Privacy policy

This policy is based on Law No. 29733 on Personal Data Protection of Peru and its Regulation (S. D. No. 016-2024-JUS), and is interpreted according to them. The essentials:

• We use little data, only what a feature needs to work.
• We don't sell your data or use it for advertising.
• We don't keep the images the detector reviews.
• You're in charge: you can ask to see, correct or delete your data, for free, at [email protected].

The developer of NextGen, who operates independently under the pseudonym agnonotdev, decides on the data covered by this policy and answers for it to you and to the Authority.

• Contact for data matters: [email protected]
• A different case: when the bot reviews messages or images of a server's members, the one who decides what that data is used for is the server owner, and NextGen acts on their behalf (see Terms, "If you own a server").

• Signing in to the panel: when you sign in with Discord we ask only for the "identify" and "guilds" permissions. We receive your ID, name, avatar and the list of your servers. They are kept in the server's memory while your session lasts (up to 7 days) and are not written to disk.
• Your server's configuration: IDs of the server, channels and roles; AutoMod rules; custom messages; detector settings; prefix and language. It is stored in files on our computers. If you write personal data in a custom message, it stays there.
• Server messages: the bot receives their content to recognize commands, review attached images and, if the owner turned on AutoMod rules, read it to apply them (links, invites to other servers, spam patterns and known scam patterns; with "18+ server alert" it also looks up invite codes on Discord). A message that triggers no rule is not stored: it is analyzed in memory and only simplified versions of each person's latest messages are kept, for up to 30 seconds and without writing them to disk, to detect spam. The alerts that reach the owner's channel carry the person, the channel and the reason, not the text of the message.
• AutoMod cases: when an AutoMod rule acts on a message, the bot saves a numbered case for that server with the person's Discord ID, the rule, what was done, the channel, the date and the text of the message that triggered the rule (the first 1500 characters, no attachments). It is a moderation record of the server: the owner, who turned the rules on, decides what it is used for, and NextGen only stores it on the owner's behalf. The server's moderators see it in Discord and in the panel, and the bot posts it in the log channel the owner picks. Authorized moderators can hide or delete a case with commands or from the panel.
• Images reviewed by the detector (only if the owner turned it on): they are downloaded, analyzed in memory and discarded. If the detector acts, the alert on Discord includes the person's mention, the channel, the risk level and the reasons.
• Images you send us (NG-3), only with your consent: the image, your optional note, your Discord ID, the server's, the date and the type of submission.
• Site visitors: the network that serves the site (Cloudflare) processes technical connection data, such as the IP address, to deliver and protect it. We use few cookies, all necessary, and no analytics or advertising (see Cookie policy).
• Support and complaints: your email and the content of the messages you send us.
• List of suspended users: if someone sends illegal content or breaks the terms, we keep their Discord ID, the reason, the date and the origin (for example, the ID of the image sent).
• Payments: today plans cannot be bought and we do not process payment data. When they can be, the charge will be processed by an external provider that we will tell you about before you pay; we will not keep your card number.

The law asks for free, prior, express, informed and unequivocal consent, except in cases such as carrying out a contractual relationship to which you are a party. In practice:

• Panel: we use your Discord account to give you the service you asked for, and by authorizing the sign-in on Discord you give your consent for that data.
• NG-3: consent is the box on the form. You can withdraw it whenever you want.
• Data of a server's members: the basis must be secured by the server owner.

We use the data only for what we explain here. We don't sell it or use it for advertising.

Legal basis: articles 5, 6 and 14.5 of the Personal Data Law (No. 29733) and articles 2 to 6 and 10 of the Regulation of the Personal Data Law.

The image detector and, if the owner turns it on, AutoMod can delete a message automatically. You have the right not to be subject only to an automatic decision that significantly affects you.

• How to ask for a person to review it: write to [email protected] or talk to the server's moderators. How the detector and AutoMod work is in the Terms.

Legal basis: article 23 of the Personal Data Law (No. 29733) and article 87 of the Regulation of the Personal Data Law.

• Discord: the bot works on its platform and API. It is a foreign company with its own privacy policy.
• Cloudflare: a foreign company that delivers this site and protects the connection; the traffic of people who visit the site and the panel passes through it.
• Where we keep our data: on the computers where NextGen runs, managed by the NextGen team.

We don't sell your data or share it with anyone else, unless a competent authority requires it under the law or we must report a crime (see Terms, "Illegal content and reports"). The transfers abroad above are necessary to give you the service, one of the cases the law allows.

