Privacy Policy

1. Controller and scope

The controller for Botkeep account, website, commercial, support and security processing is TRAMA BENEVENTO SRL, registered at Piazza Maria Montessori 11, 80011 Acerra (NA), Italy. Contact: [email protected]; PEC: [email protected].

This notice covers botkeep.cloud, the account and dashboard, Free and Founder Free, Partner and custom allocations, paid plans, source imports, hosted applications, databases and websites, domains, backups, collaboration, support and abuse channels. External services apply their own privacy information. This notice explains processing; accepting the Terms or a Partner plan is not blanket consent to unrelated processing or marketing.

No Data Protection Officer contact is published because no appointment has been confirmed for Botkeep. If a DPO is appointed or becomes legally required, this notice will be updated before that contact is used.

2. Accounts, localisation and administrative access

The panel stores accounts, password hashes, session records, workspace configuration and hosting metadata on the API server. Passwords are not stored in plaintext. GitHub and Discord sign-in operate after the user deliberately starts authorisation. Botkeep receives the profile and verified email information necessary for sign-in, not the provider password. Social sign-in does not grant repository, message or community-management access. Email verification is required before provisioning.

On the root homepage, in both main and coming-soon mode, the browser asks GeoJS for a two-letter country code only when no manual language preference is present. GeoJS necessarily receives the request IP. In main-site mode, detection of Italy opens /it/ automatically; if the lookup fails, a supported browser language is used as fallback. Other detected languages and coming-soon mode use optional suggestions. The Italian main page offers a return to original English. A manual choice is stored locally, takes priority on the main root and prevents later lookups. Explicit localised URLs are always respected. Botkeep does not persist the IP, country code or automatic result of this language lookup.

The main-site panel and its login/registration also request only a country code from GeoJS when no separate panel language preference exists. The panel uses Italian only for country code IT and English for all other countries or lookup failures. A manual English/Italian choice in Account is saved as botkeep_panel_locale and prevents later panel lookups. The request omits credentials and referrer, contains no account or workspace content, and times out after 2.5 seconds. Only the manual preference is persisted; the automatic language is held in memory for the page lifetime. No browser location permission is requested.

Web and infrastructure systems receive the connection information necessary to deliver, diagnose and protect the service. Hosting a publicly accessible website makes the content you publish available to its visitors; this does not make your account records, private files or billing details public.

The staff area reads real account and plan records through the API, subject to server-side role permissions. Staff sign-in requires a password and a time-based authenticator code. Authenticator secrets are encrypted on the API server. Staff sessions expire after 30 minutes; administrative changes are recorded in the server-side audit log. No fictional clients or accounting documents are seeded.

Authorised staff can access a customer panel for support after providing a reason and a fresh authenticator code. This access is visible, audited, limited to ten minutes and dependent on the staff session and permissions. It does not disclose the customer’s login credentials. Suspended accounts retain restricted authentication solely to see their suspension reason and submit or follow their own appeal tickets; internal staff notes are not shared with the customer.

Account security monitoring compares keyed pseudonymous identifiers derived from connection IPs, a signed first-party browser cookie, verified account emails and linked provider identities. Consumer Gmail aliases may be normalised for comparison. Registration timing is used only alongside other signals. These observations help authorised staff investigate duplicate free-tier accounts and possible suspension evasion. They are not shared with NexNode or an external reputation provider. No hardware, canvas, audio or cross-site fingerprint is collected. A shared network or browser is not proof of common ownership. When expressly enabled by staff, configurable registration rules compare a selected minimum number of matching signal types against existing non-exempt accounts observed within a window of up to 30 days and may refuse an additional registration. Unverified email input is not treated as verified evidence. Existing sign-ins are not refused by this rule. Applicants can request human review at [email protected]. Support impersonation is excluded.

Staff may assign a blocking account-review notice, individually or in a confirmed batch. The restricted panel remains available for a review ticket, verification of both account email addresses, selection of the account to keep, sign-out and privacy information. A notice alone does not stop running servers or delete files. No other account identity is disclosed to the customer before ownership is verified. Automatic deletion requires control of both mailboxes, a fresh short-lived verification request, explicit permanent-deletion confirmation and a safe dependency check. Accounts with services, pending operations or financial records require staff review; no files, purchases or plan rights are silently transferred. Exceptions and restrictions can be reviewed or removed by authorised staff.

