Privacy Policy

1. Summary

This policy explains what personal data we collect when you use our website (nekokoneko.org) and the Manolo Discord Bot, why we collect it, the lawful basis for processing, how long we keep it, who we share it with, and your rights under the GDPR. For details about how data is used in relation to the Services, see sections below. (Short version: we collect account identifiers, Discord IDs, usage/log data and keep only what’s needed to run and secure the Services.)

2. Data we collect

We collect the following categories of personal data:

• Account data: username, encrypted password, email address (if provided), account settings.
• Identifiers: Discord ID, Supremacy ID (when you link accounts).
• Usage & technical data: IP address, timestamps, activity logs, error/diagnostic logs.
• Support & correspondence: private messages and email records when you contact support.
• Cookies & similar technologies: session cookies and (with consent) analytics cookies. (We do not collect special categories of personal data (sensitive data) without explicit consent).

3. Purposes & lawful bases

We process personal data for the purposes below and rely on the indicated lawful basis for each processing activity (Article 6 GDPR):

• To provide and operate the Services (account creation, Discord linking, in-service features): Performance of a contract (necessary to provide features you request).
• To secure the Services, prevent abuse, and detect fraud (logs, IPs, security monitoring): Legitimate interests (protecting systems and users). We perform a balancing test and minimise data where possible.
• To send transactional emails (account notices, critical updates): Performance of a contract / legal obligation.
• For support and correspondence (responding to support requests): Performance of a contract / legitimate interest.
• To comply with legal obligations (e.g., responding to lawful requests): Legal obligation.

4. Recipients and processors

We do not sell or share your personal data with third parties for advertising or marketing purposes.

The only external recipients of personal data are:

• Discord Inc. - The Manolo bot necessarily transmits user IDs and commands to Discord’s platform in order to function.
• OVH US LLC dba OVHcloud - Our hosting provider supplies the infrastructure on which our services run. They act solely on our instructions as a data processor and cannot use your data for their own purposes.
• Google LLC (Analytics) - With your consent, we may use Google Analytics to understand how visitors use our site. Analytics cookies collect usage data (such as pages visited, time spent, device type) and transmit it to Google servers. These cookies are non-essential and are only set if you provide consent. You can withdraw consent at any time.

International transfers

Some providers (for example, Discord Inc.) are located outside the EU/EEA. When personal data is transferred outside the EU/EEA, we rely on EU Commission adequacy decisions or Standard Contractual Clauses (SCCs) to safeguard your data.

Aside from the parties listed above, your data remains under the control of La Nutria Network.

5. Retention

We retain personal data only as long as necessary for the purpose it was collected and to comply with legal obligations. Below are the retention rules we apply; where we use the word “permanently” this means the data will be retained indefinitely unless you request deletion — in which case we will act as described for each category.

• Account data (while account active): Account data (username, email if provided, account settings) is retained permanently while you do not request deletion. If you request deletion, we will delete your account data immediately upon verification of the request.
• Linked identifiers (Discord ID / Supremacy ID): Linked identifiers are retained permanently while they remain linked to your account. If you request deletion or unlinking, we will delete those identifiers immediately upon verification of the request.
• Authentication logs, access logs: By default we retain authentication and access logs for security and incident investigation (180 days). Unless you request deletion, these logs are kept in accordance with our security needs. If you request deletion, we will anonymize the relevant logs so they can no longer be linked to you (rather than preserving identifying information).
• Backups: Backups of system data may be retained for a short period for disaster recovery (12 months, encrypted). If a deletion request affects data contained only within backups, we will take reasonable steps to remove or anonymize that data at the next backup cycle or restore-window where feasible.
• Support emails / correspondence: Support messages and related correspondence are retained to resolve issues (up to 2 years after case closed). If you request deletion, we will delete or anonymize your personal data in those records promptly.

6. Cookies & tracking

We use a single, strictly necessary session cookie to keep you logged in. It does not require consent. We do not set analytics or advertising cookies unless you opt in.

Google Analytics (optional) — If you opt in we may set Google Analytics cookies (non-essential) to collect anonymized usage stats. You can withdraw consent at any time; declining will not prevent site use.

How to request deletion

Request deletion by email or by DM from the Discord account to be deleted (Manolo bot or our support account). Include your mail and/or Supremacy ID.

We will verify the request (from the sending email or the Discord account) and then delete your account data and linked identifiers immediately. Logs/backups that cannot be removed immediately will be irreversibly anonymized.

7. Your rights

Under the GDPR you have the right to: access, rectification, erasure, restriction of processing, object to processing, data portability, withdraw consent (where processing is based on consent), and lodge a complaint with a supervisory authority. To exercise these rights, contact us at nekokonekowebsite@gmail.com. We will respond within the statutory timeframes.

8. Automated decision-making & profiling

We do not carry out automated decision-making or profiling that produces legal effects concerning you. If this changes, we will provide meaningful information about the logic involved and your rights.

9. Data security & breach notification

We implement technical and organisational measures (encryption of stored passwords, access controls, regular audits) to protect personal data. In the event of a personal data breach that is likely to result in a high risk to individuals’ rights and freedoms, we will notify the supervisory authority and affected individuals as required by GDPR. (We follow EDPB guidance on breach notification procedures.)

10. Children

Our services are not intended for children under 16. If you are under 16, do not create an account or provide personal data. If we learn we have collected data from a child under the minimum age, we will delete it unless we have parental consent as required by law.

11. Changes to this policy

We will publish any material changes on nekokoneko.org and — where feasible — notify users in advance of material changes. The effective date is shown at the top.

12. Contact & supervisory authority

Contact: nekokonekowebsite@gmail.com. If you are located in the EU/EEA and you believe your rights have been violated, you may also lodge a complaint with your national Data Protection Authority. See the EDPB website for contact details.