Privacy Policy

1. Data We Collect

Depending on how you interact with us, we may collect:

• Discord account data: your Discord user ID, username / tag, avatar, server membership, and roles. Discord provides this to our bot when you join or interact with the server.
• Onboarding answers: if you tell us how you found us (Google, YouTube, Discord, Twitch, or other) during onboarding, we log that selection to help us understand where our members come from.
• Support & ticket content: the messages, attachments, and forwarded clips you send in support or purchase tickets (including messages you send to our automated assistant) so we can help you and keep a record of the order. When a ticket is closed a transcript of the conversation is saved.
• Purchase & invoice data: the buyer, seller, product, price, chosen payment method (e.g. PayPal, Cash App, gift card), and order date. We do not collect or store your full card, bank, or payment-account details. Those are handled directly between you and your payment provider.
• Verification data: if you verify through Discord on our website, we use Discord's OAuth to receive your user ID, username, and avatar, and to record that you are verified.
• Reviews: if you submit a review, we store and publicly display your Discord identity, star rating, and review text.
• Invite / referral data: to run invite rewards, we record which member invited which other member, and invite-use counts.
• Voice presence: our music features can see which voice channel you are in so the bot can join it. We do not record or store any audio.
• Safety-scanning data: to protect members, our bot automatically screens messages, links, images (using on-device text recognition), and file names for scams and malware. Content flagged as harmful may be removed and logged to a staff-only channel.
• Website analytics: our site records anonymous, aggregate visit counts using a random identifier stored in your browser. This contains no name, no account data, and no IP address, and is not used to track you across other sites. We also use Vercel Web Analytics, which is cookieless: it records the page visited, the referring site, and coarse details such as country, browser, and device type. Vercel derives a temporary anonymous identifier that is discarded daily, so it cannot follow you between sessions or across other sites.

2. How We Use Your Data & Legal Bases

We use your data for the following purposes. Where the GDPR applies, our legal basis is shown in brackets:

• To process orders, deliver products, issue invoices, and grant purchased access (performance of a contract)
• To provide support and respond to tickets, including via our automated assistant (contract / legitimate interests)
• To run community features such as welcomes, roles, reviews, invite rewards, and music (legitimate interests)
• To detect and prevent scams, malware, fraud, chargebacks, and abuse, and to moderate the community (legitimate interests)
• To understand where members come from and improve our services (legitimate interests)
• To send you service-related messages, such as order confirmations and transcript links, via Discord (contract / legitimate interests)

Where we rely on legitimate interests, we balance those interests against your rights and only process what we reasonably need.

3. Automated Assistant & AI Processing

To help buyers quickly and to screen for scams, some message content is sent to our AI provider, Groq, which runs the large-language models that power our ticket assistant and scam detection. This can include the messages you send in a purchase ticket and text found in messages or images being screened. This content is used only to generate a helpful reply or a scam/safe decision in the moment. We do not use it to build advertising profiles.

4. Who We Share Data With

We do not sell, rent, or trade your personal data. We share data only with the service providers we need to operate D10 Leaks:

• Discord: the platform our community and bot run on, and our verification login (Privacy Policy)
• Vercel: hosts our website and its API endpoints, and provides the cookieless Vercel Web Analytics described in section 1 (Privacy Policy)
• Upstash: the database that stores our invoices, ticket transcripts, verification records, and analytics counts (Privacy Policy)
• Groq: the AI provider that powers our assistant and scam detection (Privacy Policy)
• GitHub / jsDelivr: public hosting for the website's background music files
• Google Fonts: serves the fonts used on our website; when a page loads, your browser's IP address is shared with Google to fetch them (Privacy Policy)
• Payment providers (PayPal, Cash App, and gift-card issuers): you transact with these directly; we never receive your full payment credentials

We may also disclose data where required by law or to protect our rights, our members, or the public.

5. International Transfers

Several of the providers above are based in the United States and other countries outside the EU/EEA and UK. This means your data may be processed outside your home country. Where required, we rely on those providers' safeguards (such as Standard Contractual Clauses) for these transfers. By using our services you understand that your data may be handled in these locations.

6. How Long We Keep Data

• Invoices / receipts: kept for up to about 3 years as proof of purchase and for fraud prevention.
• Ticket transcripts stored on our website: kept for about 90 days, then deleted.
• Verification records: kept while you remain verified, and removed on request.
• Reviews, invite records, and order history: kept while you are part of the community and for a reasonable period afterwards for record-keeping, unless you ask us to delete them.
• Website analytics: aggregate counts only, retained for up to about 90 days; live-visitor data clears within minutes. Vercel Web Analytics keeps its own aggregate statistics for a limited window set by our hosting plan, currently about 30 days.
• Discord membership data: held for as long as you remain in our server.

When data is no longer needed, we delete it or remove information that identifies you. You can ask us to delete your data sooner (see your rights below).

7. Your Rights

Depending on where you live, and in particular if you are in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Object to, or ask us to restrict, certain processing
• Request a copy of your data in a portable format
• Withdraw consent where we rely on it, without affecting past processing

To exercise any of these rights, contact us via Discord and we will respond within a reasonable time, normally within one month. If you are in the EU/EEA or UK and believe we have mishandled your data, you also have the right to complain to your local data-protection supervisory authority.

8. Children

Our services are not directed at children under the minimum age required to use Discord (13, or higher where local law requires). We do not knowingly collect data from anyone below that age. If you believe a child has provided us with personal data, contact us and we will remove it.

9. Cookies & Local Storage

Our website does not use advertising or cross-site tracking cookies. The only identifier we set is a random, anonymous ID stored in your browser's local storage to count unique visits. It holds no personal information and is not shared with advertisers.

10. Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or loss, including access-controlled links for invoices and transcripts. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the latest revision. We encourage you to review this page periodically.

Contact

Privacy questions or data requests? Reach us on Discord (discord.gg/d10leaks).