Legal basis: article 15, item 4, of the Personal Data Law (No. 29733) and articles 18 to 21 of the Regulation of the Personal Data Law.

The service is bought by server owners, but a server's members may be minors. We apply these rules:

• With the consent of those who hold parental authority or guardianship, processing minors' data is lawful.
• From 14 to 17 they may consent on their own if they are informed in words they understand.
• Under 14: their parents' or guardians' consent is needed.

We don't use minors' data to profile them or for advertising, and we don't ask them for information about their family. The server owner must obtain those consents before turning on the detector (see Terms). Paid plans cannot be bought by a minor.

Legal basis: articles 22 to 25 of the Regulation of the Personal Data Law.

• Panel session: up to 7 days, only in memory.
• Images reviewed by the detector: not stored; they exist in memory while the analysis lasts.
• Fingerprints of confirmed scams: as long as they help detect repeated images, with no data about people or servers.
• NG-3 images: a rejected one is deleted at once; an approved one, when the bot processes it. The record of the submission is deleted after 12 months.
• Server configuration: while you use NextGen. If you remove the bot, it is deleted on its own 30 days later, unless you add it back; before that, you can ask us to delete it at [email protected].
• AutoMod cases: while the bot is in the server and authorized moderators do not delete them. Deleting a case erases its text and leaves only its number, who deleted it and when. If you remove the bot, they are deleted with the rest of the server's data 30 days later, unless you add it back. If you want a case about you to be reviewed or deleted, ask the server's moderators or owner; if your request reaches [email protected], we pass it to the owner as explained in the Terms, "If you own a server".
• List of suspended users: until the suspension is lifted.

We keep data only for the time needed for its purpose.

Legal basis: quality principle, article 8 of the Personal Data Law (No. 29733).

• The connection is encrypted (HTTPS).
• The panel's cookies can't be read by scripts and only travel over HTTPS.
• Sessions are stored on the server; the browser only receives a random key.
• The panel checks where requests come from and limits attempts.
• Panel access: by default, only the server owner gets in.
• The visual comparison model is stored encrypted.

Legal basis: security measures, article 16 of the Personal Data Law (No. 29733).

If an incident seriously exposes personal data:

• To the Authority: we notify within a maximum of 48 hours from when we learn of it.
• To the affected people: we notify them within the same period. If it happens in the digital environment, we also notify the National Digital Security Center.
• Server members' data: if the incident affects data that a server processes, we tell its owner without delay, by Discord direct message, as the data controller, so they can make their own notices.

Legal basis: articles 34 and 36 of the Regulation of the Personal Data Law.

You can ask us, about your data, to:

• Know what data we have about you (information and access).
• Correct what is wrong (rectification).
• Delete it (erasure) or object to our using it.
• Have a person review an automatic decision.
• Take it with you (portability).
• Withdraw your consent whenever you want, without justification and without retroactive effect.

Legal basis: articles 10 and 61 to 87 of the Regulation of the Personal Data Law.

• How to ask: write to [email protected] with your name, what you are asking for, an address to reply to and a copy of your national ID or equivalent document (or your digital signature), or your representative's.
• It's free, and we answer even if we hold no data about you.
• Deadlines: 8 days if you ask for information, 20 if you ask for access and 10 if you ask to rectify, delete or object, counted from the day after your request. We may extend them only once, for the same time and explaining why.
• If you're not satisfied with the answer, you can file a claim with the National Authority for Personal Data Protection of the Ministry of Justice and Human Rights.

Legal basis: articles 63, 64, 67.3, 68, 69, 71 and 88 to 92 of the Regulation of the Personal Data Law.

NextGen is offered from Peru and governed by Peruvian law. It is not specially aimed at the European Union, but if you are there, this applies to you too:

• Your rights and the deadlines are the same as above, and you ask for them at [email protected].
• You can file a complaint with the data protection authority of your country. If the EU General Data Protection Regulation applies to this service in your case, that right exists even if this text does not repeat it.

Legal basis: article 77 of the EU General Data Protection Regulation (Regulation (EU) 2016/679): anyone who considers that the processing of their data infringes that regulation can lodge a complaint with a supervisory authority, in particular in the State where they live.

If we change this policy to use your data in a new way, we'll tell you in the panel beforehand and, when the law requires it, we'll ask for new consent before starting. The date of the last update is at the top.