ModFlow Privacy Policy

This Privacy Policy applies to ModFlow's Discord bot, dashboard, public appeal and request forms, moderation cases, evidence, transcripts, recordings, support communications, website interactions, security operations, and optional billing features. It applies whether information comes from a Customer, Authorized User, Affected User, Discord, a connected server, an enabled provider, or the service itself.

This Policy does not govern Discord, a Customer's independent server practices, another trusted server, or a third-party provider acting for its own purposes. Those parties may have separate notices and obligations. Links to their materials are provided for context, but their services remain outside ModFlow's control.

ModFlow is designed for authorized moderation and community-management workflows, not undisclosed general surveillance. Collection and use depend on the feature, Customer configuration, platform permissions, active storage provider, and operational stage described below.

ModFlow operates the service and can be contacted at [email protected]. ModFlow determines limited service-wide purposes such as authentication, security, support, billing, legal compliance, dispute handling, and protection of the service. For many server moderation workflows, ModFlow processes information to provide the configuration and instructions selected by a Customer.

A Customer generally determines why its server uses moderation cases, evidence, appeals, recording, external logs, analytics, trusted networks, and retention settings and who may access those features. Depending on applicable law and the specific activity, a Customer and ModFlow may be described as controllers, businesses, processors, service providers, or independent responsible parties. Those labels follow the facts and applicable law rather than a universal designation.

An Authorized User acts under a Customer's authority. An Affected User is a Discord member whose information is processed because a Customer uses ModFlow. Processing an Affected User's information does not make that person a Customer, imply agreement to the Terms, or eliminate that person's privacy rights.

Customers are responsible for selecting lawful and proportionate moderation purposes, configuring permissions and features, limiting staff access, giving server-specific notices, obtaining any required consent, responding to community members, reviewing automated outputs, correcting records they control, and making final moderation and disclosure decisions.

• Explain community rules, enabled recording or monitoring, evidence practices, trusted-network sharing, and how an Affected User can make a request.
• Use least privilege, remove former staff, protect credentials and confidential links, and review feature and retention choices periodically.
• Do not enable broad snapshots, profiling, recording, transcription, external logging, or sharing until the Customer has documented its authority, notice, and safeguards.
• Forward a request to ModFlow when the Customer cannot complete it using available controls and cooperation from ModFlow is reasonably needed.

ModFlow's Policy supplements rather than replaces the Customer's notice. A Customer should not copy this Policy as if it fully described that server's separate practices.

ModFlow may receive information from Discord APIs, OAuth and events; Customers and Authorized Users; Affected Users who submit appeals or participate in noticed workflows; Google or Microsoft accounts connected for assignment-file selection; public-web sources explicitly selected for an approved MIRA investigation; server configuration; automated service activity; mutually trusted servers; enabled service providers; imported moderation logs; support or legal correspondence; and records generated from operating, securing, and debugging the service.

Not every category is collected for every person or server. The active feature, permissions, Customer choices, provider configuration, and event determine what ModFlow receives.

ModFlow may process Discord user, guild, role, channel, message, application, and related identifiers; usernames, display names, avatars, nicknames, membership, staff status, roles, channels, permissions, and presence when an enabled workflow needs it. This information supports display, authorization, routing, moderation context, server selection, and audit.

Staff availability. When ModFlow uses Discord presence data, it uses current status only for members with configured moderation roles to help staff route an urgent moderation escalation. ModFlow does not use Presence Intent to monitor ordinary members and does not write a separate long-term history of staff presence statuses.

Dashboard sign-in may use Discord OAuth profile details and authorized guild information. Access and refresh tokens may be held in the authenticated session so ModFlow can retrieve permitted information, refresh access, and support sign-out or revocation. Session cookies or tokens identify the browser session. Provider-side records remain subject to Discord's own policy and controls.

Discord can change permissions, data availability, annual review requirements, access thresholds, API behavior, or account status. ModFlow limits collection according to the permissions and operational controls available, but a platform change may affect what can be accessed or displayed.

Moderation records may include reported conduct, allegations, actions, reasons, rules, sanctions, Jail or restriction history, Watchlist membership, heat and alerts, No Contact relationship state, notes, assignments, evidence references, Jail and appeal conversation records, staff discussion, review status, appeal submissions, delivery and routing state, outcomes, trusted-network context, and audit trails showing who did what and when.

