In force as of 26 August 2026
Courtesy translation. This policy is published by a French company and governed by French law and the GDPR. In the event of any discrepancy, the French version prevails.
B&R DIGITAL attaches particular importance to the protection of personal data. This policy describes the processing carried out as part of the Bao service, in accordance with Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978 as amended.
1. Who is responsible for your data
Two situations must be distinguished, because they do not carry the same responsibilities.
| Situation | Controller | B&R DIGITAL's role |
|---|---|---|
| Your account, your subscription, your billing, the security of the service | B&R DIGITAL | Controller |
| The data of a Discord server's members processed according to the configuration decided by its administrators | The server's administrator | Processor, within the meaning of Article 28 GDPR |
In other words: when an administrator enables logs, tickets or an artificial intelligence agent on their server, it is they who decide the purpose of the processing. Bao carries out their instructions.
Controller's details:
| Controller | |
|---|---|
| Company name | B&R DIGITAL, société par actions simplifiée |
| Address | 60 rue François Ier, 75008 Paris, France |
| Personal data contact | contact@mybao.io |
No data protection officer has been appointed, as such an appointment is not mandatory given the activity.
2. Data processed
2.1. Account data
Collected through Discord authentication (OAuth protocol): Discord ID, username, avatar, email address associated with the Discord account, list of administered servers.
No password is created or kept.
2.2. Configuration data
The settings entered by administrators: channels, roles, messages, panels, moderation rules, agent parameters, and all the dashboard's options.
2.3. Data relating to a server's members
Depending on the features enabled by the administrator:
- Discord IDs and nicknames;
- experience points, levels and activity statistics;
- the content of support tickets and the associated transcripts;
- conversations exchanged with an artificial intelligence agent;
- infractions, sanctions and events recorded in the logs;
- giveaway entries and tasks completed;
- messages analysed by auto-moderation, processed in memory and not retained where no infraction is found.
2.4. Knowledge bases
The documents, web pages, channels and notes provided by an administrator to feed an agent, together with their indexed representation.
2.5. Monetisation data
When a customer uses paid roles: their own buyer's email address, order or subscription reference, the tier concerned, and the log of events received.
2.6. Billing data
Name or company name, billing address, country, customer identifier and payment history.
No bank card data is processed or stored by B&R DIGITAL. That data is collected directly by Stripe.
2.7. Technical data
Connection and error logs, IP address, timestamps, session identifiers, consumption indicators for the artificial intelligence features.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service and running the configured features | Performance of the contract (Art. 6(1)(b)) |
| Managing accounts, subscriptions and billing | Performance of the contract and legal obligation (Art. 6(1)(b) and 6(1)(c)) |
| Ensuring security, preventing fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
| Measuring artificial intelligence consumption and applying caps | Performance of the contract (Art. 6(1)(b)) |
| Answering support requests | Legitimate interest (Art. 6(1)(f)) |
| Improving the service through aggregated statistics | Legitimate interest (Art. 6(1)(f)) |
| Measuring how well our advertising campaigns perform, using cookies | Consent (Art. 6(1)(a)) |
| Measuring purchases originating from our advertising campaigns, without cookies | Legitimate interest (Art. 6(1)(f)) |
| Keeping accounting records | Legal obligation (Art. 6(1)(c)) |
User content is never used to train an artificial intelligence model, neither by B&R DIGITAL nor, on the basis of its contractual agreements, by its model providers.
4. Recipients and processors
Data is neither sold, rented nor transferred for commercial purposes.
It is accessible to authorised B&R DIGITAL staff and to the following providers, acting as sub-processors:
| Provider | Role | Processing location |
|---|---|---|
| Discord Inc. | The platform the service runs on | United States |
| Hostinger International Ltd. | Hosting of the mybao.io marketing site | European Union |
| Railway Corporation | Hosting of the application and the bot | European region |
| Supabase, Inc. | Hosting of databases and files | European Union |
| Stripe Payments Europe, Ltd | Payments and billing | European Union |
| OpenRouter, Inc. | Access to language models | United States |
| OpenAI | Semantic indexing of knowledge | United States |
| Resend | Sending transactional emails | United States |
| Meta Platforms Ireland Ltd. | Advertising campaign measurement | Ireland, with transfers to the United States |
| TikTok Technology Limited | Advertising campaign measurement | Ireland, with transfers to the United States and Singapore |
Transfers outside the European Union
Some providers are established in the United States. These transfers are covered by the appropriate safeguards provided for in Chapter V of the GDPR: an adequacy decision under the EU–US Data Privacy Framework where the provider is certified under it, and otherwise the European Commission's standard contractual clauses, supplemented by technical and organisational measures.
