This policy explains what personal data RecheBot processes, why, for how long and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). RecheBot does not sell data, shows no advertising and uses no analytics tools.
This is an English translation provided for convenience. The Spanish version is the legally binding one and prevails in case of any discrepancy.
Who is responsible for your data
RecheBot involves two different roles depending on the type of data:
| Data | Controller | Role of Luis Reche |
|---|---|---|
| Data about your activity in a specific server: giveaways, entries, winners, levels, vouches, scammer flags, announcements and server configuration | The Discord server, represented by its administrators (for example, the streamer) | Processor, under the Data Processing Agreement |
| Account data not tied to a server: linked Steam account, Steam Trade URL, verification tokens and technical and security logs | Luis Reche | Controller |
- Controller (account data)
- Luis Reche, natural person. Tax ID (NIF) [NIF pendiente]. Address: [Domicilio pendiente]
- Privacy contact
- rechedev@hotmail.com
Luis Reche has not appointed a data protection officer because he is not required to (Article 37 GDPR and Article 34 LOPDGDD).
What data is processed
Account data (controller: Luis Reche)
- Discord user ID: the public numeric identifier of your account, which links the rest of the data.
- Verified Steam account: your SteamID64 and the verification date, obtained when you sign in to Steam with
/steam vincular. RecheBot receives only your SteamID64 from Steam; it never sees your password. - Steam Trade URL and the date you saved it. If you save it without having verified Steam, RecheBot derives an unverified SteamID64 from it.
- Steam verification tokens: a random single-use code linked to your Discord ID and to the server you requested it from, valid for 10 minutes.
- Steam account age: not stored. If a giveaway requires it, it is fetched from the Steam Web API using your SteamID64 and the result is kept in memory only, for at most 10 minutes.
- Technical logs of the bot and the web server: events, errors, Discord and server identifiers and, for visits to the web pages, the IP address and browser.
- Emails you send to rechedev@hotmail.com.
Server data (controller: the server)
- Server and configuration: server ID and name, configured channels and roles, anti-scam guard settings and blocked domains (with the ID of whoever added them).
- Giveaways: prize, image and declared value, requirements, ID of the creator, dates, seed hash and seed.
- Entries: your Discord ID and the time you entered.
- Winners: Discord ID, selection date, draw data (seed, number of entries, whether it was a redraw), a copy of your Trade URL at that moment so staff can send you the prize, notification date and delivery date with the ID of whoever marked it.
- Activity: message count, date of the last message, XP and level in each server. Message content is not stored.
- Vouches: who gives it, who receives it, the written comment and the date.
- Scammer flags: flagged user, reason, ID of the staff member who set it, and date. The reason is visible to staff only, but the neutral "Under review" role that is assigned may be visible to members depending on the server's settings. Flags are never shared between servers.
- Scheduled announcements and role panels: announcement text, channel, time, author and the roles offered.
Data that is read but not stored
- Anti-scam guard (only if the server enables it): reads message content transiently to look for dangerous links and does not store it. If it finds one, it posts an alert in the server's log channel with your ID, the channel, the reason and the detected domains (neutralised so they cannot be clicked), and may delete the message or time you out depending on the server's configuration. It also compares your display name with the staff's when you join or change it, and only alerts staff if it looks like impersonation.
- Middleman helper: creates a thread in the server itself; RecheBot does not store its content.
Direct messages
RecheBot sends you direct messages only for the Steam verification link you request and, if you win a giveaway, to ask for your Trade URL. Those messages remain in Discord.
What is published on transparency pages
So that anyone can verify a giveaway, its public page (/sorteos/{id}) shows, without signing in: the prize and status, the seed hash, the seed once revealed, the Discord ID and time of each entry, and the Discord ID of each winner together with the delivery status (including winners replaced by a reroll, marked as such), and the server ID. These pages are public to anyone who knows a giveaway link.
Usernames, Trade URLs, SteamIDs and other Steam data are not published. Even so, a Discord ID lets anyone who looks it up find your Discord profile, so entering implies that publication. If you do not want your ID to appear, do not enter giveaways.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing your giveaway entries, drawing winners and notifying you if you win | Performance of the service you request by entering (Art. 6(1)(b)) |
| Publishing the transparency page and keeping the record of giveaways already held | Performance of the service (Art. 6(1)(b)) and the legitimate interest of the organizer and participants in the giveaway being verifiable (Art. 6(1)(f)) |
| Storing your Trade URL so the organizer can deliver a prize | Performance of the service you request (Art. 6(1)(b)) |
| Linking and verifying your Steam account and checking its age when a giveaway requires it | Consent, which you give by signing in to Steam and can withdraw at any time (Art. 6(1)(a)) |
| Levels, leaderboard, vouches, announcements and role panels | Performance of the service the server provides to its members (Art. 6(1)(b)) |
| Anti-scam guard and scammer flags | The server's legitimate interest in protecting its community from scams (Art. 6(1)(f)), processed on behalf of the server |
| Technical logs, security and abuse prevention | Legitimate interest in keeping the service secure and running (Art. 6(1)(f)) |
| Answering your emails and requests | Your request and compliance with legal obligations regarding data subject rights (Art. 6(1)(b) and 6(1)(c)) |
Where the basis is legitimate interest, it has been assessed that the processing is limited and expected in a Discord community and does not override your rights. You can object at any time, as explained below.
