Privacy Policy

Who we are

head-mod is an AI-assisted Discord moderation service operated by Ayo Software & Design UG (haftungsbeschränkt), Anemonenweg 1, 47447 Moers-Kapellen, Germany. The data controller for the purposes of the GDPR is the UG, represented by managing director Paul Gößmann (see Imprint). Privacy contact: impressum@ayo-service.de.

Message content handling (Discord MESSAGE_CONTENT intent)

The most common question we get is: do you store and train on Discord message content? Short, plain answers:

• We store message content outside Discord only where it is needed for the bot to answer the call it was asked to handle , ticket channels, DM conversations, and channels where a user opened a session by mentioning the bot. In other words, we keep the messages required to respond, and only those. We do not scrape unrelated channels or retain messages the bot was never invoked on.
• No, message content is never used to train external AI models. Our AI providers (Google Gemini) operate under their standard API terms, which contractually prohibit training on customer data. We do not run our own model-training pipelines.
• Content is sent to AI providers transiently for each call (intent classification, reasoning, embedding) and is not stored on the provider side beyond what their own policies describe.
• We do use operational data to improve head-mod , see the "Improving the service" section below. This means reviewing stored prompts, responses, classifier decisions, and usage metrics to debug failures, tune prompts and safety gates, and make the product more reliable. This is internal engineering and quality work; it is not the same as training a machine-learning model on your content.
• Where we do persist text, ticket transcripts, channel- session buffers (capped at 200 turns each), DM conversation history (rolling ~2-hour / 200-turn window), profile facts, audit events, AI trace prompts and responses, and knowledge-base entries, retention is documented in the "Retention" section below, and users can request erasure at any time.

What we process

When a server owner invites the head-mod bot, and when users interact with it, we process the following categories of data:

• Discord identifiers , user IDs, guild (server) IDs, channel IDs, role IDs, and message IDs. These are required to address the right channels and apply the right permissions.
• Message content , only the messages the bot needs to answer a request it was invoked on (direct mentions, DMs, ticket channels, channels where an active session is open). The bot does not silently scrape or store messages from channels it was never invoked on.
• Profile facts , short text notes the AI saves about users when they ask it to remember something (name, pronouns, preferences). PII categories like passwords, government IDs, financial data, and health data are filtered out before storage.
• Moderation history , when the bot takes a moderation action (warn, timeout, kick, ban) or processes a ticket, we record the event with timestamp and actor for audit purposes.
• Usage metrics , AI-call counts, token totals, and cost-per-call (keyed to guild and, for per-user caps, to Discord user ID) so the dashboard can show usage against your plan and so we can enforce abuse limits.
• Diagnostic & trace data , to operate and debug the service we record per-call traces. These can include the full prompt and response of an AI call, classifier verdicts and confidence scores, which knowledge-base entries were retrieved, tool-call arguments and results, latency, and error/reason codes. Traces are keyed to your guild and used for reliability, security, and product-improvement work (see "Improving the service").
• OAuth session , when an administrator signs in to the dashboard via Discord OAuth, we store a signed, httpOnly session cookie (see the Cookies section below).
• Referral / campaign data , when you reach our site through one of our own campaign links (head-mod.com/r/…), we record the campaign code in the link (which platform and which post), a coarse country derived from your IP (the IP itself is not stored), the referring URL, and your browser's user-agent string. With your consent, asked for in a banner on arrival, we additionally place a random first-party identifier in a cookie; if you later sign in, we link that identifier to your Discord user ID so we can measure which channels bring sign-ups. Decline and no such cookie is set. See "Referral & campaign measurement" below.

Lawful basis (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b)) , processing required to run the moderation, tickets, knowledge-base, and dashboard features the server owner opted into.
• Legitimate interest (Art. 6(1)(f)) , audit logging, cost metering, basic abuse prevention, and keeping diagnostic/trace data so we can debug, secure, and improve the service (see "Improving the service"). You can object to processing based on legitimate interest at any time (see "Your rights").
• Consent (Art. 6(1)(a)) , for the explicit "remember about user" feature, which only fires when a user asks the bot to remember something.

Improving the service

We use operational data, diagnostic traces, usage metrics, classifier decisions, and, where needed, the actual prompts and responses of AI calls, to keep head-mod working and to make it better over time. Concretely, this means:

• Investigating bugs, errors, and incidents by replaying what the AI actually saw and did on a specific call.
• Measuring quality and tuning prompts, classifiers, and the safety/verifier gates so the bot makes fewer mistakes and unsafe actions.
• Producing aggregated and de-identified statistics (for example, per-model latency, cost, error rates, and feature usage) to monitor reliability and plan capacity.

What we do not do: we do not sell your data, we do not use it for advertising, and we do not feed your content into the training of third-party foundation models. Our use is internal engineering, quality, and security work. Reviews of raw content are limited to staff who need it for these purposes and are logged. Where insights can be derived from aggregated or de-identified data instead of raw content, we prefer that.

