Privacy Notice

1. Data Controller

The data controller responsible for your personal data is Lona System, operating the website lonabot.space (the "Service").

Legal entity: Lona System — Independent software business

Registered address: Provided on request and to our payment provider as part of merchant verification

Contact: [email protected]

For any question about this notice or about how we handle your data, contact us at the address above. We aim to respond within 7 days.

2. What Data We Collect

We collect only what is necessary to operate the Service. We do not collect special-category data, and we do not build advertising profiles.

Category	Examples	Source
Account identifiers	Discord user ID, username, avatar URL, list of servers you administer	Discord OAuth
Server configuration	Settings you choose in the dashboard: moderation rules, ticket panels, welcome messages, role mappings	You
Activity data	Experience points, level, message counters — only where a server administrator has enabled these features	Discord API
Audit and moderation logs	Records of administrative actions taken through the Service, retained for accountability	Service
Session data	Encrypted session cookie, OAuth access token, IP address and user agent at sign-in	Your browser
Subscription data	Subscription status, plan, renewal date, transaction reference. We never receive or store card numbers.	Payment provider

3. Purposes and Legal Bases

Where the GDPR or equivalent law applies, we rely on the following legal bases:

Performance of a contract — to provide the dashboard, apply your configuration, manage your subscription and provide support.
Legitimate interests — to keep the Service secure, prevent abuse and fraud, maintain audit logs, and diagnose faults.
Legal obligation — to retain transaction records required by tax and accounting law.
Consent — for any optional feature you explicitly enable. You may withdraw consent at any time.

We do not use personal data for automated decision-making that produces legal effects, and we do not sell personal data under any circumstances.

4. Sub-processors and Sharing

We share the minimum data necessary with the following processors:

Processor	Purpose	Data shared
Discord Inc.	Authentication and platform operation	User ID, server IDs
Lemon Squeezy, LLC	Merchant of Record — payment processing, tax, invoicing, refunds	Email, billing country, transaction data
Hosting provider	Application and database hosting	All stored data, encrypted in transit

We do not sell, rent, or trade personal data. We disclose data to a public authority only where compelled by a valid, legally binding order, and we will notify you unless prohibited by law.

5. Retention Periods

Account and configuration data — kept while your account is active, then deleted within 90 days of account closure or of the Service being removed from your server.
Activity and level data — deleted within 90 days of the feature being disabled or the Service being removed.
Audit and moderation logs — retained for up to 12 months for security and accountability, then deleted.
Session data — deleted on sign-out or after 30 days of inactivity.
Transaction records — retained for 7 years where required by tax and accounting law.

6. Your Rights

Subject to applicable law, you have the right to:

Access — obtain a copy of your data

Rectification — correct inaccurate data

Erasure — request deletion

Restriction — limit our processing

Portability — receive data in a machine-readable format

Objection — object to legitimate-interest processing

Withdraw consent — at any time, without affecting prior processing

Complain — to your local supervisory authority

To exercise any right, email [email protected] from the address associated with your account. We respond within 30 days. We do not charge a fee for reasonable requests.

7. Cookies

We use strictly necessary cookies only. We do not use advertising, analytics, or cross-site tracking cookies.

Cookie	Purpose	Duration
session	Keeps you signed in — strictly necessary	30 days
csrf_token	Protects forms against cross-site request forgery	Session

Because these cookies are strictly necessary to deliver a service you requested, no consent banner is required. Blocking them will prevent you from signing in.

8. Security and International Transfers

TLS/HTTPS encryption for all connections
CSRF protection on every state-changing request
Rate limiting on all public endpoints
Access to production data limited to authorised personnel
Unique encrypted secret per session

Our processors may store or process data outside your country of residence. Where personal data of individuals in the EEA or UK is transferred, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

Breach notification: in the event of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify affected users without undue delay.

9. Children

The Service is not directed at children. In line with Discord's own Terms of Service, you must be at least 13 years old (or the minimum age of digital consent in your country, whichever is higher) to use the Service. If we learn that we hold data of a child below that age, we delete it promptly. A parent or guardian may contact us at [email protected] to request deletion.

10. Payment Data

All payments are processed by Lemon Squeezy, LLC, which acts as the Merchant of Record for every order. Lemon Squeezy collects and processes your billing information under its own privacy policy. We never see, receive, or store your card number, CVV, or bank details. We receive only a payment confirmation, your subscription tier, and its renewal date.

11. Changes to This Notice

We may update this notice to reflect changes in the Service or in the law. The "last updated" date at the top always reflects the current version. For material changes we will give notice in our support server and, where required, seek your consent before the change takes effect.