Privacy Policy

1. Data controller and contact

The data controller is VSK, the company that publishes and operates Ganyu. No data protection officer has been appointed: your requests are handled directly by the team.

For the data processed by a server's moderation and management features (logs, sanctions, tickets, giveaways, and so on), the administrator of that server is the controller and VSK acts as their processor. Section 4 details this split.

2. Data processed, purposes and legal bases

The table below describes each processing operation: the data involved, the legal basis under Article 6 of the GDPR, the retention period and the recipients. Retention periods are detailed in the next section.

3. Retention periods

Once these periods have elapsed, data is deleted or anonymised:

• Sign-in sessions: valid for 7 days on the dashboard and 4 hours in the Activity. A session closed by signing out is deleted immediately; an expired session can no longer be used and is erased from the database within about 25 hours of its expiry.
• IP address log: 90 days.
• Ganyu team security log: 13 months.
• Server technical logs: 30 days.
• Command log: 90 days. The text of each command is truncated to 500 characters. Commands recorded before this limit was introduced may hold their full text. They follow the same retention and disappear when they expire, 90 days at most. When Discord notifies us that the message holding a command typed with the bot's prefix was deleted, the text of that command is erased. The command stays in the log, without its text. Discord sends no such notification for the messages of a deleted channel or thread, and a notification can be lost, for instance while the bot is offline. In those cases, as for a command recorded before this erasure was introduced, the text stays until it expires, 90 days at most. A slash command has no message to delete and keeps its text until it expires.
• Activity statistics: 13 months.
• Values set for the fun calculators (lovecalc, hatecalc, toxicitycalc): deleted after 12 months without use.
• Finished history: deleted 12 months after it ends. This covers removed automoderation infractions and removed warnings (12 months after removal), lifted sanctions (12 months after they are lifted), the history of trades between members, finished mini-games (mines, blackjack, roulette) and finished automation runs (blueprints).
• League of Legends, TFT and Valorant rank history: records older than 12 months are deleted. While the Riot account is linked to a Ganyu account, the latest record is kept, for each ranked queue (League of Legends, TFT) or for each player (Valorant). As soon as the Riot account is no longer linked, all its records older than 12 months are deleted, including the latest one.
• Dashboard action log: 13 months. Deletion happens one whole month at a time, so an action can remain for about 14 months at most.
• Server logs: deleted every day once they are older than 30, 90 or 365 days depending on the server's plan (Free, Premium, Pro). No log is kept for more than about 14 months. The content of a message deleted by automoderation is kept there, truncated to 500 characters, for the same period. Messages deleted before this limit was put in place may contain up to 2000 characters. They follow the same retention period as server logs and disappear when those logs expire, about 14 months at most.
• Ticket transcripts: 1 year after the ticket is closed. If the bot is removed from the server, they are deleted along with the key that encrypts them 30 days after the removal, unless the bot comes back in the meantime or the server still has an active paid subscription.
• Notifications: 90 days.
• Bot malfunction incidents (errors encountered on a server, with their context): deleted 90 days after they are resolved and after their last error. An incident that is still active, or whose feature has been disabled, is kept.
• Referring page of an install (referer) and ID of the person who made it: cleared 13 months after the install. The arrival channel and campaign parameters are kept.
• Bot install history (server, person who added the bot, date): 13 months after the install, including after the bot is removed. The server record keeps the date of the first add and the latest known person who added the bot.
• Giveaway entries (growth contests excluded): deleted 12 months after the giveaway's scheduled end, once it has ended or been cancelled. A giveaway still running keeps its entries. The drawn winners stay attached to the giveaway.
• Growth contest participants and the servers credited to them: deleted 12 months after the contest's scheduled end, once it has ended or been cancelled. A contest still running keeps its participants and credits. The contest and its drawn winners are kept.
• Virtual currency transaction log (earnings, spending, trades, with the balance before and after): 13 months. Deletion happens one whole month at a time, so a transaction can remain for about 14 months at most. It is used to check and correct balances, handle disputes and fight cheating, including after the bot is removed from a server.
• Log of direct messages sent by the bot about a Premium subscription: 1 year.
• Server data: deleted 30 days after the bot is removed, unless the server still has an active paid subscription (the data is then kept for as long as the subscription runs). The following are kept after that deletion: the server record (ID, name, owner, person who added the bot), install history (13 months) and attribution (referring page and installing person cleared after 13 months), subscriptions, payments and shop purchases, billing data, the virtual currency transaction log (about 14 months at most), growth contests and their winners, their participants and credited servers (12 months after the contest ends), the log of direct messages about subscriptions (1 year), the feature settings enabled for the server, the Ganyu team audit log and the dashboard action log (about 14 months at most).
• Members who left a server: username, nickname, avatar, roles, permissions and join date erased 30 days after leaving. XP and inventory are kept, linked only to the Discord ID, so they can be restored if the member comes back.
• Billing data: kept for at least 10 years, the legal retention period for accounting records. The Stripe customer ID is not part of it: it is erased at most 30 days after the subscription ends.
• Encrypted backups: about 9 days at most. Erased data only disappears from the backups once they have rotated.
• Other account data: until the account is deleted.