For internal account-country statistics, a separate local database on the Botkeep API server estimates a two-letter country from the connection IP at successful registration. Existing accounts without an estimate are measured in the background when they open the panel with an authenticated customer session, without requiring a new sign-in. This is labelled as a later panel observation, not a reconstructed registration location. Previously collected first-sign-in estimates keep their original provenance. The local country lookup saves only the first available country code, observation time, source and database version; it does not retain the lookup IP or send it to DB-IP. It does not add a cookie, browser location permission or continuous location history. Support impersonation and staff accounts are excluded; an accepted objection prevents collection. VPNs, proxies and database inaccuracies may affect the estimate: it is not nationality, residence or billing country, and does not decide prices, taxes, access or moderation. Staff reports require permissions; account-level details also require customer/user access permissions.

To assess the uncertainty of these statistics, Botkeep separately checks the connection IP through ipapi.is in the background after an authenticated customer opens the panel. For an authorised, bounded recovery of missing observations, Botkeep may instead use a registration IP already present in operational logs, only when existing keyed security signals and registration times establish an unambiguous association with that account. Ambiguous or unavailable addresses remain unverified; no new raw-IP archive or continuous location tracking is created. Only the temporary lookup IP is sent to the fixed German API endpoint over HTTPS, not an account identifier, email, username or hosting content. A successful check stores an encrypted, one-shot observation with the country estimated locally from the same IP, observation time, source, database version and category: VPN/proxy detected, Tor, or no detection. A recovered registration observation separately records the later network-check time: the current classification does not prove how that IP was classified at registration. Errors, unavailable results and quota exhaustion remain unverified. An unrelated later IP is never used to classify an earlier country estimate. The observation is not the user’s current connection, cannot identify their real country behind a VPN and does not create a continuous location history. No detection does not guarantee absence of a VPN. This check does not block login, change prices or taxes, or make automatic moderation decisions. An accepted objection prevents both ordinary collection and recovery and removes the live observation.

3. Categories of personal data

• Technical data: IP address, date and time, requested resource, response status, user-agent, request or security identifiers and diagnostic events generated by web and infrastructure protocols.
• Account data: display name, email, account identifier, authentication method, linked provider identifier, session state, verification, accepted legal versions and security events.
• Provider data: Discord or GitHub identifiers, profile information, authorisations and repository metadata only when the user deliberately connects that provider.
• Optional GitHub source integration: the Botkeep GitHub App requests read-only code and metadata access to repositories selected on GitHub. Botkeep stores the GitHub account identifier and encrypted access/refresh tokens on the API server, separately from sign-in. Requested source files are copied to the assigned hosting server; these tokens are not sent to the browser or hosting container.
• Service data: server and project names, runtime, branch, startup command, configuration, deployment operations, allocations, usage, logs, files, source archives, database records and query results, backup metadata and contents, monitoring targets and related request data.
• Domain and access data: canonical addresses, aliases, custom domains, DNS verification, certificate status, network allocations, SFTP credentials or keys where used, collaborator emails, invitations, roles, permissions and administrative actions. Public certificate-transparency logs can include domains for which a certificate is issued.
• Secrets: submitted credentials and environment variables, encrypted in the API database and delivered to the assigned runtime. Saved fields are masked where supported; runtime files and database credentials remain accessible to the application and people with the necessary permissions.
• Communications: support requests, privacy requests, abuse notices, appeals and other information voluntarily sent to official contacts.
• Commercial data: plan and version, order and expiry, billing name, email, address, country, tax identifiers, invoice request, consent to the order and immediate activation, transaction references, amounts, taxes, refunds and disputes. The selected payment provider hosts payment-method entry; Botkeep does not receive or store complete card numbers or security codes. Order and receipt records retain the billing information needed for reconciliation. For local VAT calculations, Botkeep records the rules version, rate, treatment and supporting billing country, current connection-country estimate and verification date; the connection IP is looked up locally and is not retained in the tax record. This tax-compliance evidence is distinct from optional account-country statistics and is not a claim about nationality or exact location.
• Plan and promotional data: current and historical allocations, Founder eligibility and badge, Partner or custom-plan terms and expiry, code redemptions and staff-assigned credit adjustments. Codes and personal API keys are stored as hashes, not recoverable plaintext; key metadata includes name, creation, expiry, revocation, explicit permissions and selected server/project access. New personal API keys can read or change authorised customer resources according to those permissions and the account's current rights; existing read-only keys do not gain write access. Keys do not grant staff access, payment actions, infrastructure credentials or access to saved secret values. Promotional credits have no cash conversion and no automated purchasing flow.
• Developer API operation receipts contain the key/account identifier, a fingerprint of the request, time, status and a minimal operation acknowledgement for safe retries. They do not retain request bodies, uploaded files, secret values or full responses. Administrative audit entries record the operation path template and outcome, not submitted values or query parameters. In-memory request-limit counters are not written to the account database.
• Partner enquiries and agreements: contact details, project or community links, information supplied for evaluation, agreed activity or visibility commitments, allocation decisions, review communications and any authorised public name or logo. Do not submit member lists or sensitive personal data that are not needed to assess the project.
• Invitations are optional. A verified customer may create an invitation link; another verified customer must explicitly accept it to establish the account association. The inviter sees only an aggregate acceptance count, not invitees’ names, emails or activity. No advertising tracker, referral cookie or automatic reward is used. Account-linked promotional credit entries and invitation links are removed during completed account erasure; redeemed-code usage totals and pseudonymous staff audit identifiers are retained for abuse prevention and operational accountability.
• Device storage: the session cookies and language/notice preferences listed in the Cookie Policy. Workspace data is stored on the API server, not in a browser demo dataset.
• Approximate localisation data: a two-letter country code returned by GeoJS from the request IP when the root homepage or the panel has no respective saved language choice. It localises the main homepage or suggests a public language; in the panel it selects Italian for Italy and English elsewhere.
• Account-country statistics: the first available IP-based country estimate from registration or a later authenticated panel opening for an existing account, with observation time and provenance. Earlier sign-in observations retain that source. Unknown results remain unknown; billing data and language are not substituted.
• Network observation for country statistics: an encrypted record of the first successful IP-based VPN/proxy/Tor check, paired with the locally estimated country, observation time and provenance. The temporary lookup IP and full provider response are not stored with the account.

