Privacy Policy

Last updated: 27 June 2026

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use the software and services operated under the brand "Status Rotator" ("SR++"), including the desktop application ("App"), the cloud-hosted Discord bot ("Bot"), and related websites and support channels (together, the "Services").

This Policy should be read together with our Terms of Service and our Cookies Policy. Capitalised terms not defined here have the meaning given in the Terms of Service.

1. Controller and Contact Details

1.1. The data controller responsible for your personal data is:

• Entity: NATIV STUDIO OÜ
• Legal form / registration number: Private limited company (osaühing), registered in Estonia under number 17290338
• Registered address: Järvevana tee 9, Kesklinna linnaosa, 11314 Tallinn, Estonia
• Country of establishment: Estonia
• Contact email: [email protected]
• Privacy / data protection contact: [email protected]

1.2. Data Protection Officer (DPO). We have not designated a Data Protection Officer. Under Article 37 GDPR, a DPO is mandatory only where an organisation's core activities consist of large-scale, regular and systematic monitoring of data subjects, or large-scale processing of special-category data; our processing does not meet those thresholds. We will reassess this if the nature or scale of our processing changes.

1.3. Supervisory authority. If your establishment is in Estonia, the competent supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, "AKI") — see Section 11 for how to lodge a complaint.

2. Scope

2.1. This Policy applies to personal data we process as a controller in connection with the Services. It applies to Users worldwide, including residents of the EU/EEA, to whom the GDPR applies.

2.2. The Services are intended only for individuals aged 18 or over (see Section 12).

2.3. Third-party platforms and services (such as Discord and Stripe) process personal data under their own privacy policies, which we do not control. We provide links where relevant.

3. Categories of Personal Data We Process

We process the following categories of personal data, depending on which Services you use:

3.1. Discord identity data. Your Discord ID and username (and, where made available by Discord, your avatar), obtained from your interactions with the Bot and from the Discord account you use with the Services.

3.2. Discord authentication credentials. Where required to provide the App or Bot functionality, your Discord user token, stored in encrypted form (using Fernet symmetric encryption), and, where applicable, a bot token. These are security-sensitive credentials and receive specific treatment — see Section 6.

3.3. Contact and order data. Your email address (provided at checkout for delivery of License keys and for support) and order, License, and activation records.

3.4. Payment data. Payment-card details are collected and processed directly by Stripe; we do not store full card numbers. We receive and store related information such as your billing email, amounts, currency, payment status, and subscription/order/transaction identifiers, and payment history.

3.5. Technical and security data: HWID (hardware identifier), IP addresses, session details (device, browser, operating system, approximate location derived from IP), access and activity logs, and anti-fraud / rate-limiting data.

3.6. Support data: the content of your communications with us, including conversations via the Assistify support chat widget, and any information you choose to provide.

3.7. Anti-tamper / integrity data: signals generated by the App's Anti-Tamper Protection (for example, the detection of code injection, debugging, memory manipulation, or suspicious executable regions) and related enforcement records — see Section 10.

We do not intentionally collect special categories of personal data (Article 9 GDPR). Please do not provide such data to us.

4. Purposes and Legal Bases

We process personal data for the purposes and on the legal bases set out below (Article 6 GDPR). Where more than one basis may apply, the most relevant is indicated.

4.11. Legitimate interests. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You may object to such processing (see Section 11). You may request more information about our balancing assessment via the privacy contact in Section 1.

5. Where the Data Comes From

5.1. Most data is provided by you or generated by your use of the Services.

5.2. We also receive data from third parties, including: Discord (identity and the actions you perform with the Bot/App, and the Discord Token you provide) and Stripe (payment and transaction data).

6. The Discord Token: Specific Disclosures

Because the Discord Token is a security-sensitive credential, we provide the following specific information:

6.1. What it is. To perform certain functions you configure (such as rotating your Discord status, custom Rich Presence, or role-colour rotation), the App and/or Bot require your Discord user token (and, where applicable, a bot token). This token can be used to take actions on the associated Discord account.