4. Role of server administrators

The administrators of each server decide which features to enable, how to configure them, who can access the log channels and how to moderate their members. For the processing tied to these features, the server administrator (its owner or the person who installs and configures the bot) is the controller within the meaning of the GDPR. VSK acts as a processor: it processes this data only to run the bot according to the administrator's configuration and commands, and decides neither on sanctions nor on their reasons. The logging, automoderation, ticket and attachment logging modules are disabled by default.

An administrator who enables these features must inform the members of their server (for example in the rules or an information channel) and have a lawful basis for their moderation. If you are a member of a server and your request concerns moderation data (logs, sanctions, warnings, tickets and their transcripts), contact the administrators of that server first. If you write to us about it, we forward your request to the administrator concerned as soon as we can identify the server, and help them answer it. The tools on the My data page (export, account deletion) remain available to you.

Processing carried out by VSK as a processor for administrators

• Server logs (edited or deleted messages, joins and leaves, voice, bans, role and channel changes) and attachment logging.
• Sanctions, warnings, automoderation, its infractions and excerpts of the messages it deletes.
• Tickets, answers to their forms, events and transcripts.
• Member onboarding and management: verification, welcome and goodbye messages, auto roles and reaction roles, birthdays announced on the server, temporary voice channels, command rules, channel templates and history.
• Giveaways and their entries, drops, sticky messages and custom messages, custom commands and automations.
• Server levels, economy, quests and mini-games according to the administrator's settings, and tracking of the game accounts they add.

Processing for which VSK remains the controller

• Account and dashboard, sessions and email address.
• Payments, subscriptions, shop and billing.
• Global XP and economy, Ganyu profile, activity statistics and objection to their tracking.
• Command log, virtual currency transaction log, dashboard action log, operational incidents and notifications.
• Security, IP address log, Ganyu team audit log, audience measurement and install attribution.
• Ganyu Arcade Activity.

VSK's commitments to administrators are set out in the data processing agreement.

Attachment logging

When enabled by an administrator, this feature detects messages containing files or embedded media and reposts them in a private log channel on the same server.

Data processed:

Files are fetched from Discord's CDN and sent back to the log channel. They are not stored on Ganyu's servers: they only pass through memory.

Only members with access to the configured log channel (usually administrators or moderators) can view the logged content.

Administrators can restrict logging by channel, role, file type and minimum size, exclude NSFW channels and threads, and disable the feature at any time.

5. Recipients and processors

Your data is accessible to the Ganyu team within the limits of its duties. It is never sold. The following providers receive it for the purposes described above:

• Discord : Platform on which the bot and the Activity run, and sign-in provider (OAuth2).

  Privacy policy: discord.com/privacy

• Contabo GmbH : Hosting of the servers for the website, the bot and the databases, and of the backup server, within the European Union. Company headquartered in Germany.

  Privacy policy: contabo.com/en/privacy-policy

• Cloudflare : Content delivery network (CDN), protection against attacks and bots, Turnstile bot check.

  Privacy policy: cloudflare.com/privacypolicy

• Stripe : Payment of Premium plans, subscription management and invoicing.

  Privacy policy: stripe.com/privacy

• Takt (VSK) : Cookieless website audience measurement. Tool published by VSK and hosted in the European Union.

  Privacy policy: taktlytics.com

• Riot Games : Game statistics for the Riot accounts you link to the bot.

  Privacy policy: riotgames.com/en/privacy-notice

• TradingView : Price chart on the crypto page, loaded only after you click.

  Privacy policy: tradingview.com/privacy-policy

• CoinGecko : Cryptocurrency prices and logos on the crypto page. The logos are loaded from its servers, which therefore receive your IP address.

  Privacy policy: coingecko.com/en/privacy

• Top.gg and DiscordBotList : Voting platforms for the bot: when you vote, they send us your Discord ID so the reward can be granted.

  Privacy policy: top.gg/privacy,discordbotlist.com/privacy

Until 28 September 2026, when the /translate command was removed, the text of the messages a member asked to translate was sent to DeepL SE (Cologne, Germany), which may keep it under its own terms; Ganyu no longer sends it any text.

6. Transfers outside the European Union

The production servers (website, bot and databases) and the server that stores their backups are hosted in the European Union. Some of the recipients listed above are, however, established outside the Union, particularly in the United States, and may process data there.

