Owner and Data Controller
Easy Auth — an independent software project, operated on a personal basis and not incorporated as a company, based in Italy.
Owner contact email: [CONTACT EMAIL]
For any request concerning the processing of personal data, this Privacy Policy or the exercise of the rights provided by the GDPR, Users may contact the Owner at the email address indicated above.
Types of Data collected
Among the types of Personal Data that Easy Auth collects, by itself or through third parties, there are: Discord account identifiers; email address associated with the Discord account; Usage Data; IP address; session and access data; data relating to subscriptions and transactions.
Complete details on each type of Data collected are provided in the dedicated sections of this privacy policy.
Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically when using the Service. Some Data may also be received from third parties, in particular from Discord, as described in the following sections.
Unless specified otherwise, the Data processed is necessary for the provision of the Service: failure to provide such Data may make it impossible to deliver the requested features.
Logs are not intended to intentionally collect the content of private messages or of Users’ messages.
Users are responsible for any third-party Personal Data obtained, published or shared through the Service.
Mode and place of processing the Data
Methods of processing
The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification or unauthorized destruction of the Data.
The processing is carried out using computers and/or IT-enabled tools, following organizational procedures and modes strictly related to the purposes indicated. Access to the Data is limited, as far as reasonably possible, to the systems and parties that need it for the operation of the Service, such as technical and hosting service providers, appointed, where necessary, as Data Processors.
Legal basis of processing
The Owner may process Personal Data relating to Users if one of the following applies:
- Users have given their consent for one or more specific purposes, where required;
- the processing is necessary for the performance of a contract with the User and/or for any pre-contractual obligations thereof, i.e. to provide the requested Service;
- the processing is necessary for compliance with a legal obligation to which the Owner is subject;
- the processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party, for example to ensure the security of the Service and prevent abuse.
In any case, the Owner will gladly help to clarify the specific legal basis that applies to each processing activity.
Place
The Data is processed through the hosting services and technical infrastructure indicated in the section “Detailed information on the processing of Personal Data”.
Some providers used by Easy Auth may process Data outside the European Economic Area. In such cases, transfers are carried out in compliance with the conditions set out by the GDPR, for example on the basis of adequacy decisions or Standard Contractual Clauses.
Retention time
Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose for which it has been collected and may be retained for longer due to applicable legal obligations or based on the User’s consent.
Where no predetermined retention period can be set, criteria such as the necessity of the Data for the operation of the Service, security, abuse prevention and subscription management are used. Data is not automatically deleted upon removal of the Bot from a server: it is deleted or anonymized following a request by the data subject, or when the Owner determines that it is no longer necessary for the purposes for which it was collected. Data relating to authentication sessions may be deleted upon expiry or invalidation of the relevant session.
The purposes of processing
The Data concerning the User is collected to allow the Owner to provide the Service, comply with legal obligations, respond to enforcement requests, protect its rights and interests (or those of Users or third parties), detect any malicious or fraudulent activity, as well as for the following purposes: registration and authentication; operation of the bot within Discord servers; hosting and backend infrastructure; handling payments; infrastructure monitoring and security.
For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”.
Detailed information on the processing of Personal Data
Personal Data is collected for the following purposes and using the following services:
Registration and authentication (Discord OAuth2)
By registering or authenticating, the User allows Easy Auth to identify them and give them access to the dashboard and dedicated services. The authentication service is provided by Discord via OAuth2: in this case, Easy Auth will be able to access some Data stored by Discord, for registration and identification purposes only. Easy Auth does not receive or store the credentials of the User’s Discord account.
Personal Data processed: Discord account identifiers; email address associated with the Discord account; session data.
The use of Discord authentication is also subject to the Discord Privacy Policy.
Operation of the bot within Discord servers
Easy Auth operates within the Discord servers where it is installed, in order to provide the features configured by server administrators. To this end, the Service may process Discord identifiers relating to users who interact with the bot, even where such users have not logged into the dashboard.
Personal Data processed: Discord identifiers; Usage Data.
Hosting and backend infrastructure
This type of service has the purpose of hosting Data and files that enable the Service to run and be distributed.