6.2. Legal basis. We rely on your explicit, informed consent (Article 6(1)(a) GDPR) for the collection, storage, and use of the Discord Token, in addition to the performance of our contract with you (Article 6(1)(b)). You provide this consent when you choose to enable the relevant functionality and supply the token. You may withdraw your consent at any time (see Section 11), after which we will cease using and will delete the token, and the related functionality will no longer operate.

6.3. How we protect it. The Discord Token is stored encrypted (Fernet symmetric encryption) and access is restricted. See Section 13 for further security measures.

6.4. Associated risk — important. Using a Discord user token to automate a user account ("self-botting") may violate Discord's Terms of Service, and Discord may restrict, suspend, or permanently terminate the Discord account concerned or take other action. You use this functionality at your own risk. This is described further in the Terms of Service, Section 10. We are not affiliated with Discord and do not control Discord's decisions.

7. Recipients and Processors

7.1. We share personal data with service providers ("processors") who process it on our behalf and under written agreements (Article 28 GDPR), and with other recipients where necessary. The principal categories are:

7.2. Discord — independent third party. Discord is not our processor and does not process personal data on our behalf. When you use the Services with your Discord account, the relevant actions take place on Discord's own platform, under Discord's own Terms and Privacy Policy (https://discord.com/privacy). We are not affiliated with Discord (see the Terms of Service, Section 10).

7.3. No third-party analytics. We do not embed third-party website analytics; we therefore do not share your data with analytics providers for that purpose (see the Cookies Policy).

7.4. Other disclosures. We may also disclose personal data: (a) to comply with a legal obligation, court order, or lawful request from a competent authority; (b) to establish, exercise, or defend legal claims; (c) to enforce our Terms and protect the rights, property, safety, and security of the Services, our Users, and third parties; and (d) in connection with a merger, acquisition, reorganisation, or sale of assets, subject to applicable law and appropriate safeguards.

8. International Transfers

8.1. EU hosting. Our primary processing, including our primary database, is hosted in the EU (Hostinger).

8.2. Transfers outside the EU/EEA. Some of the recipients in Section 7 may process personal data outside the EU/EEA (for example, Stripe, Cloudflare, Upstash, Resend, and the AI language-model providers used by the Assistify support agent may be located in, or transfer data to, the United States or other third countries). Where personal data is transferred to a country that does not benefit from an adequacy decision under Article 45 GDPR, we rely on appropriate safeguards under Chapter V GDPR, namely the EU-US Data Privacy Framework where the provider is certified, and otherwise the European Commission's Standard Contractual Clauses (SCCs) together with a transfer impact assessment and any supplementary measures required. You can obtain information about, or a copy of, the safeguards we use by contacting us (Section 1).

9. Retention Periods

9.1. We keep personal data only for as long as necessary for the purposes set out in this Policy, after which it is deleted or anonymised, unless a longer period is required by law (for example, accounting and tax records).

9.2. Where your data has been deleted on suspension/ban under our Terms, certain minimal records may be retained where necessary to enforce the ban, prevent re-abuse, comply with law, or defend legal claims.

10. Automated Individual Decision-Making (Article 22 GDPR)

10.1. What happens. The App's Anti-Tamper Protection and our security systems can detect activity such as tampering, code injection, debugging, memory manipulation, and suspicious executable regions. Where such activity is detected, the App and/or our systems may automatically suspend, restrict, or permanently ban the relevant License and/or device. Save in cases of a manifest, documented security threat, a permanent ban may follow a human review of the detection. A sanction may affect your access to the Services and, as described in the Terms of Service, Sections 8, 9, and 14, the associated data; refunds and the reversal of errors/false positives are addressed in those Terms.

10.2. Article 22. Such a decision may be based solely on automated processing and may produce legal effects or similarly significantly affect you within the meaning of Article 22(1) GDPR.