Depending on the provider, these transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for certified companies, or on the standard contractual clauses adopted by the European Commission. You can ask us for details of the safeguards that apply to a given provider by writing to us.

7. Cookies and trackers

Ganyu itself sets two cookies, strictly necessary for the website to work and therefore exempt from consent. No advertising or analytics cookie is used. Cloudflare, which protects the website, may also set its own security cookies (for example __cf_bm or cf_clearance) to tell visitors apart from bots; these are strictly necessary too.

The website also saves in your browser's local storage: the display language, a few choices you make yourself (pinned cryptocurrencies, display of the TradingView chart, refusal of audience measurement) and, for the Ganyu team only, the search history of the administration pages. This information stays on your device.

Audience measurement

Website traffic is measured with Takt, a tool published by VSK. Takt sets no cookies, builds no profiles and does not follow visitors from one site to another. Identifiers found in addresses (Discord IDs, server IDs, tokens) are replaced before sending, and the IP address is discarded as soon as the country and the visit identifier of the day have been derived from it.

Takt honours your browser's Do Not Track and Global Privacy Control signals: when either is enabled, no measurement is sent. You can also refuse measurement on this browser with the button below.

TradingView chart

The crypto page of your account offers a chart provided by TradingView. It is only loaded if you click "Show chart (TradingView)". TradingView then receives your IP address and may set its own cookies, according to its privacy policy. You can change this choice from the same page.

CoinGecko logos

Cryptocurrency logos on the crypto page are loaded from CoinGecko's servers, which receive your IP address when they are displayed. These images set no cookies.

Images hosted by third parties

Some images shown are not hosted by Ganyu. Custom profile images are links to images hosted by Imgur: Ganyu only keeps the link and sends no data to Imgur. The icons of linked Riot Games accounts come from CommunityDragon. To display these images, your browser contacts Imgur or CommunityDragon directly, which therefore receive your IP address.

8. Data security

VSK implements technical and organisational measures to protect your data against loss, unauthorised access or disclosure: encrypted connections, access restricted to the team, secrets masked in logs, encrypted backups. No method of transmission or storage is, however, infallible.

Backups are encrypted on the production server before being copied to a separate backup server, which only stores files that cannot be read without the key. They are kept for about 9 days at most. Data you have erased therefore remains in the backups until they rotate, without being used.

9. Your rights

Under the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your data:

• Right of access: find out which data we hold about you and obtain a copy.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure: have your data deleted, within the limits detailed below (legal obligations such as billing, proof, data shared with other members or with a server).
• Right to restriction: have a processing operation frozen while a dispute is examined.
• Right to data portability: receive the data you provided to us in a structured, machine-readable format.
• Right to object: object to processing based on our legitimate interest, such as tracking your activity or audience measurement.
• Post-mortem instructions: decide what happens to your data after your death (Article 85 of the French Data Protection Act).

For a server's moderation data (logs, sanctions, warnings, tickets), the server administrator is the controller: contact them first. VSK forwards the requests it receives about that data to them and helps them answer. The tools of the My data page nevertheless also apply to that data, on the administrators' instruction given in the data processing agreement. The export gives you the sanctions, warnings and automod infractions that target you, with their reasons. The IDs of other people stored in these records are masked in it. The transcripts of the tickets you opened are provided as they are, with the messages and names of the other participants. Deleting your account erases these sanctions, warnings and infractions on every server where you have data, including servers you have left, together with your member record, levels, balances and giveaway entries: your moderation history disappears and the count of your warnings restarts from zero. The details are in the section "What deleting your account keeps".

Exporting your data, deleting your account and objecting to activity tracking can be done directly from the My data page.

On Discord, the /privacy command shows your current choice and lets you object to activity tracking or turn it back on.

What deleting your account keeps

Deleting your account erases your personal data, with the following limits:

