Skip to content
Back to home

Privacy Policy for AgencyMod

Last updated: 1 October 2026

This privacy policy explains how we process personal data when AgencyMod is used on a Discord server, when you use the dashboard at bot.agencyscripts.dev and when you buy AgencyMod Premium. AgencyMod is a Discord bot for moderation, tickets, logs, welcome messages, button roles, FiveM tools, monitoring, a server list and optional AI features.

1. Controller

Agency Scripts, Sole Proprietor: Leon Rudolf
Die Halde 2, 64853 Otzberg, Germany
Email: [email protected]
Legal notice: agencyg.de/impressum

2. How AgencyMod works

Server administrators add AgencyMod to their Discord server and decide in the dashboard which features are switched on. AgencyMod only processes the data that the switched-on features need. Most features work on data that Discord sends to every bot on a server. We do not sell personal data and we do not use it for advertising profiles.

3. Data we process

3.1 Discord data on servers that use AgencyMod

Server ID, name and icon; IDs and names of channels and roles; IDs, usernames, display names, avatars and roles of members; the date a member joined. Discord provides this data to the bot. We use it to run the features a server has enabled, for example welcome messages, automatic roles, moderation commands and logs.

3.2 Message content

AgencyMod reads messages in channels it can see, in order to provide the enabled features (for example spam and link filters, ping protection, the counting game, commands and AI answers when AgencyMod is mentioned). Message content is processed in memory and is not stored in our database, with these exceptions that a server can switch on:

  • Logs: the content of deleted or edited messages is posted into the log channel of that server on Discord.
  • Ticket transcripts: when a ticket is closed, a transcript is posted into the server's transcript channel and, if enabled, sent to the person who opened the ticket.
  • Applications: the answers to an application form are stored until a decision is made and for 90 days afterwards.
  • Spam protection: When auto moderation removes a message, we store a case with the user ID, channel, rule, detected keywords, the text of the message and the text that the text recognition found in attached images. The removed image itself is deleted and is neither stored nor shown again anywhere. With the case, the server's moderators can lift a punishment or report a false detection to us.

Images and text recognition: When image recognition is switched on, AgencyMod briefly loads images posted in channels into memory, creates a checksum (MD5) of each image and reads the text in the image with a text recognition program (Tesseract) that runs on our own server in Germany. The images are not passed on to anyone for this and are not stored by us. AgencyMod keeps checksums and a member's latest messages in memory for at most 10 minutes to recognise the same message or the same image in several channels.

3.3 Data stored in our database

  • Server settings from the dashboard, including texts the server writes itself (welcome messages, custom commands, AI instructions and knowledge).
  • Warnings: user ID, moderator ID, reason and time.
  • Tickets: channel, opener, category, status and times (no message content).
  • Counting game: current number, last user and record.
  • Applications (see 3.2).
  • Tebex: if a server connects its own Tebex store, the redeemed transaction IDs and the Discord user who redeemed them. The Tebex secret key of that server is stored encrypted at rest on our server and is never shown again in the dashboard.
  • Monitors: the targets a server wants to watch (websites, ports, game servers) and their status.
  • Server list: the public information a server chooses to publish (name, icon, description, tags, member count, invite link) and bump times.
  • Premium: status, type, runtime and payment references (see 3.5).
  • AI usage: counters per server and day (number of requests and tokens), without content.
  • A change history of dashboard settings (who changed what and when), limited to the last 500 entries per server.
  • Tebex purchase logs: for every purchase that Tebex reports to the bot, the transaction ID, the packages bought, the amount, the buyer's name in the store and the status (no email addresses, no IP addresses, no real names).
  • Reviews: if you review a server (in the server list or in Discord), your Discord user ID, display name, profile picture, the stars, your text and the time. Name, picture, stars and text are public: on the server's page in the server list, in the server's Discord channel and in the widget the server can embed on its website. You can change or delete your review yourself at any time.
  • Documentation knowledge: if a server links public documentation pages, AgencyMod fetches these pages (respecting robots.txt) and stores their visible text to answer questions about them.
  • Uploaded images: images a server uploads in the dashboard (backgrounds, logo, profile picture and banner of the bot). Embedded metadata such as camera or location data is removed on upload.
  • Team access: the roles and user IDs a server gives access to its dashboard, with the areas they may change.
  • Spam protection: strikes per server and user ID (number, latest reason, time) and the cases described in 3.2.
  • Shared scam image blocklist: when an image is recognised as a scam advertisement, we store its checksum (MD5), the detected keywords, the score, the time and the server on which it was recognised. The list applies to all servers that use AgencyMod and contains neither the image nor any user data.
  • Reported false detections: when a moderator reports a false detection, we receive the case (message text, text recognised in the image, rule and punishment), the server name, the user ID of the reporting person and their note. The report appears in an internal channel of our Discord server that only our team can see, so that we can check and improve the detection.