These records are used to operate safety workflows, give authorized staff context, support consistent review, preserve evidence, process appeals, investigate misuse, resolve disputes, and maintain accountability. They may describe an allegation rather than an established fact. Customers and Authorized Users must distinguish reports, inferences, and preliminary notes from verified findings.

Staff records may also include team membership, permissions, claimed work, assignment comments, approvals, dismissals, escalation, moderator administrative notes, evaluations, ordinary activity, controlled Scorecard snapshots and review outcomes, and configuration actions. These are distinct record families with different permissions. Access is limited by the roles and controls configured for the server, but Customers remain responsible for choosing those recipients.

When an enabled moderation, conversation, logging, assignment, or evidence workflow requires it, ModFlow may process message text, excerpts, links, embeds, reactions, files, attachment metadata, author and channel details, surrounding context, and edit or delete versions. Explicit Case evidence, dashboard Jail relay, appeal DMs and internal notes, configured native Discord event logs, external moderation-log imports, assignment evidence, and scoped moderation listeners are separate from broad snapshot logging.

ModFlow does not use customer messages, attachments, or moderation records for unrelated advertising, data brokerage, or general-purpose model training.

If lawfully and operationally enabled, behavior and activity features may process message samples or excerpts, message counts, language or style signals, Watchlist heat, pattern and risk summaries, report or alert history, channel activity, voice-duration statistics, cache entries, and controlled moderator-performance dimensions, evidence, confidence, explanations, and review outcomes. These outputs are decision support and may be inaccurate, incomplete, stale, biased, or affected by missing context.

ModFlow does not authorize automatic punishment based on a behavior or Watchlist profile, does not authorize automatic staff role or assignment changes based on a Scorecard, and does not make solely automated decisions that produce legal or similarly significant effects. Missing evidence is not a zero score. Authorized staff must review relevant evidence and context and provide an appropriate correction or appeal route.

For an approved Case investigation, ModFlow may collect permission-visible Discord messages and metadata, prior Cases and actions, evidence, transcripts, recordings, Watchlist and appeal context, explicit public-web snapshots, and sanitized image derivatives. ModFlow may send a bounded structured payload to OpenAI and store source excerpts, provenance and hashes, coverage state, generated findings, briefs, citations, limitations, follow-up questions, reviewer decisions, provider and model identifiers, token use, cost, budget, and errors.

The OpenAI request is configured with store set to false, but this setting is not a promise that OpenAI keeps no abuse-monitoring, security, or legally required records. OpenAI's API data controls, enabled account settings, contractual terms, and legal obligations apply. ModFlow does not authorize submitted Customer content for general-purpose model training and does not opt in to provider model improvement without separate review, notice, and authorization.

AI outputs can hallucinate, omit context, reproduce bias, misread images, or cite incomplete, stale, permission-limited, or unavailable sources. Public-web snapshots can preserve third-party content. Affected people and Authorized Users may request appropriate access, correction, deletion, objection, restriction, or appeal, but Discord, provider, source, legal-hold, and recipient copies can require separate handling or limit the result.

When the controlled-preview Assignment workflow and a provider connection are enabled, an Authorized User may connect Google Drive or Microsoft 365 through OAuth, list files available to the granted account and scopes, and select a file to copy into assignment evidence. ModFlow may store provider account and connection metadata, encrypted access and refresh tokens, granted scopes, expiry and error state, selected-file metadata, and the imported evidence copy.

The provider connection does not bypass ModFlow assignment, Case, evidence, participant, or source permissions. The Customer must authorize only appropriate accounts and files, keep assignment recipients narrow, and disconnect or revoke the connection when no longer needed. Google and Microsoft apply their own account, administrator, API, security, retention, and legal controls.

Disconnecting or revoking a provider can stop future access after provider processing completes, but it does not retract an evidence file already copied into ModFlow or an export already received by another person. The provider original and the ModFlow copy can require separate access, correction, deletion, or retention actions.