Supabase (Supabase, Inc.)
Supabase is a hosting and database management platform used for the storage and management of the Service’s data.
Personal Data processed: various types of Data, as specified in the privacy policy of the service.
Handling payments
Unless otherwise specified, payments are processed through external payment service providers. Easy Auth is not involved in the collection of full payment instrument details (such as the full card number): it only receives the information necessary to manage the subscription, such as the outcome and status of the payment.
Stripe (Stripe, Inc.)
Stripe is a payment service that enables the handling of payments and subscriptions.
Personal Data processed: various types of Data, as specified in the privacy policy of the service.
Infrastructure monitoring and system logs
For operation, security and maintenance purposes, Easy Auth may record events and operations performed through the Service. While using the dashboard, technical data relating to the connection may also be processed, for security, abuse prevention and session management purposes.
Personal Data processed: IP address; user-agent; session and access data (dates and times); event and operation logs.
The rights of Users based on the GDPR
Users may exercise certain rights regarding their Data processed by the Owner. In particular, to the extent permitted by law, Users have the right to:
- withdraw their consent at any time, where the processing is based on consent;
- object to the processing of their Data, where the processing is carried out on a legal basis other than consent;
- access their Data, obtaining confirmation as to whether processing is taking place and a copy of the Data undergoing processing;
- verify and seek rectification of inaccurate or incomplete Data;
- restrict the processing of their Data;
- have their Personal Data deleted or otherwise removed;
- receive their Data and have it transferred to another controller (portability);
- lodge a complaint with the competent supervisory authority in their country of residence (a list of European supervisory authorities is available at https://www.edpb.europa.eu/about-edpb/our-members_en).
How to exercise these rights
Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. Such requests are free of charge and will be answered by the Owner as early as possible and always within one month. To protect Personal Data, the Owner may request information reasonably necessary to verify the identity of the requester.
Additional information about Data collection and processing
Data received from Discord and other parties
Some Data processed by Easy Auth may not be provided directly by the data subject. For example, the bot may receive from Discord information relating to users who are members of a server where Easy Auth is installed or who interact with its features. In such cases, Easy Auth processes such Data to the extent necessary to provide the Service and ensure its security.
System logs and maintenance
For operation and maintenance purposes, the Service and any third-party services it uses may collect system logs, i.e. files that record interactions with the Service and which may also contain Personal Data, such as the IP address.
Automated decision-making
Easy Auth does not use Personal Data to make decisions based solely on automated processing which produce legal effects or similarly significant effects on the data subject.
Information not contained in this policy
More details concerning the processing of Personal Data may be requested from the Owner at any time using the contact details provided in this document.
Changes to this privacy policy
The Owner reserves the right to make changes to this privacy policy at any time by notifying Users on this page. It is strongly recommended to check this page often, referring to the date of the last modification listed at the top. Should the changes affect processing activities based on the User’s consent, the Owner shall collect new consent from the User, where required.
Definitions and legal references
- Personal Data (or Data)
- any information that directly, indirectly, or in connection with other information allows for the identification or identifiability of a natural person.
- Usage Data
- information collected automatically through the Service, which may include: IP addresses, times of requests, technical details of the connection and other parameters relating to the use of the Service.
- User
- the individual using the Service who, unless otherwise specified, coincides with the Data Subject.
- Data Subject
- the natural person to whom the Personal Data refers.
- Data Processor
- the natural or legal person that processes Personal Data on behalf of the Controller, as described in this privacy policy.
- Data Controller (or Owner)
- the party that determines the purposes and means of the processing of Personal Data. The Data Controller, unless otherwise specified, is the operator of Easy Auth.
- Service
- the service provided by Easy Auth, comprising the Discord bot, the web dashboard and related features.
- Cookie
- small sets of data stored in the User’s device, used to store or retrieve information.
- Legal information
- this privacy policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR) and applicable legislation. Unless otherwise specified, this privacy policy relates solely to the Easy Auth Service.
The rules of the Service: subscriptions and renewals, the free trial, withdrawal and refunds, acceptable use.