> For the complete documentation index, see [llms.txt](https://docs.doublecounter.gg/double-counter-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.doublecounter.gg/double-counter-en/legal.md).

# Privacy Policy

Double Counter legal terms and commitment to keep your data safe.

At Double Counter, your privacy is a priority. We collect only the minimal personal data necessary to detect alternate accounts and ensure server security. All data is automatically processed.

You can request access to or deletion of your personal information at any time via our [Discord support server](https://discord.com/invite/doublecounter). This policy outlines what data we collect, how it’s used, and your rights under GDPR.

## Introduction

We are committed to safeguarding your privacy and handling your data transparently and responsibly. This Privacy Policy explains what personal data we collect, how it is used, and your rights under applicable laws, including the [General Data Protection Regulation (GDPR)](https://gdpr.eu/).

This policy applies to your use of:

* The Double Counter Discord bot
* The Double Counter web portal and configuration dashboard
* Any related services provided by Tellter SAS

We may update this policy as needed to reflect changes in technology, law, or business practices. If any significant changes are made, we will notify you and seek consent where required. Notations will be made to display the date and purpose of any updates.

## Who We Are

**Double Counter** is a service operated by **Tellter SAS**, a company registered in France under [SIREN Identification Number 899 727 606, Paris RCS](https://www.societe.com/societe/tellter-899727606.html)), with a capital of 5,000 euros, located at 9 rue des Colonnes, 75002 Paris, France.

## What Data We Collect

**When you interact with our services, Double Counter obtains and stores the following data:**

* **Discord User ID:** Collected when you click the verification link.
* **Discord Username**: The username of users is stored at the time of verification. It is associated with the user ID, and its associated data.
* **IP Address:** Collected when you click the verification link.
  * Linked to your **Discord ID**
  * Linked to additional IP Address derived data: Internet service provider (to detect VPNs, Tor nodes or VPS) and coarse geographical location (Country, Region, City, ZIP Code).
  * Used solely for detecting alternate accounts (fraud prevention)
* **Browser User-Agent**
* **Email Address:** Your e-mail address is never collected during Double Counter verification, as it does not involve OAuth2 authorization. However, it may be collected and associated with your User ID when you use our web dashboard to configure Double Counter in your server.
* Guild **name**, **icon** and approximate **member count**: this data is cached where applicable, and served in our logs and dashboard
* **Guild IDs**, **Channel IDs** and **Role IDs**: Guild IDs are stored when users configure Double Counter in their guild. It can be associated, at most, with: channel IDs (configuration items), role IDs (configuration items), user IDs who attempted verification in their guild.
* **Audit Log Entries:** audit logs for bans, kicks and moderator message deletions, to provide moderators with an overview of sanctions taken against a user. It is associated with the Guild ID and User ID.
* **Entitlements data**: This data is stored when users subscribe to Double Counter Pro. It is associated with User ID, Guild ID, and potential cancellation date.
* **Interaction data**: Folllow-up URLs and interaction tokens are stored short term (a few minutes), to be able to follow-up with bot interactions after they're deferred.

## How We Use Your Data

We process your data under the **legal basis of Legitimate Interests** (Article 6(1)(f), GDPR), specifically for:

* Detecting alternate (fraudulent) accounts
* Preventing abuse and ban evasion
* Supporting community moderation and integrity

This means we process data where it is necessary for the purposes of preventing abuse, protecting community integrity, and maintaining the functionality of the verification system, provided that such interests are not overridden by your fundamental rights and freedoms. 

All personal data processed by Double Counter is automatically handled by automated systems and encrypted at rest using AES-256. This includes IP addresses, browser fingerprints, and other directly identifying information.

### Data Use During Verifications

When a user attempts to verify through a server using the Double Counter bot, the system may determine that the account is associated with one or more previously flagged or verified accounts. In these cases, a log message is sent to the server via the Discord API to inform moderators of the result. This message includes the Discord usernames and user IDs of both the user attempting to verify and the account they are associated with. These identifiers are retrieved from our internal database, decrypted, and transmitted securely to the server where the verification attempt occurred. This data is shared only with the server using the bot at the time of the verification request and is not disclosed outside that context. It is intended solely for the legitimate purpose of assisting moderators and Administrators in enforcing server-specific verification rules and preventing abuse. This processing is based on our legitimate interest in supporting community moderation (Article 6(1)(f), GDPR), and the data is only shared to the extent necessary to fulfill that purpose.