3.4 Dashboard login

You log in with Discord (OAuth2, scopes identify, guilds and guilds.join). We receive your Discord user ID, username, avatar and the list of servers you are a member of, including your permissions there, so that we can show only servers you are allowed to manage. We do not receive your email address or password. With guilds.join, AgencyMod adds you to the Discord server of Agency Scripts right after you log in, where you get support and news, just like when you log in to our shop. Discord asks for this permission on its login screen, and you can leave that server at any time without any effect on the dashboard. Your login is kept in a signed, encrypted session cookie for up to 7 days.

3.5 Payments

Premium is paid through PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). PayPal processes your payment data under its own privacy policy. We receive and store the order or subscription ID, the amount, the currency, the status, and the Discord user and server the purchase belongs to. We keep these records for 10 years, because German tax law requires it.

3.6 AI features (Premium)

If a server switches on AI features, the question, a limited part of the recent conversation in that channel or ticket, and the instructions and knowledge text written by the server are sent to a specialised AI provider based in the USA to generate an answer. We name the provider on request. The provider processes the data on our behalf and may keep it for up to 30 days to detect abuse; it does not use it to train its models. We do not store the content of AI requests. AI answers are marked as AI answers.

If an admin uses the setup assistant, their request, the server's settings without secrets and the names of its channels and roles are sent to the provider. If a server has linked documentation pages, matching excerpts of these pages are sent along with questions.

For the AI protection of auto moderation (Premium), the text of a message and, if present, the text recognised in attached images are sent to the provider for checking.

3.7 Website

The website bot.agencyscripts.dev is delivered through Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which processes your IP address to deliver the page and to protect it against attacks. Our own web server logs requests without IP addresses. We only use technically necessary cookies (login session, language).

3.8 YouTube videos

Our start page shows a video that is hosted on YouTube. It is only loaded when you click on it: before that, the page shows an image from our own server and your browser does not connect to YouTube. After your click, the video is loaded from YouTube in privacy-enhanced mode (youtube-nocookie.com), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives your IP address, the page you came from and technical data about your browser, and may also process data in the USA. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR); if you do not want this, simply do not start the video. More in Google's privacy policy: policies.google.com/privacy

3.9 Withdrawal and cancellation

With “Withdraw from contract” and “Cancel contracts here” at the bottom of every page you can withdraw from a Premium purchase or cancel a subscription, also without logging in. We process your name, your email address, the details of the contract, for a cancellation its type, its time and any reason you give, an optional message, the language of the form and the time of receipt, and if you are logged in, also your Discord user ID. We need this to process your statement, to refund money and to confirm receipt by email as required by law (§§ 312k and 356a of the German Civil Code). We use your IP address only briefly in memory to slow down abuse; it is not stored. The emails are sent on our behalf by Brevo (see section 5).

3.10 Applications on the website

If a server has turned on applications on its page in the server list, you can sign in there with Discord and fill in a form. We then store your answers together with your Discord user ID, your name and your profile picture and show them to that server's team in its review channel on Discord and in its dashboard; that team decides on your application. If you choose “Sign in with Discord and join” and the server has turned this on, AgencyMod adds you to that server via the guilds.join permission, instead of the Agency Scripts Discord server. Applications are deleted 90 days after the decision.

3.11 Social alerts, patch notes and GitHub

For social alerts, patch notes and GitHub, our server in Germany fetches publicly available pages and feeds, for example from YouTube, Twitch, Kick, TikTok, Reddit, Bluesky, Medal, Steam and game publishers, the same way a browser would. We only store what a server has set up (name, link and picture of the followed account, game or repository, channel, role, filters, custom message), the IDs of posts that were already announced so nothing is posted twice, and the time of the last check. In the dashboard your browser does not load pictures of channels, games and repositories from these services but through our server. For GitHub every server gets its own webhook address with its own secret. What GitHub sends there (for example commit messages, titles of pull requests and issues, GitHub usernames and avatars of the people involved) is posted as a message in the chosen Discord channel. Of this we only keep a short log of the last 15 deliveries (event, repository, result, time). With Premium, AgencyAI can summarise patch notes; only the public text of the patch notes is sent to the AI provider, no user data. The legal basis is Art. 6(1)(b) GDPR towards the server using the feature and Art. 6(1)(f) GDPR, as this is content its creators have made public themselves.

3.12 Medal clips and affiliate links

AgencyMod is a partner of Medal (medal.tv). When someone posts a link to a Medal clip, our server fetches the public clip page to show title, game, creator and views in a card; the result is only kept briefly in memory. The button "Clip your games with Medal" and Medal links with the addition via=tdysky are affiliate links: if someone installs Medal through them, Agency Scripts may receive a commission. Nothing changes in price for you, and we do not learn who clicked. Only when you click such a link does your browser connect to Medal and its partner service Dub (dub.co), which may process your IP address and set a cookie for attribution; Medal and Dub are responsible for that themselves. With Premium a server can hide the button.

