Privacy policy
This is a translation provided for convenience. The French version is the authoritative one.
Toscio is a Discord bot for applications (whitelists, staff recruitment, team recruitment…) with a web dashboard. This page explains what data we process, why, for how long, and how to exercise your rights.
Data controller (for the data listed in section 2): Lucas BLANC, EI (sole trader), 59 rue de Ponthieu, 75008 Paris, France — contact@toscio.com.
1. Applications: Toscio acts on behalf of servers
When you apply on a Discord server that uses Toscio, that server's team decides which questions are asked and what happens to your application. For this data, the server is the controller and Toscio is its processor (article 28 of the GDPR): we process it solely to run the server's applications.
Data concerned: your Discord ID and username, your avatar, the date you joined the server, your Discord language, your answers (including any files you attach, kept as attachments of the staff card on Discord), the decision and its reason, if any, and the votes of staff members on your application. If a server excluded you from its applications (blacklist), it keeps your ID and the reason it gave. For a ban appeal, Toscio also checks with Discord that you are banned and reads the ban reason, if the server gave it that permission.
For any question about how a server uses your answers, contact its team. You can also use the /toscio privacy command at any time (see section 4).
2. Data for which Toscio is the controller
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Dashboard account: Discord ID, username and avatar, list of the servers you manage | Logging you in and checking your rights on each server | Performance of the contract | Session of 7 days at most, deleted when you log out |
| Web form login: Discord ID, username and avatar (not your server list) | Know who is applying and show you your application status | Performance of the contract | Session of 7 days at most, deleted on logout |
| “Stop receiving direct messages” preference | Respecting your choice | Legitimate interest | As long as the choice is active |
| Premium subscription: Stripe customer ID, status, dates | Providing and billing Premium | Performance of the contract | Duration of the subscription, then 3 years |
| Invoices | Accounting obligations | Legal obligation | 10 years |
| Technical logs (errors, security) | Running the service and protecting it from abuse | Legitimate interest | 90 days at most |
We do not read your Discord messages, do not sell any data, do not display advertising and do not use your data to train AI models. The dashboard only uses a session cookie required to log in, with no advertising trackers or audience measurement.
3. Retention of applications
- Processed applications (accepted or declined): deleted automatically after the period chosen by each server (1 year by default, between 30 days and 3 years).
- Applications started but never submitted: deleted after 24 hours.
- If Toscio is removed from a server: all of that server's data is deleted 30 days later.
4. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability.
- Directly on Discord: the
/toscio privacycommand shows what Toscio keeps about you, lets you download your data (JSON file) and delete it across all servers. - By email: contact@toscio.com. We reply within one month.
You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
5. Processors and transfers outside the EU
| Provider | Role | Data location |
|---|---|---|
| Supabase | Database | European Union (Paris) |
| Vercel | Hosting of the website and application | Worldwide, including the United States |
| Stripe | Payment and billing | EU and United States |
| Discord | Platform on which the bot runs | United States (Discord acts as an independent controller) |
| top.gg | Bot directory: tells us about votes (the voter's Discord ID) and receives the bot's server count | United States |
Transfers to the United States are governed by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.
6. Minors
Discord is open to users aged 13 and over, so minors may apply on servers. We ask server teams not to collect any sensitive data (health, religion, political opinions, sexual orientation…) or identity documents. Purchasing Premium is reserved for adults, or for minors with their parents' consent.
7. Security
Data encrypted in transit and at rest, restricted access, protected sessions, secrets stored outside the code. In the event of a data breach, we notify the affected individuals and the CNIL within the legal deadlines.
8. Changes
We may update this policy; the date of the last update is shown at the top of the page. Significant changes are announced on our Discord support server.