HR Protocol: Privacy Policy

Who is responsible

HR Protocol is Ridoco's pair of Discord bots, Rascal and Halcyon. Ridoco runs them from De Nieuwe Erven 3-12572, 5431 NV Cuijk, Netherlands (KvK 95439609 · BTW NL005153257B49). Contact: contact@doombringerz.com.

On the Doombringerz Discord server, Ridoco is the data controller. When the bots run on a server someone else owns, that owner decides to add them and which features are on. For that server the owner is the controller, and Ridoco processes the data for them under the Data Processing Agreement. Ridoco stays the controller for its own records, such as a paid plan and your opt-out and deletion requests.

What the bots read

The bots read every message posted in a channel they can see, also when you are not talking to them, and every direct message you send them. Messages from other bots are left out. The bots also see reactions, and members joining and leaving.

What the bots store

• Your Discord identity: your user ID, username and display name, and when the bots last saw you.
• Recent messages: the text of each message, with your user ID, the server, the channel and the time. The bots keep the last 100 messages per channel.
• Memories: messages the bots rate as important are copied into a longer-term memory. The bots also save facts about you: a name, a childhood name, preferences or pronouns you mention, and short facts the AI model draws from what you say. A server administrator can pin a memory.
• Mood and sentiment scores: a sentiment tool on Ridoco's server scores each message as positive or negative. From that the bots keep a mood, energy and affinity score for you per channel, a count of how often you talked to them, and a score on your reactions and interactions. These scores change how the bots talk to you. They are not used for moderation.
• Server features: XP and level, reputation, economy balance and transactions, daily streaks, halo votes, profile bio, colour and social links, birthday, timezone, AFK status, reminders, highlight keywords, watchlist, quiz scores, lore commands you use, event replies, suggestions, tickets, quotes, starboard posts and a linked Reddit username. Confessions are stored with a coded reference in place of your user ID.
• Moderation records: warnings with the reason and the moderator, bans, kicks and timeouts with the reason, automatic moderation hits with up to 200 characters of the message, joins and leaves, and alerts about new accounts or accounts without an avatar.
• Voice consent: if you agree to voice transcription, the server, your user ID and the time you agreed.
• Paid plans and usage: who bought a plan and for which servers, usage credits, and a usage log that holds a coded reference in place of your user ID.
• Your requests: whether you opted out, and a record of each /data-delete request with your user ID and the number of records deleted.

Why it is processed

• Reading and remembering conversations, writing replies, and keeping the scores that shape how the bots talk: Ridoco's legitimate interest in running community bots that can follow a conversation (Art. 6(1)(f) GDPR). You can object with /data-optout and /data-delete, or by email.
• Server features you use, such as XP, economy, profiles, reminders and tickets: to provide those features (Art. 6(1)(b)).
• Moderation records: the legitimate interest of the server and of Ridoco in keeping the server safe and its rules enforced (Art. 6(1)(f)).
• Voice transcription: your consent (Art. 6(1)(a)). You can withdraw it at any time with !voice revoke.
• Paid plans and usage credits: the contract with the person who bought the plan (Art. 6(1)(b)).
• Your opt-out and the record of a deletion request: to honour the request and to show it was carried out (Art. 6(1)(c)).

AI replies

Replies are written by a large language model, not by a person. Rascal and Halcyon are AI characters: ask one and it says so, and /privacy and !help say it too. AI output can be wrong or made up. Do not rely on it for legal, medical, financial or safety decisions.

For a reply, the bot gives the model your message and its context: your display name, the last 8 messages in the channel with the names of who wrote them, the names and user IDs of people you mention, what the bot remembers about you, your pronouns, and its mood towards you. Where the model runs:

• Ridoco's server: replies are written here by default. Fact extraction and the sentiment scores always run here. Nothing is sent outward.
• The server owner's computer: if the owner of a server runs the HR Protocol compute module, replies on that server go to their computer first. Your message and its context are then processed there.
• An external AI provider: Anthropic (Claude) or Google (Gemini), whichever Ridoco has set up, in the United States. It is only used for a reply to a message that mentions a bot, and only on a server where it is allowed. On a server someone else owns, that takes a paid HR Protocol plan and the owner's permission in the server settings. On the Doombringerz server, Ridoco decides. Ridoco can switch the external provider off for every server at once.

Voice

A server administrator can bring a bot into a voice channel. The bot then receives the audio of everyone who speaks there. Audio from people who have not agreed with !voice consent is dropped before anything is done with it. For people who have agreed, the audio is turned into text on Ridoco's server, through a temporary file that is deleted straight after. Neither the audio nor the text is stored. The text goes to the AI model on Ridoco's server, and the reply is posted in a text channel.

When a bot speaks a reply in a voice channel, the text of the reply is turned into audio. By default Microsoft's online speech service does this.

