Privacy Policy

1. Who we are and what this policy covers

Exylia Staff (the "Service") is a staff-management suite for Minecraft networks, made of the panel at staff.exylia.net, the gateway at staff-gateway.exylia.net that the ExyliaStaff server plugin (the "Plugin") connects to, and the Exylia Staff Discord bot (the "Bot"). It is operated by Cristobal Aranda, a natural person domiciled in Chile ("we", "us"). Contact: [email protected].

We handle personal data in two different roles:

• As controller, for the people who sign in with Discord ("Users": staff members, network owners and players who sign in to appeal or answer a form) as far as their account is concerned, and for visitors of our website. Sections 2 and 5 to 13 describe that processing.
• As processor, for the data a network processes through the Service: its players, its staff team and the members of its Discord servers. The owner of each workspace (the "Customer") decides to collect that data and is its controller; we process it only on the Customer's instructions under our Data Processing Agreement. Sections 3 and 4 describe what is processed, so that players, staff members and Customers can see it in full.

If you are a player or a staff member and want to exercise your rights over data a network holds about you (punishments, reports, chat, appeals, staff records), contact that network first: it decides what is collected and why. If you write to us instead, we will pass your request on to the network and help it answer.

2. Data about Users of the panel

• Discord account: when you sign in with Discord we receive your Discord user ID, your username and the address of your avatar. Signing in requests only the "identify" scope: we never receive your email address, your password or your messages. The access token is used once and discarded.
• Discord servers you manage: only if you choose a Discord server on a workspace's Discord page, you grant the additional "guilds" scope. We then read once the list of servers you own or manage and keep it for 30 minutes in a signed cookie in your browser so you can pick one; it is not stored on our side.
• Login sessions: a random session token, stored on our side only as a hash, with its creation and expiry dates. We do not store your IP address or browser with the session.
• Workspace data: the workspaces you create or join, your role, the invitations you create or accept, the Minecraft account you link with the /staff web code, your notifications and, if you enable them, the browser push subscription that delivers them, and the content you add.
• Usage counts: how many pages of each section of a workspace you open per day, used to show workspace activity to platform administrators. No individual page visits are kept.
• Usage analytics, only if you accept them in the cookie banner: Google Analytics and Microsoft Clarity measure how our sites are used (see sections 6 and 7).
• API keys you create: a hash of the key, its name and scopes, and the date and IP address of its last use.
• Communications: the messages you send us by email and our replies.
• Technical data: when you visit our sites, our network provider and our servers process your IP address, browser user agent and the requested URL to deliver the page, protect the Service against abuse and diagnose errors. We do not use third-party error-tracking services.

We do not use the panel to profile you, we do not run advertising on it, and we do not sell or rent personal data.

3. Data processed for Customers

Which of the following is processed depends on the modules and settings the Customer enables. The Plugin sends the Service:

• Players: Minecraft UUID and username, when they were first and last seen, the last server they were on and playtime per server. While a player is online, also where they are (server, world and coordinates), ping, health, game mode and whether they are in staff mode, vanished, frozen or AFK; these live values are deleted when the server disconnects.
• Moderation: punishments (type, reason, duration, issuer, server, note, edits and revocation), punishment requests, reports (reporter, target, reason text, handler and staff comments), help requests and replies, notes on players, freeze sessions and their chat, inventory backups (without their contents, which stay on the Customer's servers) and restores, revoked items and where they reappeared, anticheat alerts per minute, x-ray alerts with their location, the list of replays (the recordings stay on the Customer's servers and are only relayed when staff open them), and an audit log of staff actions in game and on the panel, which may include world and coordinates.
• Chat history: public chat, private messages and commands typed in game, with the sender, the recipient of private messages, server and world. Commands the Customer marks as sensitive (such as login or register) have their arguments removed in game and never reach us. The bodies of private messages are visible only to staff with a specific permission.
• IP addresses, only with the alts module: the Plugin never sends a plain IP address. It sends a keyed hash (HMAC-SHA256) and a copy encrypted with AES-256-GCM, both with keys derived from the network's own secret, so the Customer can find accounts that share a connection. Only staff with the permission to view IP addresses can open them.
• Staff team: each staff member's rank and rank history, LuckPerms groups and permissions, duty sessions, AFK time and action counts, strikes and strike appeals, absences, meeting attendance, management notes, and the activity and quality scores of staff reviews.
• Evidence: images, videos and links that staff attach to punishments, reports, strikes, appeals or players, from the panel or with the Bot's /evidence command. Uploads are processed (transcoded and thumbnailed) and kept in private storage.
• Player-facing pages, if the Customer enables them: appeals (the Discord account of the person appealing, the Minecraft name, the text, the code confirmed in game and the decision), form responses (for example staff applications: the answers, the Discord account and the Minecraft name given) and a public ban list, which shows anyone the names of banned players, the dates and, if the Customer chooses, the reason and the staff member.
• AI features, if enabled: labels and summaries the AI writes about reports, appeals, suggestions and players, proposals for punishments and rank changes, and lines of chat kept as examples of what the Customer's staff considered or did not consider an offence.

