AgentOS

Privacy Policy — AgentOS

Effective date: 2026-06-04

Introduction

This Privacy Policy explains what personal data the AgentOS Discord bot ("AgentOS" or "the Bot") may collect, how it is used, stored, shared, and how you can request access or deletion. This policy applies to interactions with the Bot in Discord servers where it is installed.

Data We Collect

How We Use Data

Storage & Retention

Storage locations: Data is stored where the server operator configures it (local files, database, or third‑party services). This repository contains the Bot code and local storage implementation, but actual storage location depends on deployment.

Retention examples: Verification challenges (state tokens) are short‑lived (example: 10 minutes). Moderation logs and records may be retained for operational and audit needs (typical ranges: 1–3 years). Specific retention periods should be published by the server operator.

Deletion requests: You may request deletion of personal data. The Operator will remove linkages and, where feasible, delete stored personal data. Some records may be retained where required for legal, audit, or safety reasons.

Third Parties & Sharing

The Bot integrates with third parties (e.g., Roblox OAuth, Trello, webhooks). Data required to perform those integrations will be transmitted to those services and is subject to their terms and privacy practices. The Operator will not sell personal data. Data may be disclosed to comply with legal obligations or to protect rights and safety.

Security

Reasonable administrative and technical safeguards (access controls, secrets via environment variables, minimal privilege) are used by the Operator. However, no system is perfectly secure—avoid sending extremely sensitive personal information to the Bot.

Your Rights

To make any request, contact the Bot owner with your Discord ID (see Contact below).

Minors

The Bot is not intended to collect data from children without parental consent. Do not provide personal data of minors through Bot commands.

Changes

This policy may be updated. Material changes should be posted in the repository and in server admin channels. Continued use after notice constitutes acceptance.

Contact

Bot owner / administrator: agentosteam.support@gmail.com (include your Discord ID in requests)

Jurisdiction

The Operator is located in Norway; this Privacy Policy is governed by the laws of Norway.

Lawful Basis for Processing

Data Subject Rights (DSRs)

You have rights under applicable data protection law, including access, rectification, erasure (right to be forgotten), restriction of processing, objection, and data portability. To exercise these rights, email agentosteam.support@gmail.com with your Discord ID and request details. We will acknowledge receipt and respond within 30 days, or with extension if needed for complex requests, consistent with GDPR/Norwegian law. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet): https://www.datatilsynet.no

Data Transfers

If data is transferred outside the European Economic Area (EEA), we will rely on an adequate transfer mechanism such as Standard Contractual Clauses (SCCs) or ensure the processor provides appropriate safeguards. Host or storage location options inside the EEA/Norway are recommended to reduce cross‑border requirements.

Processors & Third Parties

We may use processors to operate the Bot and its features (e.g., hosting providers, Trello, Roblox for OAuth). Where required by law, we will have written Data Processing Agreements (DPAs) in place with processors and ensure they act only on our instructions.

Security & Breach Notification

We implement reasonable technical and organizational measures to protect personal data (access controls, secrets management via environment variables, least privilege). However, no system is perfectly secure.

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the Norwegian Data Protection Authority (Datatilsynet) without undue delay and, where required, within 72 hours. If the breach is likely to result in a high risk to individuals, we will also inform affected users.

Retention Details