Privacy Policy

Phillip InfoSec, a Danish sole proprietorship, CVR 41892463, Sandbygårdvej 33, 1. tv, 2700 Brønshøj, Denmark operates Snitch. Contact phillip@golemgrid.com about this notice or the processing for which Phillip InfoSec is controller.

For moderation performed for a Discord server, the organization operating that server generally determines why and how moderation is used and is the controller. Phillip InfoSec processes that server-scoped data as its processor. Phillip InfoSec is separately the controller for account administration, billing, website security, service analytics, and the central cross-server scam intelligence described below.

• Dashboard identity: Discord ID, username, email, avatar, guild access, OAuth credentials, login and security events.
• Moderation data: guild, channel, message and member IDs; username; message text; image attachments; timestamps; AI classifications, reasons, model/provider metadata, selected action, action result, and appeals or false-positive reports.
• Membership and threat-intelligence data: guild membership status, warnings, known-scam indicators, propagation attempts, automatic bans, reversals, and related evidence.
• Commercial data: organization and contact details, subscription, Stripe customer/subscription identifiers, payment status, invoices and tax records. Card details are handled by Stripe, not stored by Snitch.
• Website data: IP-derived and device information processed by hosting/security providers, CookieYes consent records, and consented PostHog, Google Ads, X Ads, or LinkedIn Ads events.

Snitch uses automated models to classify messages and may recommend or execute the server operator’s configured moderation action. Models can be wrong. Server operators must configure proportionate actions, provide an appeal route, and retain meaningful human oversight. A member may contest a result through the server operator; cross-server intelligence objections and appeals may also be sent directly to Phillip InfoSec.

Data is disclosed only as needed to the server operator, authorized staff, and the providers listed in the Subprocessor List. Some providers or support access may involve countries outside the EEA. Where required, Phillip InfoSec uses an adequacy decision, the European Commission Standard Contractual Clauses, and supplementary safeguards.

Snitch does not sell personal data. Phillip InfoSec does not use customer moderation content to train its own general-purpose AI model. Retention and training controls for each enabled AI provider must be verified in the vendor register before publication or activation.

• Non-flagged raw moderation data: 30 days.
• Flagged scam/spam evidence and linked actions, reports and cross-server intelligence: three years rolling.
• Departed-member identity and ordinary membership history: 12 months.
• Operational error data containing message details: 30 days unless part of retained flagged evidence.
• Account/OAuth data: for the active account, then deletion or revocation within 30 days of closure, subject to unresolved obligations.
• Billing, tax and contract evidence: five years after the relevant financial year, or longer for a documented dispute or mandatory rule.
• Anonymous daily scan, flag, unflag, false-positive and action counts contain no member, message or channel identifiers and may be retained indefinitely.

Depending on the circumstances, you may request access, correction, erasure, restriction, portability, or object to processing, and you may withdraw consent without affecting earlier lawful processing. Send requests to phillip@golemgrid.com with enough information to locate the data. We may verify identity and coordinate with the relevant server operator where that operator is controller.

You may complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, or another competent EEA supervisory authority. Rights are not absolute; a response will explain any lawful limitation.

Snitch applies access controls, private object storage, encrypted transport, encrypted OAuth credentials, data minimization, audit trails, retention automation, and incident procedures. No internet service is risk-free.

Material changes will receive a new version and effective date. Business customers will receive reasonable notice where a change materially affects contracted processing.