For an authorized and appropriately noticed voice session, ModFlow may process participant identifiers, channel and session details, notice and consent events, audio from eligible speakers, speaker timelines, live captions, transcript text, confidence information, recording files, transcript artifacts, and case or session links.

When live transcription is enabled, consented speaker audio may be transmitted to Deepgram for streaming speech-to-text processing. ModFlow may then store or display returned transcript and confidence data. Deepgram processing is conditional; it is not used for every voice session, and provider availability or settings may affect results.

Customers must provide clear notice and obtain consent where required, limit recording to eligible speakers and legitimate purposes, and address withdrawal or objections as applicable. Captions and transcripts may contain errors, and a speaker timeline may not prove identity or intent. Staff must review context before relying on a recording or transcript.

Soundcheck artifacts receive a default expiry marker 30 days after creation unless configuration changes it, but an expiry marker is not an automatic deletion promise. Actual deletion requires an operated cleanup path. Case-linked recordings and core moderation records may have no automatic expiry and may remain according to the retention matrix.

The dashboard and hosting environment may process JWT or session cookies, OAuth tokens, browser and device metadata, IP addresses in hosting or security logs, route and activity records, permission checks, rate-limit keys, authentication events, errors, performance traces, and security signals. This information supports sign-in, session continuity, authorization, debugging, abuse prevention, incident response, and service reliability.

Sentry may receive configured error and performance information when monitoring is enabled. Browser replay is disabled by default, including error-triggered replay. If separately enabled after review, replay is intended to mask text, inputs, and media, but masking can be imperfect; retention follows the configured Sentry project.

Cookies and similar session mechanisms needed for authentication or security may be required for dashboard operation. Blocking them can prevent sign-in or authorized access. ModFlow does not describe these necessary mechanisms as advertising trackers.

When billing is used, ModFlow may process selected plan, subscription and payment status, billing period, guild and user metadata needed to associate the purchase, and Stripe customer, subscription, checkout, price, and webhook-event identifiers. These records support checkout, entitlement, renewal, cancellation, accounting, fraud prevention, chargebacks, support, and disputes.

Stripe collects transaction details and payment card information directly under its own terms and privacy practices. ModFlow is not intended to receive full payment card numbers or bank credentials through moderation fields, support messages, or evidence uploads. A person should use the provider's secured checkout rather than sending payment data to ModFlow.

Moderation records can contain allegations, threats, harassment, sexual content, health or disability references, political or religious statements, information about minors, location clues, or other sensitive material. The presence of such material does not mean ModFlow requested it or verified it.

Customers and Authorized Users must minimize collection, restrict access, redact irrelevant details, use confidential links carefully, and avoid submitting secrets or legally protected data beyond what a legitimate and authorized moderation workflow requires. Do not submit passwords, authentication tokens, payment card numbers, government identification documents, protected health information, or highly sensitive identifiers to ordinary case fields.

ModFlow does not authorize Discord or moderation data for employment, housing, credit, insurance, education admission, public-benefit, or protected-class decisions. Contact [email protected] if sensitive information appears to have been submitted without authority.

ModFlow processes information only for purposes connected to operating, protecting, supporting, or lawfully administering the service and the Customer's enabled community workflows.

• Provide Discord bot commands, dashboard features, authentication, permissions, configuration, staff coordination, and audit trails.
• Create and review moderation Cases, actions, evidence, appeal and Jail conversations, Watchlists, No Contact rules, assignments, configured Discord event logs, recordings, captions, transcripts, and trusted-network workflows.
• When separately enabled and authorized, connect selected Google or Microsoft assignment files and operate MIRA AI-assisted Case investigation with source minimization, provider controls, citations, and human review.
• Deliver support, communicate about the service, verify authority, handle privacy or legal requests, and resolve disputes.
• Operate optional checkout and subscription access, account for transactions, prevent fraud, and address chargebacks.
• Secure accounts and infrastructure, enforce limits, detect abuse, troubleshoot errors, measure performance, recover from incidents, and maintain backups.
• Comply with applicable law and platform obligations, respond to valid legal or safety requests, and protect users, providers, ModFlow, and third parties.
• Improve service reliability and usability using aggregated or appropriately de-identified information where suitable and permitted.

ModFlow does not authorize Customer content or audio for unrelated advertising, data brokerage, or provider model-improvement programs without separate review, notice, and authorization.

