1. Project and privacy contact
Mishae is a non-professional personal project operated in France by _alwvys, with development help from myana. These are public pseudonyms. _alwvys is responsible for publication and personal-data requests. Contact: mishaesupport@mishae.fr.
The team operates the website and bot infrastructure. Server administrators decide which modules to enable, which actions to request and who can read their Discord log channels. They remain responsible for their own use of member data. Contact us if you need clarification about a particular processing operation.
2. Data, sources and purposes
Discord authentication supplies your account ID, username, display name, public avatar, banner and public badges where available, plus your server list. Membership, roles, join dates, channels, permissions and voice state come from Discord to enforce access, render profiles and operate selected features. A Nitro badge is shown only when Discord returns an authorized, confirmed subscription status; it is not inferred from your avatar.
Stored configuration includes server, channel and role IDs, language, colour, enabled modules and custom welcome text. Invitation tracking records member/inviter associations, join/leave information and counts to credit unique members who remain in the server and prevent duplicate rejoin credits. Moderation stores identifiers, warning/sanction reasons and counters, and temporary-ban expiry information.
Enabled anti-spam and anti-link rules inspect incoming messages. Selected logs may publish message content, role/profile changes, invitations, voice events or moderation actions to the configured Discord channel. Message content may be unavailable if it was not received by the bot. Music processes your query, track links, requester identity, voice channel and queue through the configured Lavalink nodes and music sources. Voice connection information is used to play audio; Mishae has no voice-recording feature.
Network and security processing may involve IP addresses, request metadata, errors and connection times. Support processes the contact details and information you choose to send. Do not include sensitive information in welcome text, sanction reasons or public support messages.
3. Legal bases and required information
Providing the dashboard and features you request relies on performance of the service agreement where applicable (GDPR Article 6(1)(b)). Access checks, abuse prevention, service security and proportionate technical diagnostics rely on legitimate interests (Article 6(1)(f)). Server moderation and invitation processing concern legitimate interests in server administration and abuse prevention, subject to members’ rights and the administrators’ responsibilities. Handling rights requests and binding legal demands relies on applicable legal obligations (Article 6(1)(c)).
OAuth authorization grants technical access to Discord data; it is not blanket consent to unrelated uses. Required identifiers and permissions are necessary for sign-in or the selected feature; without them access or that feature may be unavailable. We do not sell personal data, use it for targeted advertising, or make automated decisions producing legal or similarly significant effects. Automatic server moderation follows the administrator’s rules; ask the server moderators to review a sanction.
4. Infrastructure, hosting and security
The website and bot run on an OVHcloud VPS. The primary server infrastructure is hosted in France. Hosting provider: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, RCS Lille Métropole 424 761 419. Hosting provider’s legal information.
Cloudflare manages the domain’s DNS. Where Cloudflare’s proxy services are enabled, they can improve performance, route web traffic and protect against malicious activity, including DDoS attacks. With DNS-only records, website traffic goes directly to the host: Cloudflare’s web proxy protections and cache do not apply. Depending on the services used, Cloudflare may process technical information, including IP addresses and connection or DNS metadata, across its global infrastructure. Cloudflare Privacy Policy.
We work to protect personal information and handle it in accordance with applicable data-protection law, including the GDPR. Current measures include HTTPS, protected server-side credentials, session and CSRF checks, permission checks and restricted file access. No system can guarantee absolute security. Report a concern privately to mishaesupport@mishae.fr.
Music service authentication
The project uses a dedicated Google account authorized by its publisher to authenticate the YouTube audio service. No Google account is requested from dashboard users or server members. Its renewal credential is stored in a separate private server file, outside the website and member database, while the service is used and until access is revoked or the credential is removed. Google processes the service requests under its own privacy policy. This service credential is separate from the temporary Discord dashboard sessions described below.
5. Recipients and international processing
The project team accesses data as needed for operations and support. Authorized server managers access their settings; Discord channel permissions determine who can read bot messages and logs. Discord processes authentication, API requests, images and posted attachments under its Privacy Policy. Loading Discord images connects your browser to its CDN.
Active persistent data is now held in a private SQLite database on the OVHcloud VPS, alongside the Lavalink audio service. The database has no public network port. Temporary copies from the former storage are retained separately while the migration is validated. Music searches and playback still involve external content and metadata providers. France-based primary hosting does not mean that all processing remains in France. Discord, Cloudflare and other technical providers may process data outside the EEA. Applicable contractual safeguards must be verified for each provider; we do not guarantee France-only processing. Contact the privacy address above for current details.
6. Retention and deletion
Server settings, invitation associations and moderation records are retained while Mishae remains installed. Removing the bot schedules deletion from the active database after 30 days. Reinstalling it before the deadline cancels that deletion. The cleanup runs hourly while the bot and database are available; an interruption delays execution. Removals discovered after downtime start a fresh 30-day period when confirmed. A Discord outage or unavailable server alone does not trigger deletion.
Invitation associations remain after a member leaves while the bot is installed, to prevent duplicate rejoin credit. A targeted rights request may require deletion, correction or anonymisation sooner, depending on its scope and applicable exceptions. No active-database deletion is presented as deletion of independent Discord messages or provider backups.
Dashboard account profiles and OAuth tokens are kept in server memory for at most eight hours within the token’s validity. Sign-out removes the relevant active session; a bot restart clears memory sessions. OAuth state expires after ten minutes and sign-in IP rate-limit entries after one minute. Music queues and recent history are held for the playback session in memory. Messages and /profile images or JSON snapshots posted to Discord remain until deleted there, subject to Discord’s own policy. A private database snapshot is created daily, with the seven latest snapshots retained on the VPS. These backups expire by rotation and are not immediate deletion from every copy. Temporary migration copies, infrastructure logs and support correspondence have separate retention arrangements that are still being documented; contact us for their current status.
8. Your rights and how to exercise them
Write to mishaesupport@mishae.fr to request access, rectification, erasure or restriction. You can object to processing based on legitimate interests. Portability applies where its legal conditions are met. If a processing activity relies on consent, you may withdraw it without affecting earlier lawful processing. These rights have legal conditions and exceptions, including other people’s rights.
Provide your Discord ID, the relevant server ID if needed, and your request. We may ask for proportionate additional proof only where there is reasonable doubt about identity; do not send an identity document unless specifically necessary and requested. Requests are normally free and answered within one month of receipt. Where permitted because of complexity or number of requests, this may be extended by two months with notice and reasons within the first month.
You may lodge a complaint with the CNIL or another competent supervisory authority. Contacting Support first is not a condition for exercising this right.
9. Updates
This policy is reviewed when features, providers or retention arrangements change. Material changes will be communicated through the website or Support where appropriate. The version date is shown above.