Privacy Policy

1. Who we are

TIXY is operated by an individual business registered in Lithuania under Individuali veikla, certificate No. 1359444 ("we", "our", "us"). We provide a Discord bot and web dashboard that helps server owners manage support tickets using AI.

This policy explains what personal data we collect, why, and what rights you have. It applies to all users of tixybot.com and the TIXY Discord bot.

2. Data we collect

Discord account data. When you sign in via Discord OAuth, we store your Discord user ID and username to identify your account.

Server and ticket data. When you install TIXY in a Discord server, we receive that server's ID, the channel IDs you configure, and the content of messages in ticket threads you have enabled. We do not read messages in channels you have not configured.

Knowledge base content. Documents, Q&A pairs, and URLs you upload or index are stored and used solely to generate responses within your server.

Usage and analytics data. We collect aggregate metrics (ticket counts, response times, token usage) to provide your dashboard analytics. We also use Google Analytics on tixybot.com to understand page-level traffic. Google Analytics sets cookies and may transfer data to the USA under Google's Standard Contractual Clauses.

Billing data. Payments are processed by Stripe. We do not store card numbers. We receive subscription status, plan tier, and invoice confirmations.

3. Our role as controller and processor

For account data, billing data, and website analytics, TIXY acts as a data controller — we determine the purpose and means of processing.

For content processed within your Discord server (ticket messages, knowledge base entries, and other content submitted by you or your server members), TIXY acts as a data processor on your behalf. As the server owner, you are the data controller for that content. Our Data Processing Agreement (DPA) governs that processing and forms part of your agreement with us. EU/EEA server owners are deemed to have accepted the DPA on account creation.

4. Legal basis for processing (EU/EEA users)

If you are located in the EU or EEA, we process your personal data on the following legal bases under the GDPR:

• Contract performance — processing your account data, server data, and billing information to deliver the service you subscribed to
• Legitimate interests — aggregate analytics, security monitoring, and fraud prevention
• Consent — Google Analytics cookies on the marketing website (you may withdraw consent at any time)
• Legal obligation — retaining billing records as required by Lithuanian tax law

5. How we use your data

• To operate the bot and generate AI replies in your server
• To provide the dashboard, per-server configuration, and analytics
• To process subscription payments and enforce plan limits
• To send transactional emails (receipts, service alerts)
• To analyse website traffic via Google Analytics

We do not sell your data. We do not use your ticket conversations or knowledge base to train shared AI models.

6. Cookies

The tixybot.com website uses the following cookies:

• Session cookie — strictly necessary, keeps you signed in to the dashboard
• Google Analytics (_ga, _gid) — analytics, set only with your consent

You can withdraw consent for analytics cookies at any time by clearing your cookies or using your browser's opt-out settings. The service continues to function without analytics cookies.

7. Sub-processors and international transfers

We share data with the following sub-processors. Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses or adequacy decisions.

• Stripe (USA) — payment processing
• OpenRouter / OpenAI-compatible models (USA) — AI response generation; your data is not used to train third-party models under our agreement
• Railway (USA) — API server hosting
• Neon (USA) — PostgreSQL database hosting
• Cloudflare (USA) — CDN, file storage (R2), and email routing
• Google Analytics (USA) — website analytics

8. Data retention

Ticket logs are retained for the period defined by your plan: 90 days (Starter), 6 months (Pro), 1 year (Growth). You can delete your knowledge base entries and ticket history at any time from the dashboard.

When you cancel your subscription or remove TIXY from a server, we delete that server's data within 30 days. Account data tied to billing is kept for the period required by applicable Lithuanian accounting law, after which it is deleted.

9. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Discord bot tokens are encrypted before storage. Access to production systems requires multi-factor authentication and is restricted to authorised personnel.

10. Your rights

EU/EEA users (GDPR). You have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing based on legitimate interests. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or your local supervisory authority.

California users (CCPA/CPRA). You have the right to know what personal information we collect and how it is used, to delete your personal information, and to correct inaccurate information. We do not sell personal information. Our use of Google Analytics (configured for measurement only, with ad personalisation disabled) may constitute "sharing" under the CPRA — see Section 6 for how to opt out of analytics cookies. To submit a "Do Not Sell or Share My Personal Information" request, email privacy@tixybot.com.

To exercise any of these rights, email privacy@tixybot.com. We will respond within 30 days (GDPR) or 45 days (CCPA).

11. Changes to this policy

We may update this policy. For material changes, we will notify you via the dashboard or email at least 14 days before the change takes effect. The updated date at the top of this page always reflects the latest revision.

12. Contact

Privacy questions: privacy@tixybot.com
General: hello@tixybot.com