Legal
Privacy policy
Effective 2024-06-06
This privacy policy describes how Gateway Corporate LLC ("we", "us") collects, uses, stores, and discloses information when communities ("tenants") deploy QBot4K and when operators and end users interact with the service.
1. Scope and roles
For community content and member data ingested from third-party platforms (e.g. Discord, Twitch), the community operator acts as the data controller and Gateway Corporate LLC acts as a data processor (or service provider) processing data solely on the operator's documented instructions. For operator accounts and service telemetry, Gateway Corporate LLC is the controller.
2. Data we process
- Operator account data: Discord identifiers, usernames, OAuth tokens, community role assignments, and invitation records.
- Community content: messages, member metadata, moderation events, and engagement signals from installed platforms, ingested only within installations authorized by the community.
- Moderation and audit records: sanctions, reversals, evidence bundles, operator actions, and immutable audit logs.
- Service telemetry: health checks, error logs, and performance metrics used to operate and secure the service.
3. Tenant isolation
Community data is logically isolated per tenant. Access is restricted to operators holding an active, scoped role for that tenant and to audited service processes. Cross-tenant access is denied by default, recorded when attempted, and reviewable in the audit workspace.
4. Legal bases (EEA/UK)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the service to operators), legitimate interests (security, abuse prevention, service improvement, balanced against member rights), and legal obligations (retention required by law). Community operators are responsible for establishing their own lawful basis for member data processed through their installation.
5. Retention
Retention follows each community's configured policy, subject to legal holds and statutory obligations. Audit and moderation evidence is retained for the period configured by the tenant; deletion requests propagate to replicas and backups on the next rotation cycle, at the latest within 30 days.
6. Sub-processors and transfers
Data is shared only with the infrastructure and platform providers required to deliver the service, under data processing terms. Where data is transferred internationally, we rely on adequacy decisions or standard contractual clauses as the transfer mechanism.
7. Security
We apply encryption in transit, scoped credentials, least-privilege access, origin-checked mutations, and continuous health monitoring. No method of transmission or storage is perfectly secure; material incidents affecting your data will be notified to affected operators without undue delay.
8. Your rights
Depending on your jurisdiction you may have rights of access, rectification, erasure, restriction, portability, and objection. End users should direct requests to their community operator first; operators may contact office@gatewaycorporate.org. We respond to verified requests within the period required by applicable law.
9. Children
The service is an operations tool for community staff and is not directed at children under 13 (or the minimum digital-consent age in the applicable jurisdiction). We do not knowingly collect operator account data from children.
10. Changes and contact
We may update this policy; material changes are announced through the service before taking effect. Questions and requests: office@gatewaycorporate.org.