Privacy Policy

The data controller for the Service is PEAK AGENCY LLC, a California limited liability company. For any privacy question or request, contact us at [email protected] or via our Discord support server. PeakBot consists of two connected services: the Dashboard (web application at peakbot.pro) and the Discord Bot (added to Discord servers by their administrators). The bot operates inside Discord servers owned and administered by third parties and reads, creates, modifies, and deletes server resources on behalf of server administrators.

Where GDPR or similar laws apply, we rely on the legal bases noted in brackets:

• To authenticate you and operate your account, the dashboard, the AI Server Builder, and the bot features you or your server administrator enable [performance of a contract];
• To process subscriptions and payments through Stripe, send billing-related notices (renewal reminders, payment-failure notices), and keep required financial records [contract; legal obligation];
• To send you service messages via Discord DM — such as trial or renewal notices, cancellation confirmations, win-back offers after you cancel, and feature notifications you can control in your dashboard settings [contract; legitimate interests];
• To secure the Service: rate limiting, abuse and fraud prevention, anti-raid protection, hashed-IP login checks, and admin action audit logs [legitimate interests];
• To understand and improve the product through first-party analytics and A/B experiments, reviewed in aggregate [legitimate interests];
• To monitor AI usage and costs and enforce fair-use limits [legitimate interests];
• To comply with law and respond to lawful requests [legal obligation].

We do not use your personal information for third-party advertising, and we do not make decisions with legal or similarly significant effects about you by automated means. AI moderation acts only within your Discord server under rules its administrator configures, and its actions can be reviewed and reversed by the server’s moderators.

We do not sell your personal information. We share data only with the service providers that make PeakBot work, listed with details on our subprocessors page:

• Discord — authentication and all bot operations in your servers;
• Anthropic, Google (Gemini), OpenAI, Cohere — AI processing. Your AI Builder messages and relevant server context are sent to these providers to generate responses; message content is sent to OpenAI’s Moderation API when AI Moderation is enabled. Under the API terms we use, none of these providers use your data to train their models; they may retain inputs briefly for trust-and-safety monitoring under their own policies;
• Pinecone — stores vector embeddings for our knowledge retrieval system; these are derived from documentation and template content, not from your personal data;
• Stripe — payment processing. Your payment details go directly to Stripe; we receive only billing metadata (customer ID, subscription status, amounts);
• Railway — hosting for our application, databases, and Redis;
• Google Analytics — website usage measurement (Section 9);
• YouTube, Twitch, Roblox, Disboard — only when you use the corresponding integration, as described in Section 2;
• Legal requirements — we may disclose data when required by law, or to protect the rights, safety, or property of Peak Agency, our users, or others.

If Peak Agency is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction; we will notify you of any change in ownership or in how your data is handled.

• PostgreSQL databases (Railway): account, billing, analytics, and AI usage data for the dashboard; a separate database holds all bot feature data (configurations, XP, moderation logs, transcripts, backups, and the rest of Section 2.2).
• Redis (Railway): chat sessions, rate-limit counters, OAuth tokens, usage tracking, and caches.
• Bot memory: short-lived caches (30 seconds to 10 minutes) for spam detection and settings, cleared automatically.
• Your browser: your sign-in token, cached profile, and preferences are kept in local storage on your device (Section 9).

Databases are encrypted at rest; all data in transit uses HTTPS. Internal service-to-service calls are authenticated with signed tokens and secrets, raw IP addresses are hashed before storage, and administrative actions on our side are audit-logged. No method of transmission or storage is 100% secure and we cannot guarantee absolute security — but if a breach affects your data, we will notify you and the relevant authorities as required by law (including within 72 hours where GDPR applies), and we will notify Discord where its Developer Terms require it.

• Server Members intent: powers welcome/goodbye messages, invite tracking, anti-raid detection, activity tracking, and inactive-member management.
• Message Content intent: powers auto-moderation, AI moderation, spam detection, auto-responders, XP tracking, ticket transcripts, and Disboard bump detection — handled as described in Section 2.3.

