Privacy Policy

The data controller is SADOART, the operator of CAVE CORE. Contact details for privacy questions are in the last section of this policy.

• Discord account data: ID, username, avatar and server list (via Discord login);
• Dashboard account data: name, email and password (stored encrypted, never in plain text);
• Server data: channel, role and member IDs needed for the configured features;
• Server activity data: XP and levels, warnings and moderation actions, tickets, suggestions and votes, giveaways, economy balances;
• Bot settings and integrations connected by the administrator (for example Spotify, Twitch, YouTube or Kick);
• Payment data: plan purchased, amount, date, subscription status and Stripe identifiers. Card details are entered directly with Stripe and never pass through our servers;
• Dashboard activity logs: configuration changes and dashboard pages visited, with date, account and server, for security and support (no passwords or tokens).

We do not read or store private messages. The content of channel messages is only processed when a feature needs it (for example auto-moderation or XP).

When you buy from the QuinasCraft server shop, we collect your Minecraft username, your email for the receipt, the products purchased and the payment status. This data is used to deliver purchases on the game server, send the receipt and answer support or refund requests.

The Minecraft Bridge connects a Minecraft server to Discord. To do this, it processes your Minecraft username and UUID, the link to your Discord account (when you create it) and chat messages sent between the game and the configured channel.

• Performance of a contract (Art. 6(1)(b) GDPR): providing the features of the bot, dashboard and shop, managing licences, plans and payments, and providing support;
• Consent (Art. 6(1)(a)): usage statistics with Google Analytics and connecting streaming accounts. You can withdraw consent at any time;
• Legitimate interest (Art. 6(1)(f)): Service security, preventing abuse and fraud, and dashboard activity logs;
• Legal obligation (Art. 6(1)(c)): keeping billing data for the period required by tax law.

We do not sell personal data or use it for advertising.

Data is only shared with the services needed for operation:

• Discord (the platform where the bot runs);
• Stripe (card and Pix payment processing);
• Abacus.AI (hosting of the website, dashboard and database, on cloud infrastructure);
• Google (Google Analytics, only with your consent, and the YouTube API, if you connect a channel);
• Twitch, Kick and Spotify, only if the administrator connects those integrations.

Some of these services (for example Discord, Google and Stripe) process data in the United States. In those cases the transfer is based on the EU-US Data Privacy Framework, when the company is certified, or on the standard contractual clauses approved by the European Commission.

We use Google Analytics 4 to measure website visits in aggregate (pages viewed, country, device type, traffic source). It is only enabled after you accept the notice shown on your first visit; if you decline, the Google script is not loaded.

Your IP address is anonymised. You can change or withdraw your choice at any time with the “Cookie preferences” link in the footer of every page. When you withdraw consent, the Google Analytics cookies are deleted. More information at policies.google.com/privacy.

Apart from this, we only use strictly necessary cookies (login session and language), which do not require consent.

When you connect a channel under “Streaming Channels”, you authorise CAVE CORE to access your account on that platform through OAuth. We never see or store your password.

• Twitch: channel ID, name and image; permissions for CaveCoreBot to read and write in chat and to moderate.
• YouTube (Google): channel ID, name, @handle and image; youtube.force-ssl permission (to know when you are live, read the live chat, send messages and moderate the live chat: delete messages, time out and ban users).
• Kick: channel ID, name and image; permissions to read the channel, write in chat, receive events and moderate.

We store access and refresh tokens securely, only so the Chat BOT can work on your channel and for live alerts on Discord. We do not use this data for advertising, sell it or share it with third parties.

You can disconnect a channel at any time. You can also revoke access directly: Google at myaccount.google.com/permissions, Twitch at twitch.tv/settings/connections and Kick in your Kick account settings. When access is revoked or you ask for removal, we delete the tokens and channel data.

CAVE CORE uses the YouTube API Services. By connecting your YouTube channel, you agree to the YouTube Terms of Service (youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy).

CAVE CORE’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube data is only used for the features you enabled in the CAVE CORE Dashboard. It is not used to train AI models and is not read by humans, except with your consent, for security reasons or when required by law.

To provide support, fix problems or check settings, the CAVE CORE team may open a server’s dashboard in support mode. Each access is recorded in the activity logs, showing who made it.

Server data is kept while the bot is on the server or until the administrator asks for removal. Account data is kept while the account exists. Streaming channel tokens are kept while the channel is connected and deleted when it is disconnected or access is revoked.

Dashboard activity logs are deleted automatically after 90 days. Payment and billing data is kept for the period required by tax law.

You have the right to access, correct, export or delete your data, to restrict processing, to object to processing based on legitimate interest and to withdraw consent at any time, without affecting processing already carried out. To exercise these rights, contact us (see below). You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD, cnpd.pt).

If you live outside Portugal, you can also lodge a complaint with the data protection authority in your country. In Brazil, you have the rights set out in the General Data Protection Law (LGPD) and can contact the National Data Protection Authority (ANPD).

We use encrypted connections (HTTPS), hashed passwords and encrypted integration tokens. Access to data is restricted to the CAVE CORE team.

The Service follows the minimum age required by Discord. We do not knowingly collect data from users under that age.

Data controller: SADOART. For privacy questions or to exercise your rights, contact us through sadoart.pt or by opening a ticket on the official CAVE CORE Discord server.