Who receives data

Ridoco does not sell your data. Other members of a server see what the bots post there, such as replies, leaderboards, profiles and quotes. Beyond that, data reaches these recipients:

• netcup: the server the bots and their database run on. European Union.
• Discord: the platform the bots run on. United States.
• doombringerz.com, which Ridoco also runs. The bots send it your XP, level, rank, reputation, profile bio and social links, economy balance, whether you administer the server, activity counts, tickets, and moderation entries with your display name and up to 500 characters of the reason. They ask it whether your linked account is verified as 18 or older. Through the HR Protocol dashboard, the site can read a server's recent messages, memories and interaction records. Only accounts given access to that server, and Ridoco, can open them.
• Cloudflare: carries the connection between doombringerz.com and the bots' server. United States.
• Anthropic or Google: replies on the external AI tier, as described above. United States.
• Microsoft: spoken replies. The text of the reply is sent. United States.
• Sentry: error reports from the bots. Request bodies and the values held in the code at the moment of the error are removed before a report is sent. EU and United States.
• Pollinations.ai: free image generation, and a last-resort voice for spoken replies. For an image you consent on the command, and your prompt becomes part of a public web address. For a voice, the text of the reply is sent.
• Fish Audio: spoken replies, only where a server administrator connects their own Fish Audio key. The text of the reply is sent.
• SIMKL, Spotify and YouTube: title, track and video lookups, only where a server switches that module on with its own key. The words you search for are sent.

Transfers outside the EU

The bots and their database run in the European Union. Discord, Cloudflare, Anthropic, Google, Microsoft and Sentry can process data in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses together with encryption in transit.

Pollinations.ai and SIMKL are reached without a contract and state no processing location. No transfer safeguard has been agreed with them. Fish Audio, SIMKL, Spotify and YouTube lookups run on a key the server supplies, under the terms the server accepted with that provider. Each of these stays off until a server turns it on. A Pollinations image also needs your consent on the command.

Retention

• Recent messages: the last 100 per channel. Older ones are deleted as new messages arrive, and none is kept longer than 365 days.
• Memories: 30 days. A memory a server administrator pinned stays until it is deleted.
• Facts about you (a name, preferences, pronouns and facts the AI model drew from your messages): no time limit.
• Mood, energy and affinity scores, and your entry in the bots' list of names: no time limit.
• Reactions and interaction records: 365 days.
• XP and level, economy balance, daily streak, reputation total, profile, birthday, timezone, AFK status, highlights, watchlist, quiz scores, quotes, tickets and suggestions: until they are deleted.
• Economy transactions, reputation history, halo votes, lore commands, joins and leaves, warnings, automatic moderation hits and new-account alerts: 365 days.
• Reminders: until they are sent, and after that up to 365 days from when you set them.
• Bans, kicks and timeouts a moderator records: no time limit.
• The usage log: 365 days.
• Voice audio and transcripts: not stored. Your voice consent: until you withdraw it.
• Your opt-out and the record of a deletion request: no time limit.
• Service logs: the bots keep up to 4 log files of 5 MB each, and the oldest is overwritten. A log line can hold your user ID, your display name, the first 60 characters of a message that mentions a bot, and the first 80 characters of a voice transcript. The bots also write to the server's system log.
• Backups: where a backup of the bot database was made before you deleted your data, your data stays in that copy until the backup is replaced. The backup tool keeps the 14 most recent copies.

Deleting your data and opting out

• /data-delete deletes what the bots hold about you, on every server, in one go. You confirm with a button within 60 seconds, and only you can press it. It deletes your recent messages, memories, saved facts, scores, name list entry, reactions and interactions, XP and level, economy, profile and feature records, reminders, warnings, bans, kicks and timeouts about you, automatic moderation hits, tickets, suggestions, quotes of you, confessions, your voice consent, usage credits, and your rows in the routing and safety logs. Where you acted for someone else, such as a warning you gave as a moderator or an event, poll or role menu you set up, your user ID is replaced with "[deleted-user]" and the record stays.
• Some records stay: whether you opted out and the record that a deletion happened; the subscription of a paid plan you bought, without your Discord ID, because it still pays for the servers on it; the owner record of a server you own while the bot is in it; and copies in service logs and backups, which run out as set out under Retention. Ask Ridoco at the address above to remove any of these by hand. Copies the bots sent to doombringerz.com are covered by the site privacy policy.
• /data-optout stops the bots saving your messages, reactions, saved facts and profile memory, updating your mood and affinity scores, keeping your name in their list of names, counting your XP and sending activity points to doombringerz.com. Facts and scores already stored stay out of replies while you are opted out. The bots still answer you, and commands you run yourself and moderation keep working. Use /data-delete to remove what is already stored.
• !forget deletes your memories with the bots in that server. !forget followed by some text deletes only the memories that contain it.
• !voice revoke withdraws your voice consent.
• /privacy shows a summary of this policy in Discord.

Your rights (GDPR)

You can ask for access (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18) and a copy in a machine-readable format (Art. 20), and you can object to processing (Art. 21). The bots have no export command. Ask for a copy by email. Email contact@doombringerz.com, or open a support ticket on doombringerz.com. Ridoco answers within 30 days. For a server someone else owns, Ridoco passes your request on to that server's owner. You also have the right to complain to the Autoriteit Persoonsgegevens in the Netherlands, or to the data protection authority where you live.

Children

The bots have no age check of their own. Adult content is only allowed in a channel marked as age-restricted, for members with the server's adult role, or for members whose linked doombringerz.com account is verified as 18 or older. If Ridoco learns it holds data of a child below the applicable age without permission, it deletes that data.

Changes

When this policy changes, the change is shown on this page and emailed to doombringerz.com account holders who have not switched off legal updates. The date at the top shows when it last changed.