TicketToolX Privacy Policy

Last updated: 17 August 2026. This policy is reviewed at least once every twelve months.

TicketToolX is a support ticketing application for Discord. It runs as a bot inside servers that have installed it, and provides a web dashboard where server administrators configure it and support staff answer tickets. This policy covers both, and it is the whole of our privacy notice.

We are the data controller for the personal information described here. Discord is a separate controller for the data it holds about you, governed by Discord's own privacy policy, not this one.

1. Who we are and how to reach us

The service is operated by the TicketToolX team.

• Privacy and data requests: privacy@claritya.com
• General support: support@claritya.com

Either address reaches us, and either one may be used to exercise any right described in this policy. We answer data requests within 30 days, free of charge. We have not appointed a Data Protection Officer, because we are not required to; the addresses above are the contact point.

2. What we collect, and where it comes from

2.1 Data we receive from Discord about you

• Your Discord user ID, username, display name and avatar.
• The Discord server (guild) ID, name and icon of servers using the service.
• Channel, category and role IDs and names, so tickets are created in the right place and the right people can see them.
• Message content inside ticket channels only, and only where that server has asked for transcripts.

We do not read messages outside ticket channels. The application is built without Discord's message content intent for general channels, so that content is not available to us even in principle.

2.2 Data you give us directly

• When you sign in to the dashboard, your Discord account ID, username, avatar and the list of servers you administer, supplied by Discord through OAuth. We never see your Discord password.
• Your email address, if you give us one for receipts or account notices.
• Configuration you enter: panel names, message templates, canned responses, and documents uploaded for the AI answering feature.

2.3 Data we obtain about you from someone else

This section matters if you have never used the dashboard and never installed anything.

If another person opens or participates in a ticket and names you, mentions you, or attaches something concerning you, we may hold that information about you without having collected it from you. The source is that Discord server and its members. The categories are the same as in section 2.1. Where we hold such data and can identify and reach you, we will tell you within one month, unless doing so is impossible or would involve disproportionate effort.

You have every right in section 6 over that data, exactly as if you had given it to us yourself.

2.4 Payment information

We never see or store your card details. Purchases are handled by Discord's own payment system or by our payment processor, who act as merchant of record. We receive only a record that a purchase happened and what it entitles you to.

3. Why we use it, and our lawful basis for each purpose

Under the UK and EU GDPR we must name a specific lawful basis for each purpose rather than one basis for everything. These are ours.

Performance of a contract, Article 6(1)(b)

• Creating, naming and permissioning ticket channels.
• Applying the configuration a server administrator has set.
• Generating and delivering the transcripts a server has asked for.
• Signing you in to the dashboard and keeping you signed in.
• Processing purchases and applying entitlements.

Legitimate interests, Article 6(1)(f)

• Detecting and preventing abuse, fraud and automated attack. Our interest: keeping the service available and safe for everyone using it. We use the minimum data that achieves this.
• Keeping short-lived operational logs so faults can be diagnosed. Our interest: running a service that works, and being able to explain it when it does not.
• Producing aggregate statistics for a server's own administrators. Our interest: giving the administrator the operational picture they installed the product to get.

You may object to any processing based on legitimate interests. See section 6.

Consent, Article 6(1)(a)

• Optional integrations you switch on yourself, such as saving transcripts to your own Google Drive, or sending an outbound webhook to a URL you supply.
• Optional email notices.

You may withdraw consent at any time, and doing so is as easy as giving it: switch the integration off in the dashboard, or email us. Withdrawal does not affect processing already carried out.

Legal obligation, Article 6(1)(c)

• Keeping billing and tax records for the period the law requires.
• Responding to lawful requests from authorities.

4. Who we share it with

We share personal data only with these categories of recipient:

• Discord, necessarily, since the service operates on their platform.
• Payment processors, to complete purchases and handle refunds.
• Infrastructure and hosting providers who store and serve data on our behalf under written contract, acting only on our instructions.
• Error and performance monitoring providers, which may incidentally receive identifiers present in a diagnostic record.
• Integrations you switch on yourself. These are off by default and you control them.
• Authorities, where we are legally required to disclose.

We do not sell, licence, rent or otherwise commercialise your data. We do not use it for advertising or ad targeting, and we do not disclose it to advertising networks, data brokers or any similar monetisation service. This is both our own commitment and a requirement of Discord's Developer Policy.

5. International transfers

Our infrastructure is located in the United States, so personal data of users in the European Economic Area, the United Kingdom and Switzerland is transferred there.

Where that transfer is not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum for United Kingdom data, as the safeguard under Article 46. You may obtain a copy of the clauses we rely on by emailing privacy@claritya.com.

6. Your rights

Wherever you are, you may ask us to:

• Access the personal data we hold about you, and receive a copy.
• Correct anything inaccurate or incomplete.
• Erase your data.
• Restrict how we process it while a dispute is resolved.
• Port it, receiving it in a structured, commonly used, machine-readable format.
• Object to processing based on our legitimate interests.
• Withdraw consent where consent is the basis.