Customers must not use free-text fields, forms or evidence to collect sensitive data (health, political opinions, religion, sexual orientation and the like), passwords or payment card data.

4. The Discord bot

A Customer can add the Bot to one or more Discord servers and bind them to its workspace, or connect its own bot application (a "custom bot"). The Bot acts only in servers bound to a workspace and ignores events from any other server. It connects to Discord with these gateway intents:

• Guilds: the servers, channels and roles the Bot is in, to post to the channels the Customer chose and to manage rank roles.
• Guild Messages and Message Content (Message Content is privileged): only for the staff chat bridge. When a Customer sets a channel as its staff chat, the text of a message posted there by a staff member is relayed to the in-game staff chat. Messages in every other channel, and messages from bots and webhooks, are discarded without being read or stored.
• Server Members (privileged, where Discord grants it): only to be told when a member's roles change, so that rank roles stay in sync with the ranks set on the panel and in game. The role list is compared in memory and not stored. Without it, the Bot checks the roles of linked staff members every 10 minutes instead.

The Bot does not use the Presence intent and never reads anyone's status, activity or presence. It does not read message history, direct messages or member lists.

What it stores: staff chat messages relayed from Discord (the text, up to 512 characters, its time and the author's linked Minecraft name and panel account), kept as the workspace's staff chat history for 30 days and then deleted; files attached with /evidence, as evidence; and the IDs of the servers, channels and roles the Customer configured and of the messages the Bot posted. When it repairs a manual role change it records in the audit log which roles it added or removed and for whom. It posts to the Customer's channels, and sends direct messages to staff members, the information the Customer configured (reports, help requests, staff chat, anticheat alerts, staff changes, strikes, absences, meetings).

If a server removes the Bot, it stops processing anything from that server at once. What was already stored stays with the workspace until the Customer unbinds the server on the panel or deletes the workspace (section 8). A custom bot is a Discord application owned by the Customer: the Customer is responsible for it towards Discord, and we run it on the Customer's behalf.

5. Why we use the data and on what legal basis

• To provide the Service: sign-in, workspaces, permissions, the panel, the Bot and the connection with the Plugin. Basis: performance of a contract (GDPR art. 6.1.b) and, in Chile, the contractual relationship and your consent given when you sign in (Law 19.628, arts. 4 and 20).
• To keep the Service secure and working: preventing abuse, rate limiting, suspending accounts or workspaces that breach the terms, error diagnosis and backups. Basis: our legitimate interest in running a secure service (GDPR art. 6.1.f).
• To measure and improve our sites with usage analytics and session recordings (Google Analytics and Microsoft Clarity), only if you accept them in the cookie banner. Basis: your consent (GDPR art. 6.1.a; in Chile, consent under Law 19.628 and Law 21.719), which you can withdraw at any time from the "Cookies" link in the footer.
• To answer your requests and communicate changes to these terms. Basis: performance of a contract and legitimate interest.
• To comply with legal obligations and respond to lawful requests from authorities. Basis: legal obligation (GDPR art. 6.1.c).
• Data processed for Customers: only to provide the Customer with the Service. The Customer is responsible for having a legal basis (usually its legitimate interest in running and moderating its network and managing its staff team, or consent where required) and for informing its players and staff.