3.13 Automatic roles for Tebex purchases

If Tebex reports a purchase made with a Discord account (stores with Discord login), we use the Discord user ID from that report to give the buyer the configured roles on this server and, if the server has switched it on, to send a thank-you message. If the buyer is not on the server yet, we keep the user ID and transaction ID until they join, at most as long as the Tebex purchases themselves. When a subscription ends, AgencyMod removes the roles again if the server wants that.

3.14 Role memory

If a server has switched on "Role memory", we store your Discord user ID, the IDs of your roles on that server and, if set, your nickname there when you leave the server, so you get them back when you rejoin. Banned members are not remembered. The data is deleted when you rejoin, at the latest after the period set by the server (at most 365 days). The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is that members do not have to set everything up again after leaving.

3a. AgencyMod Webstore

For shops operated by servers with AgencyMod (for example at name.agencyg.de), we process visitor data on behalf of the respective operator (Art. 28 DSGVO). The controller is the operator whose legal notice and privacy policy are linked in the shop. The following are processed: during visits, technical data for delivery (via Cloudflare, our web server logs without IP addresses); upon login with Discord, the Discord ID, name, and profile picture; in addition, shopping cart, orders with the Tebex cart identifier, submitted product reviews, loyalty points, and, if the shop uses the AI button, questions asked to the assistant. If the operator has enabled Discord join, AgencyMod adds logged-in buyers to their Discord server. The payment itself takes place entirely on Tebex. We delete shop data 30 days after a shop ends, and we retain orders for as long as statutory retention periods require.

4. Purposes and legal bases

  • Providing AgencyMod and the dashboard as requested by server administrators and users: Art. 6(1)(b) GDPR.
  • Moderation, security, preventing spam and abuse on servers that use AgencyMod, and keeping the service stable: Art. 6(1)(f) GDPR. Our legitimate interest, and that of the server communities, is a safe and working service.
  • Payments and tax records: Art. 6(1)(b) and (c) GDPR.
  • Text recognition in images, the shared scam image blocklist and the review of reported false detections: Art. 6(1)(f) GDPR. Our legitimate interest, and that of the server communities, is to stop scams and spam quickly and across all servers and to correct false detections.
  • Processing withdrawals and cancellations with the confirmations of receipt required by law: Art. 6(1)(b) and (c) GDPR.
  • Social alerts, patch notes, GitHub notifications, clip cards, automatic roles for purchases and role memory, as set up by the respective server: Art. 6(1)(b) and (f) GDPR.

5. Recipients

Discord Inc. (the platform the bot runs on), Cloudflare (website delivery), PayPal (payments) and the AI provider (only for AI features). AgencyMod itself runs on our own server in Germany. We only pass on data where it is necessary for the purposes above or where we are legally obliged to do so.

Brevo (Köpenicker Str. 126, 10179 Berlin, Germany) sends our emails on our behalf, for example the confirmation of a withdrawal or a cancellation.

6. Transfers to countries outside the EU

Discord, Cloudflare and the AI provider are based in the USA. Transfers take place on the basis of the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Retention

  • All data of a server is deleted 30 days after AgencyMod is removed from that server. Administrators can also delete it at any time in the dashboard.
  • Warnings are kept until a moderator removes them, or until they expire according to the server's setting.
  • Ticket data is deleted 90 days after the ticket was closed.
  • Applications are deleted 90 days after the decision.
  • AI usage counters are deleted after 90 days.
  • Payment records are kept for 10 years (tax law).
  • The login cookie expires after 7 days at the latest.
  • Tebex purchases are deleted 400 days after the purchase.
  • Reviews stay until you delete them or the server deletes its data; if AgencyMod is removed from the server, they are deleted after 30 days.
  • Uploaded images that are no longer used are deleted after 3 days.
  • Documentation texts are refreshed daily and deleted as soon as the server removes the links.
  • Spam protection cases are deleted after 30 days, reported false detections after 90 days and strikes one year after the latest hit.
  • Entries on the scam image blocklist remain until we remove them after a review, for example after a reported false detection.
  • Withdrawal and cancellation statements are part of the payment records and are kept like them.
  • The state of social alerts, patch notes and GitHub checks (IDs of announced posts) is deleted as soon as the server removes the entry, at the latest together with all data of the server.
  • Patch note summaries by AgencyAI are deleted after 60 days.
  • The GitHub log only contains the last 15 deliveries.
  • Pending roles from Tebex purchases are deleted as soon as the buyer joins, at the latest after 400 days.
  • Remembered roles are deleted when the member rejoins, at the latest after the period set by the server (at most 365 days).

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To use these rights, write to [email protected] or open a ticket in the category AgencyMod on help.agencyg.de. Please include your Discord user ID.

You also have the right to lodge a complaint with a supervisory authority, for example: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

9. Children

AgencyMod is meant for people who meet Discord's minimum age in their country. We do not knowingly collect data from children below that age.

10. Changes

We update this policy when AgencyMod changes. The current version is always available at bot.agencyscripts.dev/privacy.

See also: Terms of Service