Where a law requires a legal basis, the basis depends on the activity and relationship. ModFlow may rely on performance of a contract with a Customer or Authorized User; legitimate interests in providing, securing, supporting, improving, and defending the service; compliance with legal obligations; and consent for processing that requires it. A different basis may apply where permitted by the relevant law.

Legitimate interests are considered against the nature of the information, reasonable expectations, impact, necessity, and available safeguards. Consent may be withdrawn for future consent-based processing, but withdrawal does not make earlier lawful processing unlawful and may not require deletion of information retained under another valid basis.

Each Customer is responsible for identifying and documenting its own lawful basis for moderation, evidence, recording, transcription, analytics, trusted-network disclosure, and other server-controlled processing. ModFlow's technical ability to perform a function is not a determination that a Customer may lawfully use it.

ModFlow may automate routing, permission checks, reminders, rate limits, evidence linking, event-log delivery and retries, scheduled-action claiming, transcript generation, Watchlist signals, derived summaries, or other workflow assistance. Stored Automation Rule configuration does not currently establish that a runtime evaluator exists. Automated outputs can help Authorized Users prioritize review but can be incomplete, stale, biased, or wrong.

ModFlow does not make solely automated decisions that produce legal or similarly significant effects for an Affected User, does not authorize automatic punishment based on behavior or Watchlist profile scores, and does not authorize automatic staff role or assignment changes based on a Scorecard. MIRA cannot execute moderation. Customers and Authorized Users must retain meaningful human review, inspect sources, consider relevant context, permit appropriate correction or appeal, and remain responsible for final decisions.

ModFlow may disclose information only as reasonably connected to an enabled service purpose, a person's direction, protection of the service or others, or an applicable legal requirement.

• To the relevant Customer and Authorized Users according to configured roles, Discord log channels, Jail participants, Case access, Watchlist or Ban Review destinations, assignment participation, dashboard permissions, and staff workflows.
• To a mutually trusted server when both administrators opt in and the configured network workflow authorizes the particular disclosure.
• To providers that host, store, transmit, transcribe, monitor, secure, support, bill, provide a selected cloud file, or generate an approved AI-assisted Case response, subject to the active feature and provider arrangement.
• To a recipient chosen by a user or Authorized User, including an appellant receiving a Discord DM, a Jail-channel participant, an assignment reviewer, or a recipient of an export, confidential link, or requested support communication.
• To authorities, platforms, providers, affected parties, or advisers when reasonably necessary to comply with valid process, address an emergency, investigate abuse, protect rights or safety, or establish, exercise, or defend legal claims.
• In connection with a proposed or completed reorganization, financing, transfer, acquisition, or succession involving the service, subject to appropriate confidentiality and applicable notice duties.

ModFlow reviews requests according to available information, applicable law, platform duties, urgency, and the rights of others. A request is not automatically valid merely because it claims official authority.

Customers may mutually opt their Discord servers into a trusted network. An enabled workflow may disclose a member's Discord identifier and a newly prepared, redacted summary of relevant moderation context to authorized staff in the participating server when the same member or safety issue is relevant. Raw staff notes, raw evidence, attachments, transcripts, internal discussion, and private Discord message or channel references are not shared through this workflow.

The sending and receiving Customers are separately responsible for their purpose, lawful basis, notice, access control, accuracy, proportionality, retention, decisions, and response to rights requests. Trusted-network information must not be used for public shaming, retaliation, discrimination, unrelated profiling, or an undisclosed eligibility system.

Revoking trust is intended to stop future network disclosure but cannot automatically retract information already lawfully received, copied into a case, exported, backed up, or retained independently by the recipient. A person seeking correction or deletion may need to contact both the originating and receiving Customers as well as ModFlow.

Providers vary by deployment, configuration, and feature. Listing a provider does not mean it receives every category or is enabled for every server.

Provider-side processing is also governed by the provider's own documentation, account settings, and legal obligations. ModFlow evaluates enabled uses but does not claim that every provider account has identical settings or retention.

ModFlow does not sell personal information, provide it to data brokers, use advertising networks, engage in cross-context behavioral advertising, or use moderation records for unrelated marketing. ModFlow does not offer a financial incentive in exchange for personal information.