Automated decisions
Winner selection is random and requirement checks (role, time in the server, verified Steam account, one entry per Steam account and Steam account age) are automatic, following the organizer's configuration. The anti-scam guard may also automatically delete a message or time you out if the server has configured it that way.
These decisions do not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Even so, you can ask the server staff for human review and to express your point of view.
Recipients
- Hetzner Online GmbH (Germany): hosting provider. Data is stored on a server located in Helsinki (Finland, European Union). It acts as processor (or sub-processor).
- Discord Inc. (United States): RecheBot works inside Discord, so the bot's messages, alerts and direct messages pass through its platform, which processes that data as an independent controller under its own privacy policy.
- Valve Corporation (United States): when you link Steam you sign in directly on Steam, and RecheBot queries the Steam Web API for your account's creation date when a giveaway requires it. Valve acts as an independent controller.
- Server staff: see anti-scam alerts, scammer flags and, if you win, the copy of your Trade URL in order to send you the prize.
- The general public: the transparency information described above.
- Authorities: only where there is a legal obligation.
Data is not sold or shared for commercial or advertising purposes.
International transfers
RecheBot's database is in the European Union. Using Discord and Steam means your data is also processed in the United States by those companies. Those transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Decision (EU) 2023/1795) where the recipient participates in it and, otherwise, on the standard contractual clauses approved by the Commission. See Discord's and Valve's privacy policies for more detail.
How long data is kept
| Data | Period |
|---|---|
| A server's data | While RecheBot is in the server. Deleted 30 days after the bot is removed. |
| Linked Steam account and Trade URL | Until you delete them with /privacidad borrar or ask by email. |
| Steam verification tokens | Valid for 10 minutes; they expire and are cleaned up periodically, at the latest when the next token is created. |
| Steam account age | Not stored; in memory only, for at most 10 minutes. |
| Technical logs | Rotated by size (about 30 MB in total), which usually means a few days. |
| Backups | 14 days. Deleted data may remain in them until they expire. |
| Emails | As long as needed to handle your request and then blocked for the limitation periods of any possible liability. |
Records of giveaways already held
When you delete your data, entries and prizes of giveaways that have already closed are not deleted but pseudonymised: your Discord ID and Trade URL stop being shown (the public page and its JSON show a "[deleted]" marker in your position, and the copy of your Trade URL is erased), but the ID is kept internally, not displayed, so the draw order and selection can be reproduced. This keeps the giveaway history verifiable for the other participants, who have a legitimate interest in the outcome of a giveaway already held not being altered afterwards.
Your rights
You can exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw your consent at any time without affecting earlier processing.
- From Discord:
/privacidad vershows the data RecheBot stores about you and/privacidad borrardeletes it (with the pseudonymisation described for giveaways already held). It does not remove review flags a server's staff has placed on you or the record of which staff member performed an action: contact that server's staff for those. - By email: write to rechedev@hotmail.com stating your Discord ID. To prevent impersonation, you may be asked to confirm the request from your Discord account.
For a server's data, the controller is that server, so you can contact its administrators. If you write to RecheBot, whatever can be resolved with /privacidad will be handled and the rest will be passed on to the server, which will be helped to respond.
You will receive a reply within one month, extendable by two further months for complex requests, in which case you will be informed. If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country of residence.
Minors
RecheBot is not directed at children under 14. If you are under 14, do not use it. If a parent or guardian finds that a child under 14 has provided data, they can write to rechedev@hotmail.com to have it deleted. You must be over 18 to receive a prize.
Security
- The web pages and Steam verification work only over encrypted connections (TLS).
- The database is not reachable from the internet.
- The bot runs in containers with the minimum privileges needed and credentials have restricted access.
- Steam verification tokens are random, single-use and expire after 10 minutes.
- Nightly backups are made and kept for 14 days.
RecheBot will never ask for your Steam password or Steam Guard codes. Be wary of anyone who does so in its name.
Changes to this policy
If this policy changes, the new version will be published here with its date and, for significant changes, advance notice will be given on this site. In case of discrepancy between language versions, the Spanish version prevails.