Privacy Policy

Last updated: March 5, 2026

This Privacy Policy explains how Relyo ("Platform", "we", "us", "our") collects, uses, and protects your personal data in compliance with the General Data Protection Regulation (GDPR) and the EU Digital Services Act (DSA).

1. Data Controller

The data controller for your personal data processed through Relyo is the Platform operator. For questions or requests regarding your data, contact us at privacyrelyo@doombringerz.com.

2. Data We Collect

2.1 Data provided through authentication

When you log in via Discord or Reddit OAuth2, we receive and store:

  • Discord: User ID, username, discriminator, global display name, avatar URL, email (if authorized)
  • Reddit: User ID, username

We store OAuth2 access and refresh tokens securely to maintain your session.

2.2 Data generated through platform use

  • Votes: Entity voted for, timestamp, voting streak. IP addresses are hashed with a daily-rotating salt and stored only as irreversible SHA-256 hashes for fraud prevention.
  • Reviews: Rating, review text, timestamps
  • Listings: Bot/server details you submit (descriptions, invite links, tags)
  • Reports: Report reason and status
  • Transactions: Currency purchases, amounts, payment provider reference IDs (we do not store credit card numbers)
  • API keys: Key names, permissions, usage timestamps (key values are stored as irreversible SHA-256 hashes)

2.3 Automatically collected data

  • IP address hashes: Used for vote fraud detection. Raw IPs are never stored.
  • User-Agent strings: Collected during votes for fraud analysis
  • Essential cookies: Session and authentication cookies (see our Cookie Policy)

3. Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Art. 6):

  • Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service (account management, listing display, voting)
  • Legitimate interest (Art. 6(1)(f)): Fraud prevention, platform security, service improvement
  • Consent (Art. 6(1)(a)): Non-essential cookies (if applicable), marketing communications
  • Legal obligation (Art. 6(1)(c)): Tax records for purchases, responding to lawful requests

4. How We Use Your Data

  • Authenticate you and manage your account
  • Display your listings, reviews, and votes on the Platform
  • Detect and prevent vote fraud and abuse
  • Process payments and maintain transaction records
  • Moderate content and enforce our Terms of Service
  • Send service-related notifications (approval/denial of listings, payment confirmations)
  • Generate aggregate, anonymized analytics to improve the Platform

5. Data Sharing

We do not sell your personal data. We may share data with:

  • Payment processors (Stripe, PayPal, MultiSafePay): To process currency purchases. These providers act as independent data controllers under their own privacy policies.
  • Hosting providers: Our servers are hosted within the EU/EEA. Data may be processed by our hosting provider under a Data Processing Agreement.
  • Bot/server owners: When you vote for or review a bot/server, the owner may receive your user ID and username via webhooks they have configured.
  • Law enforcement: When required by applicable law or valid legal process.

6. Data Retention

  • Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
  • Votes: Retained indefinitely as part of the public record. IP hashes are rotated daily.
  • Reviews: Retained while visible. Deleted reviews are permanently removed within 30 days.
  • Transaction records: Retained for 7 years as required by Dutch tax law.
  • Webhook logs: Retained for 90 days, then automatically purged.
  • Session cookies: Expire after 7 days (refresh token) or 15 minutes (access token).

7. Your Rights (GDPR Art. 15-22)

As an EU/EEA resident, you have the right to:

  • Access (Art. 15): Request a copy of your personal data
  • Rectification (Art. 16): Correct inaccurate personal data
  • Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
  • Restriction (Art. 18): Request restriction of processing
  • Portability (Art. 20): Receive your data in a structured, machine-readable format
  • Objection (Art. 21): Object to processing based on legitimate interest
  • Withdraw consent: Where processing is based on consent, withdraw at any time

To exercise these rights, contact privacyrelyo@doombringerz.com. We will respond within 30 days. If you believe your rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority (DPA). In the Netherlands, this is the Autoriteit Persoonsgegevens (AP).

8. International Data Transfers

Your data is stored on servers within the European Economic Area (EEA). If data is transferred outside the EEA (e.g., through Discord or Reddit APIs), such transfers are covered by Standard Contractual Clauses (SCCs) or the provider's adequacy decision.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

  • Passwords and API keys are stored as irreversible cryptographic hashes
  • IP addresses are hashed with daily-rotating salts
  • All data in transit is encrypted via TLS/HTTPS
  • Access to personal data is restricted to authorized personnel
  • JWT tokens are stored in httpOnly, secure cookies

10. Children's Privacy

Relyo is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform. Your continued use after the effective date constitutes acceptance of the updated policy.

12. Contact

Data Protection Officer / Privacy Contact:
Email: privacyrelyo@doombringerz.com