Privacy Policy

Last updated: 18 October 2026

1. Who we are

Velora is a Discord bot and the website at velorabot.lol (together, “Velora”, “we”, “us”). Velora is run by an independent developer based in the United Kingdom, who is the data controller for the personal data described here. You can contact us through our Discord support server.

This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Using Velora also means using Discord, which has its own privacy policy.

2. What we collect

When you use the bot

• Discord identifiers: your user ID, username, display name and avatar, and the IDs and names of servers, channels and roles where Velora is used.
• Server settings: configuration that server staff choose, such as welcome messages, log channels, auto-roles, moderation and automod settings, and ticket, starboard and giveaway setup.
• Feature data you or server staff create: levels and XP, economy balances and items, warnings, moderation notes and case history, temporary roles, tags, AFK messages, birthdays, profile details (bio, quote, pronouns, colours, banner images and linked social accounts), Last.fm usernames, giveaway entries, suggestions, invite tracking (who invited whom), modmail conversations and music playlists.
• Message content: Velora reads messages where needed for a feature to work, for example automod filtering, text-prefix commands, AFK mentions, sticky messages, auto-responses, modmail and message counts for levels. Messages are processed as they arrive and are not stored, except where a feature saves them by design (such as a quote, a tag, a modmail message, or a log entry a server has chosen to send to its own log channel).
• Usage data: counters needed for daily limits and cooldowns (for example, how many AI requests you've used today), and error logs when something goes wrong.

When you use the website

• Discord login: when you log in, Discord shares your user ID, username and avatar (the identify scope) and the list of servers you're in (the guilds scope). We keep only the number of servers, not the list.
• The help assistant (“Star”): your questions are sent to an AI model to generate answers. Your recent conversation is kept in your browser for the current session only.

When you buy Premium

• Payments are handled by Stripe (cards) and NOWPayments (crypto). We never see or store your full card details or wallet keys.
• We keep your Discord user ID, the plan you bought, your premium rank, the payment session or order ID, the date, and any gift codes you buy or redeem.

3. How we use it, and our legal basis

We do not sell your data, use it for advertising, or build profiles about you for marketing.

4. AI features

When you use an AI feature (such as /ai, translation, summaries, image generation, text-to-speech or transcription), the text, images, files or audio you provide are sent to an AI provider to produce the result. Depending on availability, this may be Google (Gemini), Groq or Cloudflare Workers AI, and for some image requests the community service Pollinations.

• We don't store your AI prompts or the answers, apart from a daily usage counter.
• These providers process the content under their own terms. Some may keep it for a limited time, and free tiers (including Google's free Gemini API) may use submitted content to improve their products.
• Please don't put sensitive personal information (health details, passwords, financial or identity documents, or other people's private information) into AI features.
• AI output can be wrong. Don't rely on it for medical, legal, financial or safety decisions.

5. Who we share it with

We share data only with the service providers we need to run Velora, and only what each one needs:

• Discord: the platform Velora runs on.
• AI providers: Google, Groq, Cloudflare and Pollinations, for AI features (see section 4).
• Payments: Stripe and NOWPayments.
• Hosting and storage: HidenCloud (bot hosting), Vercel (website), Neon (premium database) and Cloudflare.
• Music: public Lavalink audio servers run by third parties, which receive song searches and voice connection details when you use music.
• Lookups you ask for: commands that look things up send your query to that service, for example Last.fm, Roblox, YouTube, Spotify, weather and currency services.

We may also disclose data if the law requires it, or to protect the safety of users or the service.

6. International transfers

Some of these providers process data outside the UK, mainly in the United States and the EU. Where this happens, we rely on the safeguards those providers offer, such as the UK–US data bridge, UK adequacy decisions or standard contractual clauses.

7. How long we keep it

• Bot and server data: kept while Velora is used in that server, or until you or server staff delete it or ask us to. Short rolling backups are kept for recovery and are replaced within days.
• Payment and premium records: kept for up to 6 years to meet UK tax and accounting rules.
• Website login: held in a session cookie that ends when you log out or it expires.
• Error logs: kept only as long as needed to fix problems.

8. Your rights

Under UK GDPR you have the right to access your data, have it corrected or deleted, restrict or object to how we use it, and receive a portable copy of it. Many settings can be cleared directly with commands (for example /profile reset). For anything else, contact us through the support server and we'll respond within one month.

Server staff control their own server's settings and moderation records. If you want data from a particular server removed, you can also ask that server's staff.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).

9. Cookies and local storage

• Session cookie (velora_session): keeps you logged in. It's essential for login and checkout to work.
• Browser storage: remembers an in-progress checkout so it can finish after you log in, and holds your help-assistant conversation for the current session.

We don't use advertising or tracking cookies.

10. Security

We use encrypted connections (HTTPS), keep API keys and secrets out of public code, limit who can access data, and keep backups. No online service can be completely secure, so we can't guarantee absolute security, but we'll tell affected users and the ICO about a serious breach where the law requires it.

11. Children

Velora is meant for people who meet Discord's minimum age (13 in the UK, or older where local law requires). We don't knowingly collect data from anyone younger. If you think a child under that age has used Velora, contact us and we'll delete their data.

12. Changes and contact

We may update this policy as Velora changes. We'll change the date at the top, and for significant changes we'll give notice on the website or in our support server. For any privacy question or request, contact us through our Discord support server.