4. Sources of data

• Directly from the user during registration, configuration, upload, support or reporting.
• From Discord or GitHub after the user starts and authorises an integration.
• From web, network, hosting and security systems during delivery and protection of the Service.
• From an organisation or administrator that lawfully invites or authorises a user to manage a shared resource.

5. Purposes and legal bases

Where Botkeep relies on legitimate interests, it considers necessity, reasonable expectations and impact on individuals and applies proportionate safeguards. You may object on grounds relating to your particular situation. Consent may be withdrawn at any time without affecting earlier lawful processing.

Operational and security messages are not marketing consent. Any optional promotional communications require a separately valid basis and an accessible opt-out; joining a free or Partner plan does not subscribe you to unrelated marketing. Hosted customer data is processed under the customer’s instructions and applicable processor agreement, not reused for Botkeep advertising or unrelated model training.

6. Required and optional information

Data marked as required are necessary to create or secure an account, provide a requested feature, investigate a valid report or comply with law. Without them, Botkeep may be unable to provide that function. Social sign-in, repository access, invitations, Partner applications and custom domains are optional. A feature may require the specific data needed to deliver it, but Free and Founder Free do not require a payment card or Discord connection.

7. Controller and processor roles

Botkeep is controller for its own account, billing, security, support, abuse-prevention and service-management purposes. A customer is normally controller for personal data that its workload independently collects or stores. For that customer data, Botkeep acts as processor only to the extent it handles the data on documented customer instructions to supply hosting.

Customers must provide their own notices and identify a lawful basis for data collected by their workloads. The Data Processing Addendum governs Botkeep’s processor role and does not make Botkeep controller for the customer’s workload logic or purposes.

8. Recipients and authorised access

Data may be accessed by authorised personnel and by providers supplying hosting, infrastructure, authentication, repository integration, communications, security, payment or professional services, limited to the relevant purpose and governed by appropriate agreements. Public authorities or rights holders receive data only where disclosure is legally required or another valid legal basis exists.

For a security review manually requested by authorised staff, Groq processes bounded source excerpts solely to provide an advisory analysis of possible prohibited application capabilities. Botkeep relies on its legitimate interests in protecting the service and other users, with restricted permissions, a recorded reason and human review. The collector accepts at most 8 supported files, 16 KiB per file and 64 KiB total; no more than 18,000 source characters are selected for the model. Hidden files, known secret files, symlinks, binaries and dependency directories are excluded. Best-effort redaction removes recognised credentials and direct identifiers, but arbitrary secrets or personal data embedded in code may not be recognised. Account email, billing details, environment files and complete server archives are not deliberately sent. Groq Global Zero Data Retention is enabled for this integration; batch and fine-tuning storage are disabled, while provider usage metadata is retained separately. Processing is not guaranteed to remain in the EEA: Groq is governed by its Services Agreement and incorporated Data Processing Addendum, including applicable transfer safeguards. Restricted reports contain file hashes and selected evidence excerpts, encrypted at rest in the API database, and expire from the live review records after 7 days; minimal idempotency receipts remain, and audit records or backups follow their separate retention. A report is not an automated sanction or a whole-server safety certificate. Data rights and objections may be raised through the contacts in this notice.

