Member data and privacy

Toscio stores as little as possible, for as short as possible, and lets every member see, download and delete their own data without asking anyone. This page is for both members and server admins.

What Toscio keeps

About an applicant, for each application:

• Discord ID, display name and avatar;
• the date they joined the server and their Discord language;
• their answers, including the choices they picked;
• for file questions: the name, size and type of each file, and a link to it. The files themselves are stored as attachments on the staff card, in the server's Discord staff channel;
• for a ban appeal: whether the person is banned, and the ban reason if Toscio can read it;
• the decision, who made it, and the decline reason if any;
• if the server uses staff votes: who voted for or against.

Also kept:

• whether the member turned off Toscio's DMs (the Stop these messages button), so that choice keeps being respected;
• for people who apply on a web form: a login session for 7 days at most. Logging in with Discord only shares your Discord ID, username and avatar: not your servers, not your messages. "Log out" on the form page ends it;
• for admins who use the dashboard: a login session (Discord ID, name, avatar and the list of servers you manage), for 7 days at most;
• for admins who pay for Premium: Stripe customer ID, subscription status and invoices.

Toscio does not read your messages, sell data, show ads or use your data to train AI models.

Data is stored in the European Union (Paris). The full list of providers is in the privacy policy.

For members: see, download or delete your data

Type /toscio privacy. It works in any server that has Toscio and in DMs with the bot. Only you see the answer.

Toscio tells you how many applications it keeps about you and on how many servers, with three buttons:

Download my data

Click Download my data. A few seconds later, you get a file named toscio-donnees.json, visible only to you, with everything Toscio keeps about you: your applications on every server, your DM preference, and whether you have a dashboard session or a Premium subscription.

Delete my data

1. Click Delete my data.
2. Read the warning: "Permanently delete all your applications on every server? Servers will no longer be able to see them."
3. Click Yes, delete everything (or Cancel).

This deletes all your applications on every server, your dashboard and web form sessions, and, if you're on a server's staff, the votes you cast. Two things are kept, on purpose:

• your DM preference, so Toscio keeps respecting it;
• invoices, if you paid for Premium, because the law requires keeping them.

Deleting from Toscio doesn't remove messages already posted in Discord, like the application card in a server's staff channel and the files attached to it. Those are Discord messages managed by each server's staff: ask them if you want those removed.

Stop direct messages

Every DM from Toscio (application decisions, vote thank-you) has a Stop these messages button. Click it and Toscio won't DM you anymore. Turn messages back on reverses it. Staff are told to contact you another way.

For admins: your responsibilities

When members apply on your server, your server decides what is asked and what happens with the answers. Toscio processes the applications on your behalf. The "Settings" page of the dashboard, under "Personal data", reminds you of the essentials:

• Don't ask for sensitive data: health, religion, political opinions, sexual orientation, and no ID documents. Discord members can be as young as 13. With file questions, this includes photos or scans of ID cards.
• Only ask what you need to decide.
• Members can always use /toscio privacy. If a member asks you to delete the staff card in your channel, delete that Discord message yourself: its attached files go with it.
• The CSV export (Premium) puts applicant data in a file on your computer: keep it private and delete it when you no longer need it.

Set how long applications are kept

1. Open app.toscio.com, pick your server, then "Settings".
2. Under "Keeping applications", pick a "Retention period": 30 days, 90 days, 180 days, 1 year, 2 years or 3 years.
3. The choice is saved at once: "Retention period saved".

How it works:

• the default is 1 year;
• only reviewed applications (accepted or declined) are deleted when the period is over, counted from the decision;
• pending applications are never deleted automatically;
• applications that were started but never sent are deleted after 24 hours.

Keep them as long as your recruitment needs, no longer: that's what the GDPR asks.

If you remove Toscio from your server

When the bot leaves a server, all that server's data (forms, applications, settings) is deleted 30 days later. If you add Toscio back before then, nothing is lost. Invoices are kept for legal reasons.

Deleting a form in the dashboard deletes its applications immediately: see Form editor.

Questions

Read the privacy policy and the terms, or write to contact@toscio.com. For a question about how a specific server uses your answers, contact that server's staff.