Privacy Policy

Information we collect

• Discord account data via OAuth — your Discord user id, username, avatar, email, and, for Sellers, the servers you administer.
• Seller billing data — identifiers for your connected Stripe account and your flatpass platform subscription. We do not store card numbers; Stripe handles payment details.
• Membership records — which roles a Member has purchased, subscription status, and the events (subscribe, cancel, refund, dispute) needed to grant or revoke access.
• Role data for paying Members — for a Member with a paid subscription only, whether they currently hold the role they pay for in the Seller’s Discord server, whether they are in that server, and when that last changed, checked with Discord hourly and when their roles change. When a paid role is removed and put back, the name they use in that server and their Discord username are included in the notice sent to the Seller. We don’t collect this for anyone who isn’t paying.
• Saved card (flatpass wallet). If you choose to save a card, flatpass keeps a Stripe customer for you on flatpass’s own Stripe account, with that card attached. flatpass stores the Stripe identifiers, the card brand, its last four digits, its expiry date and Stripe’s card fingerprint, and gives Stripe the name you enter for the card and your email address; the card number never reaches flatpass. When you subscribe in a server that uses flatpass, a copy of the card, that name and your email are given to that server’s Stripe account to make the payment. That checkout stays open for 30 minutes. If you leave it without paying, flatpass deletes that copy from the server’s Stripe account within about an hour; if you pay there with a different card, the copy is removed when the payment completes. If a card is declined while you save it, flatpass records that for 24 hours to stop card testing. You can remove the saved card at any time on flatpass.io/account; that doesn’t change subscriptions you already pay for, whose cards are held by those servers.
• Email from checkout. If your Discord account gave flatpass no email address, flatpass keeps the email you type at checkout, separately from your account, only so later checkouts can fill it in. It is never used to sign you in. If you later add a verified email to your Discord account, flatpass uses that one instead.
• Usage data — basic logs and diagnostics generated when you use the Service.

How we use your information

We use this information to operate the Service: authenticating you, provisioning Seller invite pages, processing platform subscriptions, granting and revoking Discord roles as subscriptions change, providing support, and keeping the Service secure.

How we share information

We share information only with the providers needed to run the Service:

• Stripe — payments, Connect onboarding, and platform billing.
• Discord — authentication and granting/revoking roles on your behalf.
• Resend — delivers the emails we send Sellers about their own account, such as reaching the free plan’s member limit. It receives the Seller’s email address, their server’s name and their paying member count. It also delivers the confirmation email when someone asks to hear if flatpass adds Telegram (below), and receives the address they entered. We never email Members.
• Hosting and database providers that store and serve the Service’s data.

We do not sell your personal information. We may disclose information if required by law or to protect the Service and its users.

Sellers and their Members

Sellers are the merchant of record and control their own customer relationships. Information about a Member’s purchase is available to the Seller they purchased from. Each Seller is responsible for how it handles its Members’ information.

Cookies and sessions

We use a session cookie to keep you signed in. It is required for the Service to function and is not used for third-party advertising.

Analytics

We count visits to Seller invite pages so Sellers can see how many people viewed their page and how many joined. Each visit is recorded with a coarse device type, the operating system and its version (such as iOS 18.5 or Android 14), your browser’s user-agent string, whether the page was opened inside an app’s built-in browser, and any campaign tag the Seller added to their own link. Pressing Subscribe is recorded the same way, so we can see how many people start checking out.

When a visit is recorded we look up the approximate location (country, region and city) and network provider, such as the mobile carrier, from your IP address and record them with the visit. We also keep a keyed hash of your IP address, to protect the Service and its users from abuse. We do not store your IP address itself. IP Geolocation by DB-IP: the location and the network provider both come from DB-IP’s free databases, used under the Creative Commons Attribution 4.0 licence.

To recognise a returning visitor we set one first-party cookie holding a random identifier. It contains nothing about you, it is never shared with anyone, and it is not used to follow you to other websites. It lets us recognise the same browser across different Sellers’ pages, for our own analytics and to prevent abuse. Sellers only ever see data about their own page.

If you sign in with Discord to subscribe, the earlier visits recorded on that same browser, for that same Seller, are linked to your Discord account. This is what lets a Seller see which of their links first brought a member in, rather than only the last page that member happened to open. Those visits are reported to Sellers only in aggregate — counts per link, per device, per day — never as an individual browsing history. The link is limited to the browser you signed in on and does not reach across your devices.

Visit and Subscribe records, with the user-agent string, the approximate location and network provider, the IP hash and the browser identifier stored in them, are deleted after 30 days, and the cookie expires on the same schedule. Clearing your browser’s cookies removes the identifier immediately, after which you are counted as a new visitor.

When you start a checkout, we keep a record of it: your Discord user id, the plan, when you started, and whether we sent you a reminder. If you leave a checkout without paying, we send you one message in Discord about a day later with a new link, and this record is how we make sure we never send more than one per plan. It is kept for as long as the plan exists.

When you use one of our commands or buttons in Discord, we record which one, in which server, your Discord user id, whether it worked, and your Discord language setting, so we can see how the bot is used and fix what fails. These records are deleted after 90 days.

On our own marketing pages we use a self-hosted, cookieless analytics tool to see which pages people find useful. It runs on our infrastructure and shares nothing with third-party advertisers.

Telegram notification

On our Telegram guides you can leave your email address to hear from us once if flatpass adds Telegram. We store that address, the language and page you used, when you asked and when you confirmed. We use it to send that one email and for nothing else.

We first send a confirmation link, and your address only goes on the list when you confirm it. That confirmation is your consent, which is our legal basis (Art. 6(1)(a) GDPR). You can withdraw it at any time.

An address that isn’t confirmed is deleted after 7 days. A confirmed address is kept until we send that email or you remove it, and is then deleted. To remove it, open the link in the confirmation email and choose Remove my email, or write to us at the address below.

Data retention

We retain information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal information. To make a request, contact us using the details below.

Security

We take reasonable measures to protect your information, but no method of transmission or storage is completely secure. Keep your Discord and Stripe credentials safe.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date above.

Contact

Questions about your privacy? Email support@flatpass.io.