The panel communicates with the Botkeep API and assigned hosting infrastructure, managed through Pterodactyl/Wings. OVH Object Storage is used for hosting backups. Resend delivers transactional verification and password-reset messages and receives the recipient address and message contents; open and click tracking are disabled. GitHub and Discord receive the authorisations you initiate; GitHub source access is separate from sign-in. GeoJS provides country-code localisation and uses delivery infrastructure including Cloudflare. No advertising or audience-analytics provider is enabled.

DB-IP Lite supplies the downloadable IP-to-country database used locally for internal account-country statistics. DB-IP does not receive customer lookup IPs, account identifiers or report results from this feature. This processing is separate from the browser language lookup described above.

ipapi.is (Nikolai Tschacher, Germany) processes the temporary lookup IP under its Data Processing Agreement for the network observation above. Botkeep uses only its fixed Germany endpoint, with no fallback outside the EEA; the provider identifies Hetzner Online GmbH as its API-hosting subprocessor. Under the provider’s DPA, queried IPs are processed transiently, not retained in query logs or persistent query storage. Provider account and usage metadata are handled separately under its privacy notice. Botkeep does not send customer names, emails, account identifiers or application data to this provider, or publish the resulting account-level reports.

When registration protection is enabled, Cloudflare Turnstile checks technical browser and connection signals, including IP address, User-Agent, TLS fingerprint and website origin, to reduce automated account creation. It is loaded on registration, not existing-account sign-in. Botkeep validates a short-lived, single-use token server-side without sending names, email addresses, passwords or hosting content to Cloudflare, and does not retain the raw verification token. Botkeep relies on proportionate legitimate interests in preventing registration abuse; alternative support is available if verification fails. Cloudflare acts as a processor to secure the website and separately as a controller to improve its bot detection, under its Turnstile Privacy Addendum. This is not an email-ownership check, a guarantee of human identity or an automatic account-ban decision. The international-transfer safeguards described below apply; processing is not asserted to remain exclusively in the EEA.

Stripe processes payment, tax, payment-method and fraud/compliance information when you purchase. Botkeep receives the transaction result, references and billing information needed for the order, non-fiscal receipt, accounting and requested invoice. The merchant account belongs to the Operator and is also used for its other services; Botkeep order references remain distinct. Payment providers may act as independent controllers for their own legal and security duties.

When you choose an available Mollie checkout, Mollie receives the payment amount, service description, order reference and billing name, email and address needed to process that one-off payment. Botkeep receives payment, refund and dispute status and references for reconciliation. The local VAT calculation does not call paid Stripe Tax APIs for Mollie or PayPal payments. For cross-border EU business quotes, the official European Commission VIES service receives the customer VAT number and company name/address and the merchant VAT number solely to validate the requested tax treatment. Botkeep retains the validation result, date, available reference and identity-match outcome with the order, not the complete registry response. VIES unavailability is not treated as a valid VAT number or zero tax.

When you choose an available PayPal checkout, Botkeep sends PayPal the service description, order reference and fixed net, tax and total amounts. Payment-account and funding details are entered directly with PayPal. Botkeep receives authenticated order, capture, refund and dispute results and transaction references for reconciliation, without storing complete payment-card details. PayPal processes payment and security information under its own privacy statement. Botkeep remains the seller responsible for tax compliance; selecting PayPal does not extend the countries or tax treatments supported by the local VAT engine.

When you choose an available NOWPayments crypto checkout, Botkeep sends NOWPayments only the order reference, service description, EUR total and callback/return URLs, not your billing name, email or street address. NOWPayments receives payment and technical information directly on its hosted page, and may request checks under its own compliance rules. Botkeep retains provider invoice/payment references, coin/network codes, payment and settlement amounts and verified status for reconciliation, together with its own local tax evidence. Wallet interaction takes place outside Botkeep; Botkeep does not collect seed phrases or private keys. Public blockchain transactions are not necessarily anonymous and may be linkable to other information. NOWPayments processes data under its own privacy policy; adding this provider does not establish that all processing stays in the EEA or that Botkeep fiscal duties are discharged.

