AuthentiGate Privacy Policy

Effective date: October 22, 2026

AuthentiGate is a Discord bot that gives servers verified age and region roles, pronoun and gender roles, and moderation and ticket tools. This policy explains what AuthentiGate stores about you, why, who can see it, how long it is kept, and the rights you have over it.

1. Who we are

AuthentiGate is run by Whiskey Bots, which decides how and why your data is used.

We don't have a postal address or an email address for privacy requests. All questions and requests go through the AuthentiGate support server at https://discord.gg/Vxq2TQzGtu, or through the bot's own /download_my_data and /delete_my_info commands (see section 9).

2. What we store

When you verify your ID

Verification is done by our ID verification provider, Persona (see section 5). You photograph your ID and take a selfie on Persona's page. Your ID images, your selfie and your ID document are handled by Persona. AuthentiGate never receives or stores them.

Once Persona finishes the check, AuthentiGate stores this personal data:

• Your date of birth, encrypted. We keep it because age bands change as you get older. It is encrypted with AES-256-GCM, using a key that is not kept in the database.
• Your region, encrypted, worked out from the country on your ID: Africa, Asia, Europe, North America, Oceania or South America. The country itself is not stored.
• The sex shown on your ID, encrypted (F, M, X or unknown).
• A one-way fingerprint of your ID number, so one ID can only verify one Discord account. Your ID number itself is never stored and can't be recovered from the fingerprint.
• The Persona inquiry ID, encrypted, with when you verified and the method (Persona). We use it for disputes, deletion requests and reconciliation.
• The date your age band next changes, so a daily job can update your age role. It shows a date within a year of your birthday, not your date of birth.
• A record of each verification attempt: when it started, which server it started in, its state and outcome, and the Persona inquiry ID.

We do not store your name, your ID number, your address, the country code, your ID images or selfie, or anything else from Persona.

Your profile

• Your gender (encrypted) and pronouns, if you set them in /profile (or choose to use the gender from your verification), with the date you set them and where the value came from (verification, you, or staff).

Moderation, reports and appeals (stored for the servers that use AuthentiGate)

• Moderation cases a server's staff create about you, such as warnings, timeouts, kicks and bans. A case holds your Discord ID, the moderator's ID, the type of action, the reason the moderator wrote, timestamps, and any evidence the moderator attached, such as a link and a short message excerpt of up to 200 characters.
• Ban records: that you were banned and in which server. These records make up a ban count, which can be shown across servers (it is a number only).
• Reports and appeals, including the text you or other members write in them.

Tickets

If you open or take part in a support ticket in a server that uses AuthentiGate's tickets:

• the ticket (who opened it, their answers to the ticket's questions, and the close reason);
• when the ticket closes, a transcript of the messages in it, with the names and avatars of the people who wrote or were mentioned. AuthentiGate reads a ticket's messages once, when it closes, to make the transcript;
• on Premium servers, files attached in the ticket, up to 8 MB each.

The web panel (panel.authentigate.gg)

If you sign in to the panel with Discord, we store a session with your Discord user ID, your display name, your avatar ID and the servers you manage. The session cookie is stored only as a hash, and we do not store your IP address. When a server's settings are changed in the panel or in Discord, we keep a record of who made the change and the old and new values.

Payments

If you buy Premium, payment is handled by Stripe. We store your Stripe customer ID and a record of the server's subscription. We never see or store your card details.

Discord IDs and server settings

Everything above is keyed by Discord user, server, channel and role IDs. We also store each server's AuthentiGate settings, such as role mappings, moderation and ticket settings, and monthly verification usage.

What we don't read

AuthentiGate does not read your messages. Word filtering is done by Discord's own AutoMod. The spam trap only notes who posted in the trap channel. The only exceptions are a short excerpt a moderator attaches to a case as evidence, and ticket transcripts, as described above.

3. How we use it

We use this information only to run AuthentiGate:

• to give you the verified, age, region, gender and pronoun roles each server has set up, in every server that uses AuthentiGate, and to move your age role up on your birthday;
• to stop one ID being used to verify several accounts;
• to let servers moderate, handle reports and appeals, and run tickets;
• to apply Premium, verification limits and cooldowns, and to prevent abuse of the paid verification service;
• to answer support requests and handle disputes.

We never sell your data, and we never use it for advertising.

4. Legal bases (GDPR)

Where the EU or UK GDPR applies, we rely on:

• Contract: to provide the service you asked for, such as your roles, your profile, tickets and Premium.
• Legitimate interests: for moderation, and to prevent fraud and duplicate accounts (including the ID fingerprint and the 30-day verification lock).
• Consent: for ID verification. You choose to start it, and you can withdraw consent at any time by deleting your data (see section 9).