We take no decisions about Users solely by automated means. A Customer can configure chat auto-moderation to issue warnings and mutes on its own: that decision is the Customer's, its staff can review and revoke every automatic punishment, and players can appeal it through the Customer. Every other AI output (labels, summaries, proposals) is a suggestion that a person accepts or dismisses.

6. Cookies and local storage

The panel uses cookies that are strictly necessary for it to work or that remember choices you made and, only if you accept them, analytics cookies. There are no advertising cookies. Nothing but the strictly necessary cookies is set before you choose in the cookie banner.

• __Host-ess_session: keeps you signed in. 30 days, renewed while you use the panel. Strictly necessary.
• __Host-ess_oauth: protects the Discord sign-in against forgery. 10 minutes. Strictly necessary.
• ess_guilds: the Discord servers you manage, after you grant that permission on a workspace's Discord page. 30 minutes. Strictly necessary for that step.
• __Host-ess_connect: protects the connection of another Exylia app to a workspace. 10 minutes. Strictly necessary.
• NEXT_LOCALE: the language you chose. 1 year. Preference.
• ess_rail, ess_fold, ess_notice and similar: the state of the sidebar and panels, and the dismissed announcement. 1 year. Preference.
• exylia_consent: your choice in the cookie banner (granted or denied), shared by every Exylia site on exylia.net. 180 days. Strictly necessary.
• The theme, recently visited pages and which notifications already sounded are kept in your browser's local storage and never leave your device.

Analytics cookies, set only after you click Accept in the cookie banner:

• _ga and _ga_<id>: Google Analytics, to tell visits apart and count sessions. 2 years.
• _clck: Microsoft Clarity, to recognise your browser across visits. 1 year.
• _clsk: Microsoft Clarity, to join the pages of one visit into a recording. 1 day.
• CLID and MUID: Microsoft Clarity and Microsoft, to identify the browser for Clarity. 1 year.

With your consent, Google Analytics and Microsoft Clarity receive the pages you visit (address path and title), the referring page, your device, browser and operating system, your screen size, an approximate location they derive from your IP address, and your clicks and scrolling. Clarity also records sessions and heatmaps; the text inside the panel and on a network's public pages (appeals, forms, ban list) is masked in those recordings. Google Analytics runs with advertising features and Google Signals disabled. You can change your choice at any time with the "Cookies" link in the footer of every page; withdrawing deletes those cookies and stops the scripts at once.

Some pages show content served by third parties: player heads from mc-heads.net, Discord avatars from cdn.discordapp.com and, when staff open a video link attached as evidence, the player of YouTube (youtube-nocookie.com), Twitch, Streamable or Medal. To load them your browser connects to those services, which receive your IP address and, in the case of mc-heads.net, the UUID of the player whose head is displayed.

7. Who receives the data

We run the Service on our own servers, including the storage of evidence files. We share personal data only with the providers needed to run it, each bound by its own data protection terms:

• Cloudflare, Inc. (United States; global network): DNS, TLS and network protection. All traffic to our domains, including the Plugin's connection, passes through Cloudflare.
• Discord Inc. (United States): sign-in with Discord, and the messages the Bot posts to the Customer's Discord servers and to staff members.
• Artificial-intelligence providers, only for workspaces that use AI features: the model provider we configure for the platform, or the one a Customer connects itself. They receive the text needed for each task (for example report reasons, appeal text, chat lines being moderated, notes, punishment history and player names), never IP addresses, which are removed before sending.
• Google LLC (United States), Google Analytics, and Microsoft Corporation (United States), Microsoft Clarity: only if you accept analytics cookies, the usage data described in section 6.
• Your browser's push service (for example Google, Mozilla, Apple or Microsoft), only if you enable push notifications: it carries the notification encrypted end to end.

Within a workspace, staff see its data according to the permissions the Customer grants them. Customers can also share data with tools of their choice through API keys and webhooks they create, and with other Exylia apps they connect (Exylia Tickets, Exylia Analytics, Exylia Link); those receive only what each key's or connection's scopes allow. Platform administrators (the operator's own accounts) can access any workspace to give support, handle abuse and maintain the Service; their administrative actions are logged. We may disclose data when required by law or by a court or competent authority, and to defend our legal rights.

