Data processing agreement
Version 2026-08-17
If you run a server on behalf of an organisation, a business or a client, you are the controller for the data Kottos processes there and you need this agreement. Most servers are private and do not.
The parties
You, as the operator of the Discord server named in your dashboard, are the controller. Kottos is the processor and acts only on your instructions.
Subject and duration
Processing lasts as long as Kottos is present in your server. It ends when the bot is removed, and the data it holds is deleted with it.
Data and data subjects
Discord user IDs, message metadata and whatever each enabled module declares it stores. Every module's declaration lists what it collects, what it exports and what it erases.
Security of processing
Data is held in Germany. Credentials are encrypted at rest, access is limited to what a service needs, and no production data is ever used in testing.
Sub-processors
Hosting in Germany, Discord as the platform the data originates on, and Stripe for payments where a subscription exists.
Your rights and ours
Export and erasure are available per guild and per user. Kottos assists with any request a data subject makes to you.
To conclude this agreement, write to privacy@kottos.app naming your server. Conclusion is recorded with the document version, the date and your Discord user ID.