Privacy Policy

This Privacy Policy describes how Scalar Studio ("we", "us", "our") — the data controller — collects, uses, and protects your information when you use the Taverna Discord bot and the tavernadm.com website (collectively, the "Service"). You can reach us about anything in this policy at [email protected].

1. Information we collect

From Discord

• Discord user ID, username, and avatar — used to identify you in the game, link your characters and worlds, and determine your plan entitlements. If you sign in on the website with Discord, we also receive the email address on your Discord account.

Game content you create

• Gameplay messages and prompts — the actions and messages you send to the bot, plus characters, worlds, quests, and other in-game content you create. Note that gameplay is shared: other players in your channel see this content too.
• Generated media — AI images (scenes, portraits) and voice audio generated in your sessions.
• Feedback — reports you submit via /feedback or email.

Payments

• Subscription data — your plan, billing period, seat assignments, and a customer reference from our payment processor. We never see or store your card details — payment is handled entirely by our third-party payment processor.

Collected automatically

• Usage data — commands used, feature interactions, usage counters (messages, image credits, voice minutes), and error logs.
• AI interaction logs — prompts and responses exchanged with AI models, retained for debugging, quality assurance, and abuse prevention for up to 90 days.
• Website session cookies — strictly necessary cookies used to keep you signed in. We do not use advertising trackers.
• Product analytics — events such as sign-ups, world creation, and purchases, tied to your Discord ID, so we can understand and improve the product.

2. How and why we use it

Under UK/EU data protection law we need a lawful basis for each purpose:

• To provide the Service (running your games, storing worlds and characters, generating content, managing your subscription and seats) — necessary to perform our contract with you.
• To secure and improve the Service (debugging, abuse and fraud prevention, product analytics, enforcing usage limits) — our legitimate interests in running a safe, working product.
• To communicate with you about your account, purchases, and material changes — contract and legal obligation. Marketing messages, if we ever send them, only with your consent.

We do not sell your personal information, and we do not use your data to train AI models.

3. Who we share it with

We share data only with vendors and service providers retained to operate the Service, when legally required, or at your direction — never with advertisers. These providers act as processors under contract and may only use the data to provide their services to us. Data received from Discord's API is handled in accordance with Discord's Developer Terms of Service and Developer Policy. The categories of providers we use:

• AI model providers — gameplay messages are sent to third-party AI APIs to generate narration, images, and audio. Our AI providers do not use this API data to train their models.
• Payment processor — handles all payment information on our behalf; we never see or store your card details.
• Hosting and infrastructure providers — application hosting, database, security, and email routing.
• Analytics and error-monitoring services — product usage analytics and crash reporting.
• Discord — the platform the bot runs on; your use of Discord is governed by Discord's privacy policy.

You can request the current list of our service providers by emailing [email protected].

4. International transfers

Some of these providers process data in the United States. Where personal data is transferred outside the UK/EEA, we rely on the providers' data processing agreements incorporating the EU Standard Contractual Clauses and the UK Addendum/IDTA.

5. Data retention

• Game data (characters, worlds, message history) — retained while your account/world is active so your campaigns persist. Deleted within 30 days of a verified deletion request.
• AI interaction logs — up to 90 days.
• Subscription and payment records — retained as long as required for tax, accounting, and dispute purposes (typically 6 years).
• Analytics events — retained in identifiable form for up to 24 months, then deleted or anonymised.

6. Your rights

Under UK/EU data protection law you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to our processing, or provide it in a portable format. Email [email protected] from an address you can verify, including your Discord username or ID so we can find your records. We respond within one month.

You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

Note that because games are shared, deleting your data removes your characters and personal records, but story content already woven into a shared world's history may persist in anonymised form for the other players.

7. Security

Data is stored in access-controlled databases with encrypted connections and regular backups. If a breach affecting your personal data occurs, we will notify you and the relevant authority as required by law. No method of electronic storage is 100% secure.

8. Children

The Service is not directed at children under 13 (or the higher minimum age Discord requires in your country), and purchases require you to be 18 or have a parent or guardian purchase for you. We do not knowingly collect data from children under 13; if we learn we have, we delete it.

9. Changes to this policy

We may update this policy as the Service evolves. For material changes we will give notice via the website, Discord, or email before the change takes effect. The "last updated" date at the top always reflects the current version.

10. Contact

Privacy questions and rights requests: [email protected]. General support: [email protected].