Privacy Policy

Last updated:

1. Responsibility for data

EvoPixel operates bLeaH and is the controller for the website, dashboard accounts, billing and service administration described here. Privacy contact: contact@bleah.xyz. This policy covers bleah.xyz, the dashboard, Discord bot and official apps linking to it.

Discord server administrators determine their own purposes and moderation rules and may have separate controller responsibilities. Processing performed by bLeaH solely for them depends on applicable instructions and arrangements. Discord, PayPal and other providers also have their own policies. Joining a server does not provide consent for every form of processing.

2. Data and sources

  • Website and dashboard: IP address, browser, device, requests, access times, errors, sessions and language or theme preferences. Discord authorisation provides your identifier, name, avatar and server list with relevant permissions through the identify and guilds scopes. bLeaH does not receive your Discord password.
  • Bot and community: user, server, channel and role identifiers, configurations, commands and usage logs. Enabled features may store your chosen profile, biography, birth date, reminders, levels, points, virtual economy, sanctions and moderation information. Message content may be read for commands, moderation and enabled features in channels the bot can access.
  • AI: messages sent to AI features, conversation context, Discord identifiers and names, relevant images or attachments, voice and transcripts depending on the interaction. Text context may be stored in the user or server database for conversation continuity.
  • Premium: plan, price, currency, status, expiry, PayPal payment and subscription identifiers, renewal and payment-issue information. Payment takes place at PayPal; the dashboard does not request a full card number.
  • Contact and apps: messages sent to the team and technical information needed by the app, including Firebase notification tokens where enabled.

3. Purposes and legal bases

GDPR Article 6(1)(b) covers accounts, orders and requested features, including Premium, where necessary for a contract or steps you request. Legitimate interests under (f) support security, abuse prevention, diagnosis, community administration and general enquiries, with assessment of the impact on your rights. Mandatory records and lawful requests rely on (c). Consent under (a) is used separately for optional features requiring it, including notifications or non-essential technologies; you may withdraw it.

Discord information is needed for sign-in and server access checks. Without information required for a feature, it may be unavailable. Optional profile details are not necessary to visit the website. Do not use the bot to send unnecessary sensitive information or other people's information without an appropriate basis.

4. AI, voice and automated moderation

AI interactions send relevant information and context to OpenAI for responses, image analysis, transcription or voice conversations. An enabled voice session may process participants heard by the bot; administrators must inform them and ensure applicable legal conditions. End the session or avoid the feature if you do not want this processing. This policy does not itself constitute participants' consent.

Automated rules may detect messages and trigger moderation measures. Ask server administrators to review server measures; contact us about bLeaH operation or service-imposed restrictions. You can request explanations and human intervention as provided by law. AI responses are not treated as verified facts about people.

5. Recipients and visibility

Commands, profiles, rankings and bot replies may be visible to channel members or others with access under Discord permissions. Authorised administrators may see server settings and moderation information. A message to the bot is not automatically confidential from others able to view that channel.

Hosting, database and support providers receive information needed for their tasks. Discord supports sign-in and interactions, PayPal handles payments, OpenAI processes AI interactions and Google/Firebase supports relevant features. Translation or media services may receive the text or request needed for the function used. Authorities and advisers may receive information as provided by law. We do not sell personal data for advertising.

6. Cookies and external providers

  • Session and sign-in cookies, including bleah_account for website-dashboard access, and local preferences support access and settings. Some persist after the browser closes. Signing out, revoking Discord authorisation and clearing cookies are separate actions; blocking necessary cookies may prevent sign-in.
  • To select language without an account preference, your IP may be sent to country.is to identify the country. This is not GPS location. Loading Google Fonts and Discord avatars sends IP and technical information to the resource provider.
  • The current website configuration does not integrate Google Analytics, AdSense or advertising pixels. Introducing non-essential technologies requires updated notice and prior consent where legally required; this policy does not replace it.
  • See the policies of Discord, PayPal, OpenAI and Google. Simple social links are not advertising pixels.

7. Retention, transfers and security

Account data, configuration and feature history are kept as necessary for the active service. AI context supports conversation continuity; do not assume it is erased when you close Discord. Enquiries are retained to resolve them and substantiate the outcome; moderation and security information follow abuse-prevention and legal-claim needs. Payment data and mandatory records follow applicable statutory periods.

There is no single retention period. You can request erasure and the period or criteria for your data. Removing the bot or revoking Discord does not immediately erase all records; legal obligations, disputes and backup cycles may require limited retention. Server administrators may separately hold copies of messages or logs.

Some providers process data outside the European Economic Area. Transfers subject to GDPR require an adequacy decision or appropriate safeguards such as standard contractual clauses, with additional measures where needed. You may request recipient and safeguard details. Using the bot is not blanket consent to transfers. We apply access controls and permission checks without promising absolute security.

8. Rights, minors and updates

Subject to GDPR conditions, you can request access, rectification, erasure, restriction and portability, object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Contact us with your Discord identifier and request, without a password. We may verify identity proportionately. We normally respond within one month; a lawful extension of up to two further months is explained in the first month.

You may complain to ANSPDCP or the competent authority in your country and seek a judicial remedy. Respect Discord's minimum age and rules protecting minors; a legal representative may contact us about a child's data as provided by law.

Updates are dated here. Significant changes require notice and, where applicable, fresh consent. This policy is interpreted in accordance with GDPR.