Some laws define sharing broadly for targeted advertising. ModFlow's functional disclosure to a mutually trusted server is designed for an administrator-enabled moderation purpose, not advertising, but the sending and receiving Customers must evaluate their own obligations and cannot relabel an advertising or unrelated disclosure as a trusted-network function.

ModFlow does not authorize Deepgram, another provider, or any recipient to use customer audio, messages, evidence, or other content for a model-improvement program or unrelated model training without a separate review, clear notice, and required authorization. Describing a provider program in reference materials does not mean ModFlow participates in it.

Retention depends on the data category, Customer configuration, case status, evidence references, safety and dispute needs, provider settings, legal obligations, technical feasibility, and whether a verified deletion or lifecycle process applies. The following statements describe public defaults and operational targets; they do not promise that every category shares one deadline or that an expiry marker deletes data by itself.

ModFlow may preserve information beyond an ordinary target when reasonably necessary for a legal hold, safety matter, security incident, dispute, accounting duty, platform requirement, prevention of abuse, or protection of rights. When the reason ends, the record returns to the applicable lifecycle.

Deleting active data does not always remove copies immediately from safely isolated backups, provider systems, exports, or records held by a Customer, trusted server, or authorized recipient. Backup deletion depends on rotation and restore integrity. Removing ModFlow from a server or deleting a Discord message does not by itself purge all separate copies.

ModFlow uses measures appropriate to the service's current operation, including role and permission checks, least-privilege configuration, secret handling, authenticated sessions, encrypted transport where supported, provider and storage access controls, rate limits, audit records, monitoring, and backup or recovery practices.

Security is shared. Customers and Authorized Users must protect Discord accounts, sessions, devices, bot and provider secrets, confidential links, roles, channels, exports, and local copies. They must remove unnecessary access and report suspected compromise promptly.

No system, transmission, provider, or storage method is perfectly secure, and ModFlow cannot guarantee that unauthorized access, loss, misuse, or failure will never occur. This Policy does not claim a security certification, universal encryption of every stored field, or controls that have not been verified. Reports may be sent to [email protected] without including exploit secrets or unrelated personal data.

ModFlow may be operated or hosted in the United States, and Discord or other enabled providers may process information in the United States and other locations where they or their subprocessors operate. Those locations may have privacy rules different from the person's home jurisdiction.

Where transfer safeguards are legally required, the responsible party may rely on applicable contractual terms, adequacy decisions, statutory exceptions, or another valid mechanism. Discord's contractual transfer terms and each enabled provider's arrangements may apply to provider-side processing. A person may contact [email protected] for available information about safeguards relevant to ModFlow's processing.

A Customer that independently exports, shares, or makes information available to staff or trusted servers in another location is responsible for evaluating its own transfer obligations.

Depending on applicable law and the processing context, a person may have rights to know or access information, correct inaccurate information, request deletion, restrict processing, object, receive portable data, withdraw consent, opt out of covered processing, avoid unlawful discrimination, and appeal a denied request. Some rights apply only in specified jurisdictions or circumstances and may be limited by safety, the rights of others, legal duties, disputes, security, or verified exemptions.

1. Contact the relevant Discord server operator first for server rules, moderation decisions, notices, and records that the Customer controls.
2. Identify whether the request concerns a Discord copy, a ModFlow Case or conversation, an imported Google or Microsoft file, a MIRA source or generated finding, a staff evaluation or Scorecard, an export, or a provider-held copy. Correction, deletion, objection, revocation, or access may require separate action by the Customer, ModFlow, Discord, or the enabled provider.
3. For ModFlow's processing or help that requires service access, email [email protected] and identify the Discord user and server, the request, relevant dates or case, and the preferred response method without sending passwords or tokens.
4. ModFlow or the Customer may request reasonable information to verify identity, server relationship, authority, and the scope of the request. Verification data is used for the request and retained as described in the retention matrix.
5. An authorized agent may submit a request when permitted, but proof of authority and direct identity confirmation may be required. A parent or guardian request is evaluated under applicable law and the child's circumstances.
6. If a request is denied or limited, the response will explain the reason and available appeal route when required. An appeal may be sent to the same contact with additional context.