10.3. Legal basis for the automated decision. We carry out this automated decision-making on the basis that it is necessary for entering into, or the performance of, our contract with you, and for the security and integrity of the Services (Article 22(2)(a) GDPR). We do not rely primarily on consent for this decision, as the Anti-Tamper Protection is essential to providing the Services.

10.4. Logic involved. In general terms, the App monitors its own runtime integrity and flags indicators consistent with tampering, injection, debugging, or memory manipulation. We do not disclose the detailed detection logic, as doing so would undermine the security purpose, but the general nature and consequences are described here and in the Terms.

10.5. Your safeguards. In accordance with Article 22(3) GDPR, you have the right to:

(a) obtain human intervention — a review of the automated decision by a member of our team; (b) express your point of view; and (c) contest the decision.

To exercise these rights, contact us at [email protected] within 30 days of the decision, providing your License details and any relevant information. We will review and respond within a reasonable time. Where we find that a decision resulted from an error or a false positive, we will lift the measure and restore your access.

11. Your Rights

11.1. Subject to the conditions and exceptions in the GDPR, you have the right to:

(a) access your personal data and obtain a copy (Article 15); (b) rectify inaccurate or incomplete data (Article 16); (c) request erasure ("right to be forgotten") (Article 17); (d) request restriction of processing (Article 18); (e) data portability — receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible (Article 20); (f) object to processing based on legitimate interests, and to direct marketing at any time (Article 21); (g) withdraw consent at any time, where processing is based on consent (including for the Discord Token and any marketing), without affecting the lawfulness of processing before withdrawal (Article 7(3)); and (h) not be subject to certain automated decisions, with the safeguards described in Section 10 (Article 22).

11.2. How to exercise your rights. Contact us at [email protected]. We may need to verify your identity. We will respond within the timeframes set by the GDPR (generally one month, extendable where permitted). Exercising these rights is free, unless requests are manifestly unfounded or excessive.

11.3. Right to complain. You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement. In Estonia, the authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — AKI), Tatari 39, 10134 Tallinn, Estonia — www.aki.ee. We would, however, appreciate the chance to address your concerns first.

12. Minors

12.1. The Services are intended only for individuals aged 18 or over. We do not knowingly process the personal data of persons under 18.

12.2. If you believe we have inadvertently collected data relating to a person under 18, please contact us, and we will take appropriate steps to delete it.

13. Security Measures

13.1. We implement appropriate technical and organisational measures to protect personal data (Article 32 GDPR), taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks involved. These measures include:

(a) encryption of sensitive credentials, including encryption of the Discord Token (Fernet), and encryption in transit (TLS); (b) encrypted database backups; (c) two-factor authentication for staff/administrative accounts and hashed credentials where applicable; (d) access controls and restriction of access on a need-to-know basis; (e) use of reputable infrastructure providers and protective services (e.g. Cloudflare for anti-DDoS/anti-bot), with EU-based hosting; (f) rate-limiting and anti-fraud controls; (g) error monitoring and security audit logging; (h) runtime Anti-Tamper Protection for the App.

13.2. No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

13.3. Data breaches. Where required by Articles 33–34 GDPR, we will notify the competent supervisory authority and, where applicable, affected individuals, of personal data breaches within the legal timeframes.

14. Cookies and Similar Technologies

14.1. We use cookies and similar storage technologies as described in our Cookies Policy, which forms part of this Policy. Non-essential cookies are used only with your consent where required.

15. Changes to this Policy

15.1. We may update this Policy from time to time. We will post the updated Policy with a new "Last updated" date and, where changes are material, provide reasonable notice (for example, by email).

15.2. Your continued use of the Services after the updated Policy takes effect indicates that you have read it. Where consent is required, we will obtain it again as necessary.

16. Contact

For any privacy questions or to exercise your rights:

• Privacy / data protection contact: [email protected]
• Controller (entity and address): NATIV STUDIO OÜ, Järvevana tee 9, Kesklinna linnaosa, 11314 Tallinn, Estonia (reg. 17290338)
• DPO: none appointed at present (see Section 1.2)