Collaborators receive only the information exposed by the permissions you grant. Authorised staff may access relevant configuration, logs, files or data for support, maintenance, migration, incident investigation, abuse handling and legal duties, not for unrelated browsing. Botkeep does not sell personal data or disclose it for behavioural advertising. A common operator does not authorise sharing Botkeep security-correlation records with NexNode.

9. International transfers

Hosting, communications, payment, authentication and localisation providers may process data outside the European Economic Area, including through support or subprocessors. An EU sending or storage region alone does not establish that all processing stays in the EEA. Transfers require a valid Chapter V GDPR basis: an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses, with an assessment and supplementary measures where required. A provider is not assumed to be covered by an adequacy framework merely because it is based in a particular country.

Opening an external link or deliberately authorising Discord or GitHub may cause the external provider to process data under its own notice and transfer framework.

The ipapi.is network check is restricted to the German endpoint described in its DPA. Botkeep does not use the provider’s global endpoint or automatically fail over to a non-EEA endpoint for this feature.

You may request the recipients, processing locations and applicable safeguards, including a copy or explanation of the relevant safeguards, at [email protected]. The linked DPA identifies the status of the production subprocessor schedule; this notice does not certify unverified provider agreements or transfer arrangements.

10. Retention

Expiry of a login or invitation is not the same as deletion of every audit or backup record. A deletion request is assessed across account records, hosting volumes, backups and third-party systems. Where limited records must be retained for law or a specific claim, their use is restricted to that purpose. Botkeep must not keep personal data indefinitely merely because a general deletion schedule has not yet been completed.

11. Security and breach response

Implemented controls include HTTPS, password hashing, server-side sessions and permissions, staff authenticator checks, encrypted stored secrets and audit records. Not all account metadata or complete databases are encrypted by the application, and authorised runtime or infrastructure access may expose runtime data. No system is risk-free; security measures must remain appropriate to the actual risk. A policy or test result is not a guarantee against every breach.

A personal-data breach will be documented and assessed. Where required, the controller will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it; high-risk breaches will also be communicated to affected individuals unless a lawful exception applies. A processor will notify the relevant controller without undue delay.

12. Automated decisions and profiling

Botkeep does not perform advertising profiling. Automated checks enforce authentication, resource budgets, plan expiry and payment confirmation, and flag possible abuse. Optional duplicate-registration refusal uses the configurable local matching rules described above; it does not establish common ownership and can be contested through human review. Existing-account notices and suspensions require an explicit authorised staff action, not an automatic risk score. Customer-requested deletion after dual ownership verification is a separate, explicitly confirmed process. Partner selection and revocation are not based solely on an automated score.

If a check or restriction appears incorrect, contact support or [email protected] for review and provide your account or order reference, not a password. Any solely automated decision with legal or similarly significant effects requires the applicable Article 22 conditions, information and safeguards; these Terms do not waive the right to contest it or request human intervention where applicable.

13. Children

Botkeep is not directed to children. Account use by a minor requires the involvement described in the Terms and must respect applicable age rules. If personal data were collected from a child without a valid basis, contact the Operator so the circumstances can be investigated and appropriate action taken.

14. Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability and information about recipients; object to processing based on legitimate interests; withdraw consent; and lodge a complaint with the Garante per la protezione dei dati personali. You also have the right not to be subject to a qualifying solely automated decision.

Send requests to [email protected] or [email protected]. Botkeep may request only the information reasonably necessary to verify identity and protect account data. Requests are normally answered within one month, subject to the GDPR rules on extensions and manifestly unfounded or excessive requests.

15. Updates and complaint

This notice will be updated before a material new processing activity, provider or transfer begins. Earlier versions and the effective date should be retained for accountability. A complaint may be lodged with the Garante per la protezione dei dati personali or another competent supervisory authority, without prejudice to other remedies.

16. Partner visibility and public project information

Partner evaluation can use project information you submit and relevant public project pages. Botkeep records the source where needed and limits assessment to the proposed collaboration; applying does not authorise collection of unrelated private community information.

A public Partner name, logo, link, testimonial or announcement is used only within the agreed collaboration and on an appropriate legal basis. Private contact, member, billing or support information is not made public merely because the project has Partner status. If consent is the basis for a particular use, it can be withdrawn without affecting earlier lawful processing. Contact the Operator to correct a listing or discuss removal at the end of the collaboration.