5. Who processes your data for us

• Persona checks your ID and selfie. We have a data processing agreement with Persona. Persona holds your ID images, selfie, name and the other details on your ID, under its own privacy notices: https://withpersona.com/legal/privacy-notices
• Stripe processes payments under Stripe's own terms and privacy policy.
• Hetzner hosts the bot and its database in Germany (EU).
• Discord is the platform the bot runs on.

We do not share identity data (date of birth, region, sex on your ID) with Discord, with server staff beyond what section 6 describes, or with anyone else.

International transfers

Our database is hosted in the EU. Persona and Stripe may process data in the United States. They rely on their own safeguards for those transfers, such as Standard Contractual Clauses.

6. Who can see what

• You can see everything stored about you with /profile.
• Server staff with Manage Server or Timeout Members can use /inspect on you. They see your account age, when you joined, whether you are verified, and only the attributes their server has roles for, for example your age band if the server maps age roles, or your region if it maps region roles. Staff never see your date of birth. /inspect only works on members of that server. The only value shown across servers is the ban count.
• Whiskey Bots (the bot owner) can view and correct a member's profile to handle support and disputes. Your date of birth is shown to the owner only through a separate "Show date of birth" step.

7. How long we keep it

8. Payments

Premium is sold per server through Stripe, for $5.00 a month, and renews automatically. You pay on Stripe's secure checkout page. AuthentiGate stores only your Stripe customer ID and the subscription's status, never your card details. Stripe keeps payment records as the law requires.

9. Your rights and choices

Download or delete your data yourself

• Download your data: run /download_my_data, or press Download my data in /profile. You get a private JSON file with every stored field, including your date of birth (decrypted for you), your verification attempts and any verification lock. You can do this once every 10 minutes. Keep the file private.
• Delete your data: run /delete_my_info, or press Delete my data in /profile, then confirm. This:
• deletes your verified identity (date of birth, age band, region), your verification history, your pronouns and gender, and your Stripe link, unless you still pay for Premium;
• asks Persona to delete your ID and selfie records. If Persona can't be reached, the bot keeps asking until it can;
• removes your verified, age, region, gender and pronoun roles in every server;
• blanks what you wrote in stored ticket transcripts, deletes your kept ticket files, and removes your name and your answers to ticket questions.

What deleting does not remove: servers' moderation cases about you, counted bans, the fact that a ticket existed, and Stripe's payment records, which tax law requires.

30-day verification lock: after you delete your data, you can't verify again for 30 days. ID checks cost money, and this stops repeated verify-and-delete abuse. The lock stores only your Discord user ID and its end date, and it deletes itself when it ends. The bot owner can lift it early.

• Correct your data: change your gender and pronouns in /profile. To correct verified details, ask in the support server.
• Stop a server using your data: leave the server. Your roles go with your membership.

Your rights under the GDPR (EU and UK)

You have the right to:

• Access the personal data we hold about you;
• Rectification: have inaccurate data corrected;
• Erasure: have your data deleted;
• Restriction: ask us to limit how we use your data;
• Portability: get your data in a machine-readable format;
• Object to processing based on our legitimate interests;
• Withdraw consent to ID verification at any time, without affecting what was done before;
• Complain to a supervisory authority, such as the data protection authority where you live.

Your rights under the CCPA/CPRA (California)

You have the right to:

• Know what personal information we collect, use and disclose;
• Delete your personal information;
• Correct inaccurate personal information;
• Opt out of sale or sharing. We do not sell or share your personal information;
• Non-discrimination: we won't treat you differently for using these rights.

How to use your rights

Use the bot's /download_my_data and /delete_my_info commands (or the buttons in /profile), or ask in the support server at https://discord.gg/Vxq2TQzGtu.

10. Children

You must meet Discord's minimum age to use Discord, and so AuthentiGate: 13 in most countries.

AuthentiGate may verify someone under 18. If it does, it stores the same information as for anyone else; the date of birth is kept so the member moves into an adult age band later. Members under 18 get the "Under 18" age band. AuthentiGate takes no extra action beyond each server's own age settings. Each server decides what happens to members below its age requirement: either they don't get the Verified role, or every role the bot manages is removed. AuthentiGate does not share a minor's identity data with Discord or anyone else.

11. Security

• Your date of birth, region, the sex on your ID, your gender and the Persona inquiry ID are encrypted at the field level (AES-256-GCM). The key is kept outside the database and the code repository, and each encrypted value is bound to your account, so it can't be copied to another account. Your pronouns are not encrypted.
• Your ID number is stored only as a one-way fingerprint.
• Persona's messages to the bot are signature-checked, so nobody can fake a verification.
• Credentials (Discord, Persona, Stripe and database) are kept in the server environment, never in the code.

No system is perfectly secure. If a data breach affects you, we will tell affected users through the support server within 72 hours of becoming aware of it.

12. Changes to this policy

We may update this policy. We'll announce changes in the support server and update the effective date at the top of this page.

13. Contact

Questions or requests: join the AuthentiGate support server at https://discord.gg/Vxq2TQzGtu, or run /support in Discord.