Data Processing Agreement

1. Roles

The person who adds Mark Defender to a server and configures it (the server owner) decides why member data is processed in that server and is the controller. Corset Studio processes that data only to provide Mark Defender and is the processor.

For our own account records, licensing, billing, fraud prevention and the global blacklist, Corset Studio acts as an independent controller, as described in the Privacy Policy.

2. What we process

Purpose

Detecting and containing destructive actions, raids and spam; rebuilding deleted channels and roles; member verification; showing the dashboard and incident history.

Data subjects

Members of, and visitors to, servers where Mark Defender is installed, and server staff using the dashboard.

Categories of data

• Discord user, role, channel and server IDs; usernames and display names; avatar URLs.
• Account creation date and whether an avatar is set (raid detection, in memory only).
• Recent message content and attachment links (rebuild cache, in memory only).
• Moderation and incident records: who did what, to whom, and when.
• Verification records, and IP address passed through to Cloudflare during the check (not stored by us).

We do not intentionally process special categories of data. Message content may contain anything members post; we keep it in memory only and only for rebuild.

Duration

For as long as Mark Defender is in the server, plus the deletion period in section 8.

3. Our obligations

• We process the data only to provide the service as configured by you, and not for our own purposes beyond those in section 1.
• Everyone at Corset Studio with access to the data is bound to keep it confidential.
• We apply the security measures in section 5.
• We help you respond to member requests (section 7) and, where reasonable, with questions about our processing.
• On request, we answer a written security questionnaire instead of an on-site audit.

4. Subprocessors

You authorize these subprocessors. We announce new subprocessors in our support server at least 14 days before using them. If you object, you can remove the bot before the change takes effect.

5. Security measures

• HTTPS for all website traffic; the bot API accepts requests only with a shared secret from the website.
• Dashboard access limited to servers your Discord account owns or manages.
• Signed, httpOnly session cookies; OAuth state checks.
• Message and join data held in memory only, never written to disk.
• Secrets kept in host environment variables, not in source code.
• Staff actions on licenses and the blacklist recorded in an internal activity log.

6. Breaches

If we become aware of a breach affecting personal data we process for you, we notify you without undue delay and within 72 hours of confirming it, through the support server and, where possible, by direct message. We tell you what happened, what data is involved, and what we are doing, and we help you meet any notification duty you have.

7. Member requests

If a member asks us directly to access or delete their data, we refer them to you where the request concerns your server, and help you answer it. We can export or delete a member's records for your server on request.

8. Deletion

When you remove Mark Defender, in-memory data disappears immediately. You can ask us to delete your server's stored data (settings, snapshots, incident and verification logs) through a support ticket; we do so within 30 days of verifying the request. License and billing records are kept as long as needed for billing, fraud prevention and legal duties.

9. International transfers

Our subprocessors may process data in countries other than yours, including the United States. Where the law requires it, we rely on the transfer safeguards those providers offer.

10. General

If this agreement conflicts with the Terms of Service on data protection, this agreement wins. We may update it; material changes are announced in the support server and take effect when the date above changes. Questions go to our support server.