ModFlow will not retaliate or unlawfully discriminate for exercising a privacy right. Ordinary feature differences caused by deleting data, revoking access, withdrawing consent, or ending a paid service are not a penalty when they are reasonably necessary consequences of the request.

For people in the European Economic Area, United Kingdom, or Switzerland, the controller or processor role depends on the activity. A Customer generally controls its community moderation purposes and decisions. ModFlow may act on that Customer's instructions for configured workflows and may act as a controller for service-wide authentication, security, support, billing, legal compliance, and protection purposes.

Applicable legal bases may include contract, legitimate interests, legal obligations, and consent. Rights may include access, correction, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. A person may also complain to the competent supervisory authority, including in the person's place of residence, work, or alleged infringement, without first completing ModFlow's process.

International transfers use applicable safeguards where required. Contact [email protected] to ask about a request, objection, role, legal basis, or available transfer information. A Customer remains responsible for requests and notices tied to its own moderation decisions.

Where an applicable U.S. state privacy law covers the activity, this Policy serves as notice at collection for the categories described in the data inventory, the sources identified above, the service, moderation, security, billing, legal, and improvement purposes, and the recipients described in the disclosure and provider sections.

ModFlow does not sell personal information or use it for targeted or cross-context behavioral advertising. ModFlow may disclose information for business purposes to Customers and Authorized Users, enabled providers, mutually trusted servers, user-directed recipients, and legal or safety recipients. A functional trusted-server disclosure is not intended as advertising sharing, and Customers may not use it to evade applicable opt-out duties.

Depending on the state and context, rights may include access or confirmation, correction, deletion, portability, opt-out, limitation of certain sensitive-data processing, non-discrimination, and appeal. Authorized-agent requests may require proof of authority and identity verification. Send requests or appeals to [email protected] or the relevant Customer. These rights apply only where the law covers the person, data, and responsible party.

ModFlow is not directed to children under 13 or to anyone below Discord's or applicable local minimum age. Customers must follow Discord's age rules and applicable child-privacy duties and must not deliberately use ModFlow to solicit unnecessary personal information from a child.

Because ModFlow operates in Customer-managed Discord servers, server membership or a moderation event may expose information about a minor despite the service not being directed to children. ModFlow does not claim that this can never occur.

If ModFlow learns that information was collected from a child in circumstances requiring parental authorization or deletion and no valid basis applies, ModFlow will investigate and take appropriate steps, which may include limiting access, coordinating with the Customer, or deleting eligible information. A parent, guardian, Customer, or affected person may contact [email protected] with enough detail to locate the record.

A person may use Discord's account, privacy, blocking, server, channel, role, permission, and application controls where available. An Affected User may leave a server or contact its owner or administrators. A Customer may remove ModFlow, revoke bot permissions, disable an optional feature, end a trusted relationship, or cancel applicable billing.

Those actions can reduce future processing but do not necessarily delete a case, sanction, appeal, audit history, referenced evidence, case-linked recording, transcript, external log, backup, legal hold, billing record, or copy already received by another responsible party. Discord account deletion or message deletion likewise may not erase separate lawfully retained records.

For a server-specific moderation decision or notice, contact that server's operator. For ModFlow's processing or technical assistance with an eligible request, contact [email protected].

ModFlow may update this Policy when service features, providers, data practices, security controls, law, platform rules, or operations change. The last-updated date will identify the current revision.

Where practicable and required, material changes will be announced through the website, dashboard, Discord, email, documentation, or another reasonable channel. Before beginning materially different processing that requires additional notice or consent, ModFlow will provide prospective notice and seek required authorization rather than relying solely on a silent policy update.

Contact ModFlow at [email protected] for questions about this Policy, privacy or data-rights requests, security reports, complaints, or help identifying the appropriate server operator. Do not include passwords, tokens, full payment card details, or unrelated sensitive evidence in the initial email.

A person may also contact the relevant Customer for server-controlled moderation records and decisions, Discord for its platform processing, an enabled provider for provider-controlled processing, or a competent privacy, consumer-protection, or other regulator where applicable. Using ModFlow's contact process does not remove a right to complain to an authority or pursue another non-waivable remedy.