You can request deletion of your personal data at any time by emailing [email protected] (subject: “Data Deletion Request”) with your Discord username/ID, or through our Discord support server. We will verify the request and complete deletion within 30 days, except for records we must keep by law (e.g., billing records) or for legitimate security purposes — and we will tell you if anything is retained and why.

When PeakBot is removed from a Discord server, that server’s cached data is cleared immediately and its stored data is deleted within a reasonable period, consistent with Discord’s Developer Policy. Server administrators can also delete specific data themselves at any time through the dashboard or bot:

• reset XP/leveling for a user or the whole server;
• delete warnings and moderation log entries;
• delete tickets and their transcripts;
• delete server backups, polls, giveaways, and events;
• delete Roblox links and webhooks created through PeakBot;
• disable any feature to stop its data collection going forward.

PeakBot sets one first-party cookie of its own:

• peakbot_locale — remembers your language preference (1 year).

Google Analytics 4 sets cookies to distinguish users and sessions:

• _ga and _ga_<ID> — analytics identifiers (expire after 2 years). We use GA4 for measurement only — not for advertising — with all advertising signals disabled via Google Consent Mode. Visitors in the EEA, UK, and Switzerland are asked for consent before these cookies are set and can decline; everyone can opt out with the Google Analytics Opt-out Browser Add-on or by clearing site data to be asked again.

We also use browser local/session storage (not cookies) for your sign-in token, cached profile, language, dashboard preferences, demo-mode flags, and a per-tab analytics session ID. This data stays on your device until you log out or clear your browser data.

Do Not Track: some browsers send a “Do Not Track” signal. There is no common industry standard for responding to it, and we do not respond to DNT signals at this time. Note that Google Analytics may collect information about your activity over time across our site; we do not permit third parties to collect personal information about your activity across other sites for advertising.

Regardless of where you live, we give you the right to access the personal data we hold about you, to correct it, to delete it (Section 8), to object to or ask us to restrict certain processing, and to receive a portable copy of data you provided. To exercise any of these, email [email protected]; we respond within 30 days (one month where GDPR applies).

If you are in the EEA, UK, or Switzerland, additionally:

• our legal bases are listed in Section 3, and where we rely on legitimate interests you may object at any time;
• where processing is based on consent, you may withdraw consent at any time without affecting prior processing;
• you have the right to lodge a complaint with your national supervisory authority (Art. 77 GDPR) — though we’d appreciate the chance to resolve your concern first;
• providing your Discord account data is necessary to create an account; the Service cannot be provided without it.

You can also limit collection at the source: disable individual bot features (stops that feature’s collection), leave servers that use PeakBot, or revoke PeakBot’s OAuth access in your Discord settings.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising. The categories of personal information we collect are described in Section 2; the categories of third parties that process it are in Section 4. You may review, correct, or request deletion of your information using the process in Sections 8 and 10 — these rights are available to all users, including California residents. Our Do Not Track disclosure is in Section 9. When we make material changes to this policy, we notify users as described in Section 14 and update the effective date at the top of this page.

Because we do not sell or share personal information for advertising, opt-out preference signals such as Global Privacy Control do not change how we process your data — there is nothing to opt out of.

We are a U.S. company and your data is processed in the United States, where our service providers are also located. Where data is transferred from the EEA, UK, or Switzerland, we rely on appropriate safeguards — our providers’ data processing agreements incorporating the European Commission’s Standard Contractual Clauses and, where applicable, their EU–U.S. Data Privacy Framework certifications.

The Service is not directed to children under 13 (or the higher minimum age Discord requires in your country), and we do not knowingly collect personal information from them. If we learn we have collected personal information from a child below the applicable age, we will delete it and terminate the account. Parents or guardians can contact us at [email protected].

We may update this policy as the Service evolves. If a change is material, we will notify you through the Service, our Discord server, or the contact details on your account before it takes effect, and we will update the effective date at the top of this page. Prior versions are available on request.

PEAK AGENCY LLC
Privacy contact: [email protected]
Discord: Discord support server