• Ganyu team security log: it is kept, with the details of each action. Only the records of data exports you made yourself are erased from it. The team's actions that targeted you keep your Discord ID in clear, and if you were part of the team, your own actions keep your ID as well. If the team handles your request (for example one received by email), a record carrying your ID is written there. If you delete your account yourself, the record does not contain your ID, only a fingerprint that makes it possible to check later that the erasure took place. This log serves as proof and for the security of the service. It is kept for 13 months.
• Technical application logs: they are not modified by the deletion of your account and are deleted after 30 days.
• Payments and purchases: amounts are kept for accounting. They are no longer linked to your Ganyu account, but remain linked to the payment reference at Stripe, our payment provider, which keeps its own billing data. Deleting your Ganyu account does not erase it. You no longer appear as the buyer of a subscription or as the person who gifted it.
• Tickets: transcripts are kept, because they mix messages from several people and belong to the server. Those of the tickets you opened are included in your data export. The ticket remains, but you no longer appear as its author or as the person who handled it, and the answers to its form are erased. If someone else added you to a ticket or removed you from one, your Discord ID may remain in the transcripts and in the dashboard action log.
• Poker games and hand history: kept, with your Discord ID, name and avatar replaced. Hands are deleted about 13 months after the game at most.
• Trades with other members: kept for the other person, your side of the trade is anonymised.
• League of Legends, TFT and Valorant rank history: the link between your Ganyu account and your Riot accounts is deleted. The rank records remain stored under the Riot account's identifier, and each one is then deleted once it is older than 12 months, including the latest one, unless another Ganyu account is linked to the same Riot account: the latest record is then kept.
• Server logs and the dashboard action journal: you no longer appear as the author of an action, nor as the target in server logs. The content of the entries remains as is: messages (which may mention you), nicknames, a member's avatar address (which contains their Discord ID) and IDs entered in the dashboard. These entries are deleted by whole month after 13 months, so about 14 months at most.
• Sanctions that targeted you: kept for the server's moderation history, without your ID or their reason, then deleted 12 months after they were lifted. For a sanction whose duration has already run out, we try to lift it on Discord first; a ban we could not lift stays in place, and the server can remove it by hand. A sanction still running is closed in our data without being lifted on Discord: a mute (timeout) ends on its own, but a temporary ban becomes permanent and stays in place until a moderator lifts it. The content of some server log entries we keep (about 14 months at most), Discord's ban list and audit log, and messages already posted in log channels may still let the server link these sanctions to you. Warnings and automoderation infractions that targeted you: deleted. The sanctions and warnings you gave to other people, as well as ticket events, are kept for the server. You no longer appear as the author, but reasons you wrote about someone else remain. When a ticket event added you to or removed you from a ticket, your ID is replaced there.
• Virtual currency transaction log: your own transactions are deleted. In other members' transactions, your ID is replaced with a neutral marker when they gave you a reputation point, including on a server the bot has left and whose data has already been deleted. The log is deleted one whole month at a time beyond 13 months, so about 14 months at most.
• Automation runs (blueprints): your ID is replaced there, whether you started the automation or it appears in its parameters or results.
• A server's operational incidents and notifications: your ID is replaced wherever it appears as a value. If it is used as a field name in that data, it remains.
• Channel templates and channel change history: permissions granted to you personally are removed, and you no longer appear as the author. Permissions granted to a role remain.
• Bot installation, giveaway draws, channel templates and similar items: kept, with you anonymised.
• Command rules that target you and temporary voice channels you own: kept as they are, because they are rules and channels still active on the server. If you own a Discord server, that fact stays recorded, because it comes from Discord.
• These replacements apply to the servers you were a member of, to the automations you started and, for the virtual currency log, to the servers whose data was deleted after the bot left. The following remain as is: channel templates prepared by the Ganyu team.
• Backups: your data disappears from them within about 9 days at most.
• Objection to activity tracking: this choice is lost with the account. If you write again on a server that uses Ganyu, a new account is created with tracking on, and you can object again.
• Ongoing subscription: deletion is refused while a paid subscription is still due to renew, or while its status cannot be checked with Stripe. Cancel it first. A subscription already cancelled for the end of the period does not block deletion. Deletion is also refused while a poker game you took part in is still loaded on the server: try again later or contact us.
• Confirmation: from the My data page, deletion only happens once you type the confirmation word shown.

You can also exercise all your rights by email at [email protected] or on our Discord server. We reply within one month and may ask you to confirm that you own the Discord account concerned.

If, after contacting us, you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority: cnil.fr.

10. Minors

• Ganyu is reserved for people aged at least 15, the age of digital consent in France (article 45 of the French Data Protection Act, Loi Informatique et Libertés). Below that age, using the Service requires the agreement of the holder of parental authority. The minimum age set by Discord in your country also applies.
• In France, when processing is based on consent, the consent of a minor under 15 is not sufficient on its own: it must be given jointly with the holder of parental authority.
• Premium purchases are reserved for adults, or for minors with the agreement of their legal guardian.

11. Information visible to other people

• On servers that use Ganyu, other members can see your level, your virtual wealth, your mini-game achievements and your position on the leaderboards.
• Your public interactions with the bot (command replies, public messages) are visible to the members of the channel concerned.
• A server's leaderboard can also be viewed on the website by anyone who has its link. It is public by default, and the server's administrators can make it private. It shows the username, avatar and score of each ranked member. The avatar shown is the person's Discord image, whose address contains their Discord ID. Members who have left the server and people who have objected to activity tracking do not appear on it.

12. Changes to this policy

This policy may be updated. The date at the top of the page shows the latest revision, and significant changes are announced on the website or on the official Ganyu Discord server.