LEGAL · VERSION 2026-07-26
Data Processing Agreement
Article 28 terms applying when Snitch processes Discord moderation data for a business customer.
- Effective:
- 26 July 2026
- Operator:
- Phillip InfoSec · CVR 41892463
1. Roles and scope
The customer is controller and Phillip InfoSec is processor for server-scoped moderation and membership processing. This DPA is incorporated into the Terms and lasts while Phillip InfoSec processes that data.
Phillip InfoSec is an independent controller for account administration, billing, security and central cross-server threat intelligence. Those purposes are outside the processor instructions in this DPA and are described in the Privacy Policy.
2. Processing details
| Element | Description |
|---|---|
| Subject matter | AI-assisted Discord scam/spam monitoring, evidence storage, configured actions, reporting and support |
| Duration | Term of service plus deletion/return period and fixed lawful retention |
| Data subjects | Discord members, moderators, customer administrators and reported accounts |
| Data | Discord/member/message/channel/guild identifiers, usernames, content, attachments, membership, classifications, actions and appeals |
| Instructions | The Terms, customer settings and documented support instructions consistent with the agreement |
3. Processor obligations
- Process only on documented lawful instructions, unless Union or Member State law requires otherwise.
- Ensure authorized personnel are bound by confidentiality and least-privilege access.
- Maintain appropriate technical and organizational measures and notify the customer without undue delay after confirming a relevant personal-data breach.
- Assist with data-subject requests, DPIAs, supervisory consultation, security obligations and breach notifications, considering the nature of processing.
- Delete or return personal data at the customer’s choice after service ends, subject to mandatory law, scoped legal holds and the independent-controller carve-out.
- Provide information reasonably necessary to demonstrate compliance and support proportionate audits no more than annually unless an incident or authority requires more.
4. Subprocessors and transfers
The customer grants general authorization for the listed subprocessors. Phillip InfoSec will provide at least 30 days’ notice of a material new subprocessor where practicable. A customer may object on reasonable data-protection grounds; the parties will seek a practical alternative, failing which the affected service may be terminated.
Phillip InfoSec imposes equivalent data-protection duties on subprocessors and remains responsible for their processing as required by GDPR. Restricted transfers use an adequacy decision or the applicable Standard Contractual Clauses and supplementary safeguards.
5. Security measures
- Encrypted transport and encrypted Discord OAuth credentials with rotatable keys.
- Private object storage, signed access, role-restricted administration and separate worker responsibilities.
- Typed and validated job/event contracts, idempotent processing, audit logs and controlled privacy fulfillment.
- Data minimization, fixed automated retention, image deletion, legal holds and anonymous long-term aggregates.
- Dependency maintenance, incident response, backup controls and vendor review appropriate to risk.