legal basis)

Where is it stored?

Kamibot runs on a fully self-hosted principle. Core features like TTS, AI chat, and voice processing all run on open-source models (VITS-based, etc.) on our own servers. That means we don't throw your data at external SaaS.

• Discord (Discord Inc., USA) — the platform the bot unavoidably goes through to work. Data flows only within the scope you already agreed to with Discord.
• Hosting — operated in an EU region. User data is stored on Kamibot's own servers.
• Overseas transfers — our goal is not to send data outside the EU except for Discord. If this changes, we'll state it here and apply the safeguards the GDPR requires (such as SCCs).

How long do we keep it?

• Login session cookie: discarded as soon as you close the browser or log out
• OAuth token: deleted at Discord's set expiry (usually 7 days) or immediately on logout + a revocation request to Discord
• Dashboard settings (TTS, keywords, etc.): until you delete them yourself or delete your account
• Per-guild bot settings: automatically deleted 7 days after the bot leaves the server
• Session metadata & command logs: kept up to 90 days for abuse analysis, then discarded
• Server access logs: kept up to 90 days for security, then discarded

Your rights

If you're in the EU/EEA, you have the following rights under GDPR Art. 15–22. In fact, wherever you live, Kamibot responds by the same standard.

• Right of access — request to be told what Kamibot holds about you
• Right to rectification — request that incorrect information be corrected
• Right to erasure (right to be forgotten) — request that everything be deleted
• Right to restriction of processing — request that processing be paused
• Right to data portability — receive the information we held in a portable format (JSON, etc.)
• Right to object — object to certain processing
• Right not to be subject to automated decisions (Art. 22) — explained separately below

How to exercise your rights

• Post in the inquiry forum of the Kamibot support server — convenient for general inquiries or a first point of contact
• Email privacy@kamibot.app — better for requests that need identity verification

Support server posts are public, so please send anything sensitive beyond your Discord ID by email. Whichever channel you use, we'll respond within one month (GDPR Art. 12(3)).

Any automated decisions?

AI or algorithms never make decisions alone that would significantly affect your life. The bot does automatically block abuse and spam, though — if you feel that's unfair, let us know via the support server or privacy@kamibot.app. A human will review it again.

You can file a complaint

If you're unhappy with Kamibot's processing, you can file a complaint with the Estonian data protection authority (Andmekaitse Inspektsioon, AKI — www.aki.ee) or the supervisory authority in your country of residence.

For children

Under Discord's terms, only those aged 13+ may use Kamibot. In some EU countries, only those aged 16+ can give valid consent on their own. If we find that a user under 16 signed up without a guardian's consent, we'll delete the information we received immediately.

Change history

• 2026-04-28: Initial draft
• 2026-07-06: Reflects completion of Kamilake OÜ incorporation (2026-07-02, registrikood 17543398)

View Terms of Service · Home