Spice Bot // Legal

Privacy Policy

Effective and last updated: August 15, 2026

Who Is Responsible

Spice-Ex is an independently operated community market service based in the United States. The Spice-Ex operator is responsible for personal data processed by Spice Bot, its checkout and installation flow, and related support. This policy explains what is collected, why it is used, who receives it, how long it is kept, and how to request access or deletion.

Information We Collect

Depending on how you use Spice Bot, we may process:

• Subscription data: PayPal order or subscription ID, selected plan, status, amount, currency, payer email when PayPal returns it, and creation, capture, cancellation, or renewal timestamps.
• Discord installation data: Discord application ID, guild ID, guild name, installation and approval status, and installation timestamps.
• Bot usage data: Discord guild and user identifiers, command names, command inputs needed to answer a request, saved server preferences, response status, and timestamps.
• Access and security data: a hashed copy of the private access token, short-lived OAuth state hash, expiration time, IP address, browser and device information, request logs, error logs, and security events.
• Support data: messages and identifiers you provide when requesting billing, installation, access, or privacy support.

Spice-Ex does not receive or store your full payment-card or bank-account number. PayPal processes payment credentials. The Discord OAuth authorization code is exchanged with Discord and is not retained as a reusable Discord credential.

How We Use Information

We use this information to verify an active subscription, issue and protect access, enforce the one-subscription-per-guild rule, install and operate the bot, answer commands, save requested preferences, review guild activation, provide support, prevent fraud and abuse, diagnose failures, comply with law, and maintain accurate accounting records. We do not use Discord API data to profile users or train artificial-intelligence models.

Legal Bases for EU and UK Users

Where EU or UK data-protection law applies, processing needed to provide paid access and bot functionality is based on performance of a contract. Security, service reliability, fraud prevention, and limited operational analytics are based on legitimate interests. Optional analytics or advertising cookies rely on consent where required. Accounting, tax, sanctions, and lawful-request processing may be required by legal obligation.

Who Receives Information

Information is disclosed only as needed to operate the service:

• Discord provides guild authorization, application installation, and bot infrastructure.
• PayPal processes subscriptions, billing, refunds, risk checks, and payment compliance.
• Cloudflare and hosting infrastructure provide domain routing, delivery, security, and operational hosting.
• Google services may provide consent-controlled site analytics or advertising on Spice-Ex web pages.
• Authorities or professional advisers may receive information when required by law or reasonably necessary to establish, exercise, or defend legal claims.

Spice Bot subscription, guild, and command data is not sold and is not shared for cross-context behavioral advertising. Separate website cookie and advertising data is governed by the general Spice-Ex Privacy Policy and the Privacy Choices control.

Security and Access Tokens

The browser receives a private Spice Bot access token after verified checkout. The server stores a one-way hash rather than the raw token. Discord installation state is single-use and expires after approximately ten minutes. Keep access tokens private, do not post them in Discord, and report suspected exposure through support.

Retention

Short-lived Discord OAuth state is deleted or invalidated after use or expiration. Active subscription, entitlement, guild, and approval records are retained while needed to provide access. Payment and transaction records may be retained afterward for accounting, tax, fraud prevention, chargebacks, disputes, and legal obligations. Command and technical logs are kept only for as long as reasonably necessary for operation, debugging, security, and abuse prevention. When data is no longer needed, it is deleted or de-identified unless law requires continued retention.

Your Choices and Rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to appeal or complain to a data-protection authority. California and other U.S. residents may also have rights to know, delete, correct, and opt out of certain sales or sharing. Spice Bot does not sell personal information.

To make a request, use the private support path in the official Spice-Ex support server and identify the relevant Discord guild and subscription. Do not publish payment details or access tokens in a public channel. We may ask for reasonable verification before acting on a request.

Removing the Bot

A guild administrator can remove Spice Bot through Discord. Removal stops new bot interactions but does not automatically cancel PayPal billing. Cancel the subscription separately in PayPal. You may also request deletion of Discord API data that is no longer required for the service, subject to records we must retain for payment, security, disputes, or law.

Children

Spice Bot is not directed to children under 13 or below the minimum digital-consent age required in their country. We do not knowingly collect personal data from an ineligible child. Contact support to report such data for review and deletion.

International Processing

Spice-Ex operates from the United States and its service providers may process information in the United States and other countries. Where required, transfers are handled using an applicable legal transfer mechanism and service-provider safeguards.

Policy Changes

We may update this policy as the bot, payment flow, legal requirements, or service providers change. The effective date above identifies the current version. Material changes will be posted here and, when reasonably possible, announced through the service or support community.

Contact and Data Requests

Contact the Spice-Ex operator through the official Spice-Ex support server for privacy questions, deletion requests, or complaints. Use a private support channel or ticket and provide enough information to locate the relevant record.

Spice-Ex and Spice Bot are unofficial community projects and are not affiliated with, endorsed by, sponsored by, or approved by Funcom, Legendary, Discord, or PayPal.