8. How long we keep data

• User account: until you delete it from your account page or ask us to. You cannot delete an account that still owns a workspace; transfer it first. Your name stays in the records you created in a workspace (for example audit entries, notes and comments), which belong to that workspace.
• Login sessions: until they expire (30 days without use) or you sign out; expired records are deleted a day later.
• Chat history and chat moderation verdicts: the number of days the Customer sets, 14 by default and 90 at most.
• IP data of the alts module: deleted when the account has not been seen on that address for the number of days the Customer sets, 90 by default.
• Evidence: deleted the number of days the Customer sets (90 by default) after the punishment or strike it belongs to expires or is revoked; evidence of a punishment still in force is kept. Unfinished uploads are deleted after 24 hours.
• Notifications and completed commands: 90 days. Records of what the Bot already posted: 30 days.
• Everything else processed for a Customer (players, punishments, reports, notes, audit log, staff chat (messages relayed from Discord: 30 days), staff records, appeals, form responses, AI outputs): while the workspace exists. Workspaces that never linked a server, have no other members and hold no evidence are deleted automatically after 7 days. A Customer can ask us to delete its workspace by writing to [email protected] from its owner account; we delete it within 30 days, together with its evidence files.
• Technical logs: up to 90 days.
• Usage analytics: 14 months in Google Analytics; Clarity session recordings 30 days.
• Emails with us: as long as needed to handle the matter and for up to 2 years afterwards, unless the law requires longer.

Backup copies, where they exist, are rotated and overwritten within 30 days, so deleted data disappears from them within that period.

9. International transfers

Our servers are in Chile, and some providers in section 7 are in the United States. When data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (incorporated in our Data Processing Agreement for Customers) and on our providers' own safeguards, such as the EU-U.S. Data Privacy Framework or their Standard Contractual Clauses. Google LLC and Microsoft Corporation, which receive analytics data only with your consent, are certified under the EU-U.S. Data Privacy Framework.

10. Security

We protect data with measures appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) for all traffic to our domains.
• Session, invitation, server, API and network tokens stored only as SHA-256 hashes; sign-in through Discord OAuth with PKCE.
• Custom bot tokens, AI keys, integration tokens and webhook secrets encrypted with AES-256-GCM under keys bound to their workspace; IP addresses kept only as keyed hashes and AES-256-GCM ciphertext.
• Evidence in private storage, served only through short-lived signed links.
• Strict separation of each Customer's data by workspace, and role-based permissions within each workspace, with separate permissions for sensitive data such as IP addresses and private messages.

No system is completely secure. If a personal data breach occurs, we will notify affected Customers without undue delay, and the competent authority and affected people where the law requires it.

11. Your rights

Depending on where you live, you have the right to access your data, rectify it, erase it, restrict or object to its processing, receive it in a portable format and withdraw any consent you gave, without affecting earlier processing. In Chile, Law 19.628 grants the rights of access, rectification, cancellation and blocking, and from Law 21.719 taking effect also objection, portability and the right not to be subject to automated decisions.

To exercise them, write to [email protected] from a channel that lets us confirm your identity (for Users, we may ask you to confirm through your Discord account). You can also delete your account yourself from your account page, and withdraw your consent to analytics from the "Cookies" link in the footer. We will answer without undue delay and within the time the applicable law allows (under the GDPR, one month, extendable where necessary).

You can complain to a data protection authority: in the European Union, the authority of your country of residence or work; in Chile, the Personal Data Protection Agency created by Law 21.719 once it is operating, or the courts under Law 19.628. We would appreciate the chance to resolve your concern first.

12. Minors

Creating or owning a workspace is reserved for people who are at least 18 years old or of legal age where they live. Staff members, and players who sign in to appeal or answer a form, must be old enough to use Discord where they live and, if they are minors, have the permission their law requires.

Many Minecraft players are minors. The Service does not ask for or record anyone's age, and we never use the data for advertising or profiling. Customers whose networks are aimed at minors must assess their obligations, including parental consent where the law requires it, and can reduce collection by disabling modules and shortening retention.

13. Changes and contact

We will update this policy when the Service or the law changes, and show the date of the latest version at the top. If a change materially affects how we use personal data, we will announce it on the panel at least 30 days before it applies.

Questions or requests: [email protected].