Two ways to make a request, and you may use either: email privacy@claritya.com, or use the data request control in the dashboard once signed in. We respond within 30 days and do not charge.

A note on tickets in someone else's server. If you opened a ticket in a server you do not control, that server's administrators can see it, and they hold their own copy of what was said. We will act on your request against our own systems, and we will tell you where a request needs to go to that server's administrators instead.

Complaints

You have the right to lodge a complaint with a data protection supervisory authority. In the EEA this is the authority in your country of residence, work, or where the issue arose; the full list is published by the European Data Protection Board at edpb.europa.eu. In the United Kingdom it is the Information Commissioner's Office at ico.org.uk. We would prefer you raise it with us first, but you are not required to.

7. California residents

This section applies if you live in California, and uses the terms of the CCPA as amended by the CPRA.

Categories of personal information collected in the past twelve months: identifiers (Discord user ID, username, avatar, and email address if you provided one); internet or network activity (dashboard usage and diagnostic logs); commercial information (what you purchased and what it entitles you to); and the contents of ticket messages, where a server has enabled transcripts. Sources and business purposes are set out in sections 2 and 3.

We do not collect sensitive personal information as that term is defined, and so there is nothing for you to limit the use of.

We have not sold or shared personal information in the past twelve months, and we do not do so. We do not share personal information for cross-context behavioural advertising. There is therefore no "Do Not Sell or Share My Personal Information" mechanism to offer, because there is nothing to opt out of. We nonetheless honour Global Privacy Control signals sent by your browser.

We do not sell or share the personal information of anyone we know to be under 16.

Your rights are to know, access, delete, correct, opt out of sale or sharing, limit the use of sensitive information, and not be discriminated against for exercising any of them. We will never give you a worse service or price for making a request. Use either of the two methods in section 6. An authorised agent may act for you with written proof.

8. How long we keep it

These are actual periods, not "as long as necessary".

• Server configuration: while the bot is installed. Deleted when it is removed, within the window in section 9.
• Ticket metadata (who opened it, when, which panel): while the bot is installed, then deleted within the window in section 9.
• Transcripts we store: for the period that server configured, and deleted on request. A server may turn transcripts off entirely.
• Operational and diagnostic logs: 30 days, then deleted automatically.
• Dashboard change history: 12 months, so an administrator can see who changed what.
• AI question and answer logs: 12 months, or until the server deletes them.
• Billing records: as long as tax and accounting law requires, typically seven years. This is a legal obligation and survives a deletion request, though we will delete everything not required to be kept.

9. Deletion, and how quickly

We delete End User Data within 7 days of any of the following, which is the standard Discord's Developer Policy sets and which we apply as our own:

• You ask us to delete it.
• You terminate your Discord account.
• The application is removed from a server, for that server's data.
• Discord asks us to delete it.

The only exception is data we are legally required to retain, such as billing records, which is kept for that purpose alone and nothing else.

Removing the bot from a server deletes that server's configuration. Export anything you want to keep before removing it.

10. Message content and AI features

Where a server enables AI answering:

• Answers are generated only from documents that server has uploaded. The feature does not answer from general knowledge about that business.
• We do not train any AI model on Discord message content. This is our own commitment and a specific requirement of Discord's Developer Policy, which prohibits it without Discord's express written permission, which we have not sought and do not rely on.
• Questions and generated answers are retained per section 8 so the server owner can review what was asked and improve their documentation.
• A human handoff is always available and the feature can be switched off per server.

11. Automated decision making

We do not make decisions producing legal or similarly significant effects about you by automated means. The service routes, sorts and drafts, and a human can always review, change or override any of it. AI-generated answers are suggestions, not decisions, and are labelled as machine-generated where they are shown.

12. Security

Data is encrypted in transit and at rest. Access is limited to the people who need it to run the service. Credentials are stored encrypted and are never written to logs.

No system is perfectly secure. Where a breach is likely to result in a risk to your rights we will notify you and the relevant supervisory authority within the time the law requires, and we will notify Discord of any unauthorised access to data obtained through their API.

13. Cookies

The dashboard sets cookies that are strictly necessary: one to keep you signed in and one to protect the sign-in against cross-site request forgery. We use no advertising cookies, no analytics cookies and no third-party trackers, so there is no consent banner because there is nothing to consent to.

14. Children

Discord requires users to be at least 13, and older where local law sets a higher age. TicketToolX is not directed at anyone below that age and we do not knowingly collect their personal data. If you believe a child has provided us data, email privacy@claritya.com and we will delete it.

15. Is providing data required?

Providing your Discord identifiers is a contractual necessity: the service cannot create a ticket for you or sign you in without knowing who you are, so if you do not provide them we cannot provide the service. Everything else, including your email address and every optional integration, is genuinely optional and refusing costs you nothing but that feature.

16. Third party links

The dashboard and ticket messages may link to sites we do not control. This policy does not cover them, and we are not responsible for their practices.

17. Changes

We may update this policy. Material changes are announced in the dashboard and the date at the top changes. We review this policy at least annually whether or not anything has changed, so the date at the top is always meaningful.