### Service Providers

We do not sell your personal data. Beyond the moderators of the server where a verification takes place (as described above), we share data only with service providers who process it on our behalf, under contract and on our instructions:

* **Google Cloud Platform**: hosting and database infrastructure (servers located in Europe);
* **Stripe**: payment processing for a part of our subscriptions. Stripe receives billing data directly, we do not store full card details;
* **Resend**: transactional and service emails;
* **PostHog** and **Datadog**: product analytics and system monitoring;
* **Google Adsense**: advertising on the verification page.

### Data Retention Period

We retain verification and detection data for **24 months** after your last verification or detection, after which it is securely deleted.

Where an account has been **detected by our systems -** this includes repeated evasion attempts or system detection - the associated detection records may be retained for up to **36** **months** to prevent recurring fraud.

A data deletion request takes precedence over these periods.

## Your Rights Under GDPR

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

1\. Right of Access (Article 15)

* You have the right to request confirmation of whether we process your personal data and to receive a copy of the data we hold about you, including the purposes of processing and categories of data involved. You may initiate this request using the `/privacy` command or contacting <gdpr@doublecounter.gg>.

2\. Right to Rectification (Article 16)

* Due to the automated nature of our systems and the security design of our verification services, we are unable to manually alter certain system-generated data (such as behavioral or technical indicators) without compromising the integrity of the service. However, where feasible, we will assist in reviewing directly stored data (such as opt-in preferences or email delivery records) and apply corrections if appropriate. We rectify only data we directly store and can reliably amend, such as opt-in preferences. These data can however be deleted, following the procedure described below.

3\. Right to Erasure (Article 17)

* Also known as the “right to be forgotten.” You may request the deletion of your personal data. This right is subject to statutory and security exceptions, including where limited data must be retained to comply with legal obligations or to protect the integrity of our fraud-prevention system. To begin the process, use the `/privacy` command or contact <gdpr@doublecounter.gg>, in any server where the bot is installed or in DMs with the bot, then select “Delete my data.” All personal data contained in our database, specifically your IP address, username, browser agent information, and e-mail address will be deleted immediately upon confirmation. Deletion revokes your verification record in our systems and removes any “Verified” status you hold in all servers using Double Counter. Servers you were actively verified in will receive notice. Erasure does not pause real-time verification on servers you continue to use, nor does it allow you to change accounts or verify with a new/different account. To prevent further processing going forward, you must leave servers that utilize Double Counter and cease all interactions with the service.

4\. Right to Restrict Processing (Article 18)

* While we cannot pause real-time verification functionality, you can prevent further data processing by leaving all servers that utilize Double Counter and cease all activity with our services.

5\. Right to Data Portability (Article 20)

* You may request a copy of the personal data you provided to us in a structured, commonly used, and machine-readable format and have the right to transmit that data to another controller where applicable. This can be achieved with the `/privacy` command.

6\. Right to Object to Processing (Article 21)

* You have the right to object at any time to the processing of your personal data where it is based on our legitimate interests. You can restrict further data processing by leaving all servers that utilize Double Counter and cease all activity with our services.

7\. Right Not to Be Subject to Automated Decision-Making (Article 22)

* You have the right not to be subject to decisions made solely through automated processing, including profiling, where such decisions produce legal effects or similarly significant consequences. While Double Counter uses automated systems to assess risk and detect alternate accounts, no decisions result in direct legal consequences, and server moderation actions remain the responsibility of server administrators. You may request a manual review of automated decisions by contacting us.

If you have questions or concerns, please contact us at *<gdpr@doublecounter.gg>* or use the `/privacy` command in any Discord server where our bot is installed in order to delete your data. We aim to respond to all data subject rights requests within **30 days**, as required by Article 12 of the GDPR. If you are not satisfied with our response or believe your data is being processed unlawfully, you also have the right to lodge a complaint with a supervisory authority.

## Security

We protect your data from unauthorized access with technical, organizational and commercially reasonable measures. These measures include:

* Encryption of data in transit (TLS) and at rest (AES-256);
* Databases and caches reachable only through private networks, with no public internet access;
* Centralized secret management, with logging of every secret access;
* Least-privilege access for our systems and staff, and monitoring and alerting on sensitive changes.

## Contact & Complaints

If you have any questions or concerns regarding your data or this policy:

📧 **Privacy Contact:** *<gdpr@doublecounter.gg>*

{% hint style="info" %}
Updated on the 15th of October, 2026.

Extensive details were added on Double Counter's data collection; precisions brought on the full deletion of personal data; added service providers; new data retention period; removal of our Doogle service.

This revision corrects and expands our previous policy. This revision includes updates to wording, terminology, and explanatory details to improve clarity and avoid potential misinterpretation. These changes reflect our commitment to transparency and GDPR compliance.
{% endhint %}