Privacy notice
This notice explains how David 'sirrio' Martin processes personal data when you use Loreling.
Controller and contact
David 'sirrio' Martin Alte Dorfstraße 24, 65207 Wiesbaden Email: home@sirrio.de
Data, sources, and account access
Loreling receives your Discord user ID, name, email address, and avatar from Discord when you create or refresh an account. It also processes your language, passkey metadata, worlds, entities, relationships, maps, positions, journal content, uploaded media, API-token metadata, feedback, sharing settings, and Discord-publication metadata. Technical data includes session identifiers, IP and request information available to the web server, and security or administrative audit records. Payment-card details are entered directly at Stripe and are not stored by Loreling.
Purpose and legal basis
Account, content, sharing, API, and billing-status data are processed to perform the service contract (Article 6(1)(b) GDPR). Security logs, abuse prevention, service diagnostics, feedback handling, and administrative audits are processed for the legitimate interests of securing and improving Loreling (Article 6(1)(f) GDPR). Billing and tax records are processed where required by law (Article 6(1)(c) GDPR). Loreling does not use personal data for advertising or automated decisions with legal or similarly significant effects.
Sharing and Discord publication
World sharing is opt-in. A share link makes only the visibility state selected by the owner available to people who receive that link; a signed-in listener may save the link to their account. When you explicitly publish a world through the Loreling Discord bot, the selected visible content and media are sent to the Discord server and channels you choose. Revoking a Loreling share does not delete copies already posted to or retained by Discord.
Processors and recipients
Discord provides OAuth sign-in and the optional bot publication (discord.com/privacy). Stripe provides Checkout, subscription and payment processing, the billing portal, and tax calculation (stripe.com/privacy). DigitalOcean, LLC hosts the application, MySQL database, private media, and encrypted transport endpoint (digitalocean.com/legal/privacy-policy). Laravel Holdings Inc. (Laravel Forge) manages deployment and server access through Laravel Forge (laravel.com/cloud/legal/privacy). Share recipients and Discord server members receive content only when a world owner enables the corresponding feature.
International transfers
Discord, Stripe, DigitalOcean, and Laravel may process data in the United States or other countries outside the European Economic Area. Where an adequacy decision does not apply, the providers state that they use safeguards such as the European Commission’s Standard Contractual Clauses. DigitalOcean and Discord additionally state participation in the EU-US Data Privacy Framework. Current details are available in the provider privacy notices linked above.
Retention and deletion
Active account and world data remain until you delete the account or individual content. Entity revisions are limited to 50 per entity and 90 days. Resolved or dismissed feedback is deleted after 180 days; administrative audit records after 180 days. Session cookies expire after the configured session lifetime. Revoked API tokens can no longer authenticate. Account deletion removes account content and private media from the live system after an active paid subscription has been closed. Loreling also attempts to remove known Discord publication threads and messages; copies may remain under Discord or server moderation if the bot no longer has access. Daily full-server backups at DigitalOcean expire after 7 days, so deleted data may remain inaccessible in a backup until that rotation completes. Stripe and Discord retain data under their own legal obligations and policies.
Your rights
You may request access, correction, deletion, restriction, or portability of your personal data and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it for the future. You may also complain to a competent data protection authority. Contact home@sirrio.de to exercise these rights. Identity verification may be required before a request is fulfilled.