Data processing agreement
If you run a Discord server for a business, a school or anyone else whose members' messages you are responsible for, you may need a written agreement under article 28 of the GDPR before you can use jevmod. This is it.
Omar Hernandez is not a lawyer. This agreement is offered as-is, written from the code and from article 28's own list of required content, not drafted or reviewed by counsel. If your organisation requires its own paper, send it and it will be read, but nothing here should be mistaken for legal advice. Effective 2026-09-20. Statements about the code cite the line they come from, in CLAIMS.md.
Jump to a section (15)
The parties
The controller is you: the person or organisation that added jevmod to a Discord server and decided which categories to turn on. The processor is Omar Hernandez, trading as a sole trader (autónomo) in Valencia, Spain, operating jevmod at jevmod.dev. By using the hosted bot on your server, both parties accept the terms below. If you need a countersigned copy for your own records, write to omarhernandezbastos@gmail.com.
Subject matter and duration
The processor moderates messages posted in the controller's Discord server, judging each one against the categories and rules the controller has configured, and reports the result to the controller's own log channel. Processing lasts for as long as the bot is a member of the controller's server, or until the controller ends it with /mod forget or by removing the bot.
Nature and purpose of the processing
The processing is automated content moderation: for each message that reaches the model, the message text and the topic of its channel are sent to a third-party model, a probability comes back for each category the controller has enabled, and the processor's own code compares that probability with the controller's threshold to decide whether to flag, delete or time out.
The purpose is solely to help the controller moderate their own community. The processor does not use the content of moderated messages for any other purpose, does not train a model on it, and does not sell it.
Types of personal data and categories of data subject
Data subjects are the members of the controller's Discord server whose messages are judged.
- Message text and the channel's topic, sent to the model for judging, then discarded by the hosted deployment:
JEVMOD_KEEP_TEXT_CHARSis set to 0, so the text column of the decision record is always empty. - Discord author id and channel id, kept in the decision record for up to 30 days so an erasure request can be honoured, then deleted automatically.
- The content of a flagged message as it appears in the controller's own log channel. That copy lives in Discord, not in the processor's database, and the controller controls its retention.
Some messages, particularly under the self-harm or harassment categories, may reveal special category data under article 9, such as a person's health or a belief. The processor's database does not keep the text of these messages either; see security measures.
The controller's instructions
The processor acts only on the controller's documented instructions, which are the settings the controller chooses: which categories are on, their thresholds, custom rules, trusted roles and the actions attached to each. The processor does not decide, on its own, to moderate a server that has not configured it to, to change a threshold, or to use the data for a purpose the controller did not set up.
If the processor believes an instruction would infringe the GDPR or another EU data protection provision, it will say so before carrying it out; today that judgment is made by Omar Hernandez personally, since the DISCLAIMER already states the operator carries responsibility for what the code does.
Confidentiality
The processor is one person. There is no staff roster to bind by a separate confidentiality clause because there is no staff. Anyone Omar Hernandez brings in to help operate the service in the future will be bound to the same confidentiality obligations as this agreement before they can reach any data covered by it, and this page will name that change when it happens.
Security measures
Full technical detail is on the security page; the measures relevant to this agreement are:
- Traffic to every public part of the service is encrypted over HTTPS with a certificate issued automatically through Let's Encrypt.
- The hosted deployment is configured to store no message text at all, only ids, categories and probabilities.
- Access to a server's settings from the dashboard is re-checked against Discord's live permission for every request, not cached or assumed from an earlier session.
- The internal service that performs judging and billing is reachable only through a separate connection gated by a shared secret checked with a constant-time comparison.
There is no encryption-at-rest layer beyond what the hosting provider's disks provide, no SOC 2 report and no ISO 27001 certificate. That gap is stated on the security page rather than papered over here.
Sub-processors
Four sub-processors are engaged today, each for one purpose, and the controller authorises all four by accepting this agreement. The processor will tell you here, on this page, before adding another.
| Sub-processor | What it receives | Purpose | Location |
|---|---|---|---|
| TypeSafe | The text of the message being judged and its channel topic. No author name, no id, no server name. | Runs the moderation model (Jev) that scores each message. | United States. See international transfers. |
| Stripe | A tenant identifier, the plan being purchased, and whatever billing details Stripe's own Checkout page collects directly from the payer. Card numbers go to Stripe and never reach the processor. | Payment processing for the Pro plan. | Processes globally under its own terms; see Stripe's privacy policy. |
| Resend | The account holder's own email address, and the content of account emails: sign-in links, receipts, quota notices. | Delivers transactional email for the dashboard account, not for anything posted in a Discord server. | United States. See international transfers. |
| Hetzner | Everything the processor stores, as the disk of the machine everything runs on. Hetzner does not read or use it. | Hosting infrastructure for the bot, the API, the dashboard and this site. | Germany, inside the EU. |
Discord itself is not a sub-processor of the processor's: Discord already holds every message in the controller's server as the platform the controller chose, before jevmod ever sees it.
Assistance with data subject rights
A member of the controller's server who wants access, correction or erasure should ask the controller first, since the controller is the data controller for their own server. The commands that deliver each right are documented on the privacy page: /mod recent for access, /mod forget_user for one member's erasure, /mod forget for the whole server. Where a request needs the processor's direct help, for example because the controller is unreachable, write to omarhernandezbastos@gmail.com and expect an answer within a month.
Deletion and return of data
On termination, whether by /mod forget or by removing the bot from the server, every table holding that server's data is deleted: settings, usage counters, decision records, API keys and the subscription row.
There is no export-and-return step: what the controller can retrieve while the agreement is live, through /mod recent or GET /v1/decisions, is the same data that would otherwise be returned, and it is available at any point before deletion, not only at the end.
Audit
The processor's core moderation code is open source, at github.com/ohernandezdev/jevmod, and every factual claim on this site links to the line of code that backs it in CLAIMS.md. That is the audit trail available today: reading the code yourself, or asking the operator a specific question, rather than a formal third-party audit report, which does not exist. A controller with a compliance requirement for a scheduled audit should treat that as a gap and say so before relying on jevmod for a regulated use.
International transfers
The judging request, the message text and the channel topic, leaves the EU to reach TypeSafe's API, which is hosted in the United States by TypeSafe's own account of its infrastructure.
Still missing. The processor does not yet have a data processing agreement or Standard Contractual Clauses signed with TypeSafe covering this transfer. Today it happens under TypeSafe's own published terms alone. If that gap matters for your organisation, run jevmod yourself with your own TypeSafe key so the transfer is between you and TypeSafe directly, or exclude the channels you care about from judging by marking their roles as trusted.
Resend, used for account email, is also a United States company; its own data processing addendum is signed automatically for every account and covers this transfer under Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Hetzner keeps everything else inside Germany, inside the EU.
Liability and precedence
Nothing in this agreement expands the liability limits in the terms of service, which govern the commercial relationship; this agreement governs the data protection relationship between the same two parties and, where the two conflict on a data protection point, this one applies.
Changes to this agreement
When this agreement changes, the date at the top changes with it, and the previous version stays in the repository history. A controller relying on a specific version should keep their own copy of it, dated.
Contact
For this agreement, for a countersigned copy, or for anything about how your server's data is processed: omarhernandezbastos@gmail.com, to Omar Hernandez.