5. Retention periods
| Data | Period |
|---|---|
| User account | For the duration of use, then 3 years from last access |
| A server's configuration | For as long as the bot is installed, then 90 days after its removal |
| Members' levels and experience | For as long as the bot is installed, then 90 days |
| Tickets and transcripts | 12 months from the closing of the ticket |
| Conversations with an artificial intelligence agent | 12 months |
| Knowledge bases | Until deleted by the administrator, then 30 days |
| Moderation and audit logs | 12 months |
| Message delivery logs | 12 months |
| Entitlements linked to paid roles | For the duration of the entitlement, then 3 years for evidential purposes |
| Technical and security logs | 12 months maximum |
| Cookie choice | 6 months |
| Advertising origin attached to an account | 13 months |
| Accounting records and invoices | 10 years, in accordance with Article L.123-22 of the French Commercial Code |
At the end of these periods, data is deleted or irreversibly anonymised.
The depth of history readable in the dashboard depends on the plan subscribed to. That is a display restriction, distinct from the retention period above, which alone determines actual deletion.
6. Security
B&R DIGITAL implements appropriate technical and organisational measures, in particular:
- encryption of communications with TLS;
- encryption of sensitive secrets at rest, and storage of authentication secrets as a non-reversible fingerprint;
- strict partitioning of data by server;
- access to production data restricted to authorised persons;
- logging of accesses and administration actions;
- regular database backups.
In the event of a data breach likely to result in a high risk, the persons concerned and the CNIL are informed under the conditions of Articles 33 and 34 GDPR.
7. Your rights
In accordance with Articles 15 to 22 GDPR, you have the following rights:
- right of access to your data;
- right to rectification of inaccurate data;
- right to erasure, within the limits of legal retention obligations;
- right to restriction of processing;
- right to portability of the data you provided;
- right to object to processing based on legitimate interest;
- right to give directions concerning what happens to your data after your death.
These rights are exercised at contact@mybao.io. A reply is given within one month, extendable by two months in case of complexity. Proof of identity may be requested in case of reasonable doubt.
If your request concerns data processed on behalf of a server (tickets, levels, logs, conversations with an agent), the decision belongs to that server's administrator. Contact them first; we will pass on your request and assist them if necessary.
In the event of persistent disagreement, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
8. Minors
The service is reserved for persons aged at least 13, in accordance with Discord's terms of service. No data is knowingly collected from anyone younger. Any data identified as such is deleted without delay upon report to contact@mybao.io.
9. Cookies and trackers
9.1 Strictly necessary cookies
The site and the application use cookies strictly necessary for their operation: maintaining the authentication session, securing communications, remembering your language and storing your cookie choice. These cookies are exempt from consent under Article 82 of the French Data Protection Act.
The application also stores, in a bao_attr cookie, the name of the campaign you arrived through and the page you landed on, for 13 months. We use this solely to produce internal traffic statistics — to know how people discover Bao. This information identifies a campaign, not a person, is never cross-referenced with other sites and is never passed on to any third party. On that basis this cookie falls under the audience measurement exemption from consent within the meaning of the CNIL's recommendations, and it is kept even if you decline advertising cookies.
If you do decline, however, advertising click identifiers are deleted from it: those do identify a person.
9.2 Advertising cookies
We run advertising and want to know which ads actually bring people to Bao. This measurement relies on cookies set by Meta Platforms Ireland Limited and by TikTok Technology Limited.
These cookies are only set with your consent, collected through a banner shown on your first visit. None is set before you choose. Declining is as simple as accepting, and a refusal is kept for as long as an acceptance.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
bao_consent | Bao | Stores your choice, so we stop asking | 6 months |
_fbp | Meta | Identifies your browser so a visit can be linked to an ad | 3 months |
_fbc | Meta | Stores the identifier of the ad click that brought you here | 3 months |
_ttp | TikTok | Identifies your browser so a visit can be linked to an ad | 3 months |
ttclid | TikTok | Stores the identifier of the ad click that brought you here | 1 day |
_tt_enable_cookie | TikTok | Remembers whether the TikTok pixel may write cookies on your device. It holds no identifier, and is set to 0 if you decline | 3 months |
The marketing site (mybao.io) and the application (app.mybao.io) are two addresses on the same domain: your choice covers both, so you are only asked once. You can change it at any time through the "Cookies" link in the footer.
No Meta or TikTok cookie is set before you answer the banner, and none is set if you decline. Two exceptions, and they are the ones that enforce your choice rather than break it: bao_consent, which remembers your answer so we stop asking, and — only if you first accepted and then changed your mind — _tt_enable_cookie set back to 0, which forbids the TikTok pixel from writing again.
9.3 Purchase measurement
When a subscription is taken out, we send Meta and TikTok a confirmation of that purchase from our servers, in order to measure how well our advertising campaigns perform. What is sent: the amount, the currency, and your email address and Discord identifier in hashed form — never in the clear. This transmission stores no cookie and no tracker on your device, and no data about your server, your members or your messages is involved.
This processing rests on our legitimate interest in measuring our advertising spend (Article 6(1)(f) GDPR). You may object at any time, without giving a reason, by writing to contact@mybao.io: your objection is applied immediately and has no effect on your subscription.
10. Changes to this policy
This policy may be changed to reflect developments in the service or in regulations. Any substantial change is brought to the attention of the users concerned.