Privacy Policy

Who we are

Rinari for Discord (“Rinari”, “the bot”, “we”) is a Discord bot with a web control panel called Studio and this website, rinari.bot. It is operated by Xainner, an independent developer based in Costa Rica, who is responsible for the processing described here.

Contact for anything in this policy: support@rinari.bot.

What this policy covers

This policy covers the bot inside Discord servers that added it, the Studio panel at rinari.bot, and this website. Discord itself, and any third-party service a server connects (for example an AI provider), have their own policies.

What we collect

Data Discord sends the bot. To work, the bot receives events from the servers it is in: server, channel, role and message IDs, user IDs, usernames, avatars, roles, membership, voice-channel presence and the content of messages in channels it can read. Messages are processed as they arrive; they are only stored when an enabled module needs them, as listed below.

Data created by the modules a server enables. Depending on the server’s configuration:

• Levels and reputation: XP events, levels, reputation given and received, badges and boosts.
• Economy: balance, inventory, purchases, trades and daily claims.
• Community: birthdays you set, giveaway entries, poll votes, event RSVPs, suggestions and their votes.
• Roles and verification: temporary and sticky roles, verification attempts and results.
• Voice: when you join and leave voice channels (for activity stats and temporary rooms). The bot does not record or store voice audio.
• Game servers: game accounts you link and whether they are verified.
• Analytics: activity counters (messages sent, voice time, joins and leaves) without message content.

Support. Ticket details (title, status, dates, rating and rating comment), ticket transcripts saved as files when a ticket closes, and ModMail messages and attachments relayed between a member and the server team.

Moderation and audit. Moderation cases, warnings, reasons and staff notes, and an audit log of changes made in Studio and actions taken by the bot.

Server configuration. Module settings, knowledge documents that administrators upload for support answers, and connection details for AI providers, game servers and notifications, including API keys, which are stored encrypted.

Studio sign-in. When you sign in with Discord we request the identify and guilds scopes: your user ID, username, avatar and the list of servers you belong to with your permissions in them. We store your Discord access and refresh tokens encrypted, to check your permissions again when you use the panel.

This website. No analytics, no advertising and no third-party trackers. Fonts are served from our own domain. Your language choice may be saved in your browser’s local storage. Like any web server, our hosting provider may keep standard access logs (such as IP address and browser type) for security and operation.

How we use it

• To run the features each server enables, and to show administrators and moderators the information those features produce.
• To check permissions, prevent abuse and keep the service secure.
• To diagnose errors and keep the service working.

We do not sell personal data, do not use it for advertising and do not use it to train AI models. Where a legal basis is required, we rely on what is necessary to provide the service you or your server requested, and on our legitimate interest in keeping it secure.

AI features

AI features are off by default. They only work after a server administrator connects an AI provider of their choice with their own API key. That provider then processes, on the server’s behalf:

• What you send with commands such as /ask, and the recent messages of that same conversation (by default, up to 10 messages from the last 15 minutes). This conversation memory is held only in the bot’s working memory and expires; it is not saved in our database.
• The knowledge documents of the server, when Rinari answers support questions.
• The messages a moderator asks Rinari to summarize or classify.
• Speech in a voice conversation you start with Rinari, which is sent for transcription and answered with synthesized speech. Rinari does not store the audio.

Each provider handles that data under its own terms and privacy policy, which the server chose. Actions that Rinari proposes with AI pass through the bot’s permission checks and need approval from an authorized member, unless the server explicitly allowed specific operations to run on their own.

Who else receives data

• Discord, where the bot runs and where its messages are posted.
• The AI provider a server connects, as described above.
• Services a server configures: music sources such as YouTube and SoundCloud when you play a track; YouTube, Twitch, Reddit or RSS feeds for notifications; the game servers it links; and Cloudflare Turnstile if the server uses it for member verification.
• Infrastructure providers that host our servers and this website.
• Authorities, only when the law requires it.

Inside a server, the information a module produces is visible to that server’s administrators and to the team members they authorize (for example, ticket transcripts to the support team).

How long we keep it

• Ticket transcripts: deleted a set time after the ticket closes (30 days by default; each server can choose 1 to 365).
• ModMail messages and attachments: erased a set time after the thread closes (30 days by default).
• Analytics: individual activity events after 30 days by default; aggregated statistics after 365 days by default. Both are configurable.
• AI conversation memory: minutes, only in working memory.
• Studio: your session lasts 7 days; the cookies used during sign-in last 5 minutes.
• Moderation cases and audit records: kept for the server’s authorized team, also after a personal-data deletion, because they protect the community.
• Everything else: while the bot is in the server and the data is needed for an enabled feature.

If the bot is removed from a server, that server’s data is kept so its configuration comes back if it is added again. The server owner can ask us to delete it at support@rinari.bot. Operational backups may keep copies for a limited time before they are rotated out.

Your choices and rights

• /mydata sends you a file with your data in that server.
• /privacy delete confirm:true deletes your personal data in that server and anonymizes your economy history so the server’s ledger stays balanced. Open tickets, ModMail threads and pending purchases must be closed first. Moderation and audit records are kept.
• /privacy info reminds you of all this inside Discord.
• Server administrators decide which modules are on and can change the retention periods above.

Depending on where you live, including under Costa Rica’s Law 8968 on personal data protection and the GDPR, you may have rights to access, correct, delete or object to the processing of your data. For anything the commands do not cover, write to support@rinari.bot. We may need to confirm that the Discord account is yours.

Security

API keys, provider secrets and Discord tokens are stored encrypted. Studio checks your current Discord permissions before showing or changing anything, and the bot checks them again before acting. No system is perfectly secure, so we keep access to production data limited and fix reported problems as a priority.

Children

Rinari is used inside Discord, which requires users to be at least 13 years old, or older where local law says so. We do not knowingly collect data from anyone below that age. If you believe that happened, contact us and we will delete it.

Where data is processed

Our servers and the services described above may be located outside your country. When data moves between countries, we protect it as this policy describes.

Changes to this policy

If we change this policy, we will update this page and its effective date. If a change significantly affects how your data is used, we will announce it on this website before it applies.

Contact

Xainner · Costa Rica · support@rinari.bot