Referral & campaign measurement

We promote head-mod on social platforms using our own campaign links of the form head-mod.com/r/<platform>/<post>. When you open one, we record the click server-side (the platform and post code carried in the link, a coarse country from your IP, the referring URL, and your user-agent). This click record contains no cookie and lets us count how many people each platform and each post sent us.

To go a step further and tell whether a click later became a sign-up, we need to set a small first-party cookie containing a random identifier. Because that cookie is not strictly necessary, we ask first: on arrival from a campaign link a banner offers "Accept" or "Decline" with equal weight. Only if you accept do we set the cookie; if you decline, or ignore it, no identifier cookie is stored and the visit stays an anonymous click. You can withdraw consent at any time by deleting the cookie in your browser.

When the cookie is set and you afterwards sign in with Discord, we connect that random identifier to your Discord user ID once, recording which campaign first brought you. From then on your activity in the product can be attributed, internally, to its acquisition source so we understand which channels bring engaged users. This is first-party measurement only: the cookie is set and read only by head-mod.com, the identifier is not shared with the social platforms or any other third party, and we do not use it for advertising or cross-site tracking.

• Lawful basis, your consent (Art. 6(1)(a)) for setting the cookie and linking it to your account, captured via the banner; and our legitimate interest (Art. 6(1)(f)) in counting anonymous clicks per channel. You can object or withdraw at any time (see "Your rights") with no loss of functionality.
• Retention, raw click records and the click-to-user link are kept for up to 12 months for trend analysis, then deleted or aggregated into de-identified counts.

Sub-processors

We use the following processors to deliver the service. Each has its own privacy policy; we contract with them on standard GDPR-compliant terms.

Transfers to processors outside the EEA rely on the European Commission's Standard Contractual Clauses (SCCs) and, where available, the EU–US Data Privacy Framework. Message content sent to AI providers is processed transiently for the duration of the call and is not used to train provider models, per the providers' enterprise terms.

Retention

• Profile facts and audit-event history are retained while the bot is in the server, and are kept after the bot is removed so that re-inviting it restores your configuration. They are deleted on a verified erasure request from the server owner or the affected user.
• Ticket transcripts are retained as configured per category (default: kept while the ticket exists; deleted when the ticket is deleted).
• DM conversation history is kept as a short rolling buffer (about the last 2 hours or 200 turns) and is cleared after a period of inactivity; it is not a permanent transcript.
• Usage-event records (for billing accuracy and abuse investigation) are retained for up to around 13 months and then anonymised or deleted.
• Diagnostic trace data, including stored AI prompts and responses, is retained on a rolling basis for debugging, security, and product-improvement purposes (we aim to keep full prompt/response blobs for roughly 30 days; aggregated metrics may be kept longer in de-identified form). It is deleted on a verified erasure request.
• Referral / campaign click records and the click-to-user attribution link are retained for up to 12 months, then deleted or reduced to de-identified aggregate counts.
• Session cookies expire at logout or after the session lifetime (currently 7 days), whichever comes first. The referral cookie expires 90 days after your first campaign click.

Your rights (Art. 12-22 GDPR)

You have the right to access, correct, delete, restrict, port, or object to the processing of your personal data. To exercise any of these rights, email impressum@ayo-service.de from the address associated with your Discord account, or send a Discord DM to the head-mod bot mentioning the right you wish to exercise. You also have the right to lodge a complaint with your local data-protection authority.

Cookies

head-mod uses strictly-necessary cookies, a signed, httpOnly session cookie used for dashboard sign-in, and a short-lived OAuth state cookie used to protect the sign-in flow against CSRF. When you open the billing page, our payment processor Stripe also sets and reads its own strictly-necessary cookies for fraud prevention; these are required to take payment securely and are not used by us for analytics or advertising.

If you arrive through one of our own campaign links (head-mod.com/r/…) we show a consent banner before setting any non-essential cookie. Only if you choose "Accept" do we set a single first-party measurement cookie (hm_ref, httpOnly, 90-day lifetime) that lets us attribute a later sign-up to the campaign that brought you; it is read only by head-mod.com, is never shared with third parties, and is not used for advertising or cross-site tracking (see "Referral & campaign measurement"). Your choice itself is remembered in a small functional cookie (hm_consent) so we don't ask again; you can refuse or delete either cookie in your browser with no loss of functionality. We set no advertising or cross-site tracking cookies.

The dashboard also uses your browser's local storage to remember interface preferences, such as which notices you have dismissed and which chat session a tab was last viewing. This data stays on your device, is strictly functional, and is not used for tracking.

Updates to this policy

We may update this policy as the service evolves. Material changes will be communicated by updating the "Last updated" date at the top, and where appropriate, via a notice in the dashboard.