Last updated: Owner decision required: date of publication
This policy explains what personal data we collect, why, who we share it with, and what you can do about it.
We have tried to write it so that it can be read. If anything here is unclear, ask.
1 · Who is responsible
The data controller is the operator of pathofbotting.com, trading as Path of Botting. Path of Botting is a trading name, not a registered company; the operator is personally responsible for the data described here.
Owner decision required: the controller’s country and address
The trading name is settled (owner, 2026-09-07). Still needed: the controller’s country and postal address, and whether an EU or UK representative is required under Article 27 GDPR given the customer base. A privacy notice that names a controller without an address is still incomplete.
2 · What we collect
When you buy a subscription and use the software
| Data | Why we have it |
|---|---|
| Account name | Identifies your account and your entitlements. |
| Email address | Account recovery and messages about your subscription. |
| Hardware identifier | An identifier derived from your computer, used to recognise the machines that sign in with a licence, for support and for abuse checks. |
| IP address | Recorded when the software authenticates and when you use this website; used for security, abuse prevention and fraud detection. |
| Payment references | The PayPal transaction reference or the cryptocurrency transaction identifier, so we can match a payment to a subscription and resolve disputes. |
| Subscription records | What you bought, when, for how long, how many instances. |
| Authentication and session logs | When the software connected, from where, and whether it succeeded — used for security and for diagnosing your problems. |
When you use this website
Standard server logs: IP address, the pages requested, the time, the user agent string and the referring page.
Owner decision required: whether any analytics are used
If they are, they must be named here, and consent requirements in the EU and the UK must be assessed. If none are used, say so plainly — it is a genuine selling point to this audience.
When you ask the assistant a question
Questions asked to the assistant on this website, and the answers, are stored so that the service can be operated, rate-limited and improved.
Do not put personal information, passwords, transaction details or anything you would not want stored into that box. It is a support tool, not a private channel.
Owner decision required: name the model provider
How long a conversation is kept, and what it is keyed to, is now in section 6: a visitor’s conversation is tied to an address bucket and deleted after an hour idle; a signed-in member’s is tied to their account and deleted after seven days idle. The text is sent to a third-party model provider to produce the answer, and that provider must be disclosed by name in section 4, with a statement of whether the text is used for training.
When you join the Discord community
Discord is operated by Discord Inc., not by us. Your use of it is governed by Discord’s own privacy policy. We see your Discord username, your Discord user identifier, and anything you write in channels or tickets we can access.
Support tickets and their contents are retained so that support has history.
What we do not collect
- We do not collect payment card numbers. PayPal handles PayPal payments and we never see your card or bank details.
- We do not collect your Path of Exile account credentials.
- We do not read the contents of your game account.
Owner decision required: confirm the credentials claim against the shipped software
FollowApp has optional auto-login settings which involve game credentials being entered into the application. If those are stored locally only and never transmitted, say so here explicitly — it is exactly the sort of thing this audience worries about and silence reads as evasion. If they are transmitted anywhere, that must be disclosed.
3 · Why we process it, and on what basis
| Purpose | Basis |
|---|---|
| Providing the software and enforcing your subscription | Performance of a contract |
| Taking payment and keeping payment records | Performance of a contract; legal obligation |
| Recognising the machines that sign in with a licence and preventing sharing | Legitimate interests — protecting the business from unpaid use |
| Security, abuse prevention and fraud detection | Legitimate interests — protecting the service and its customers |
| Support | Performance of a contract; legitimate interests |
| Keeping accounting and tax records | Legal obligation |
Owner decision required: confirm the legal bases
Legal bases must be confirmed by someone qualified, and legitimate-interests assessments should be documented where that basis is relied on.
4 · Who we share it with
- PayPal — for PayPal payments.
- Discord Inc. — if you use the community.
Owner decision required: name the cryptocurrency payment processor
The processor used for cryptocurrency payments, named.
Owner decision required: name the hosting provider
The hosting provider, named, and where it is located.
Owner decision required: name the model provider behind the assistant
Named, with a statement of what is sent to it and whether it is used for training.
We do not sell personal data. We do not share it for advertising.
We may disclose data where we are legally required to, or to protect the service against fraud or abuse.
A note on cryptocurrency. Blockchain transactions are public and permanent by design. A transaction identifier you give us is already public information, and neither we nor you can remove it from the blockchain.
5 · International transfers
Owner decision required: where data is hosted, and the transfer mechanism
Where data is hosted and processed, and what transfer mechanism applies for customers in the EU and the UK. This cannot be omitted and it depends on the hosting decision.
6 · How long we keep it
This table states what the systems actually do today, not what a policy would prefer. It was written from the systems’ own configuration (2026-09-07). Where a row says indefinite today, no deletion routine exists for that data yet and it is kept until the owner sets a period.
| Data | Retention today |
|---|---|
| Account and subscription records | Indefinite today, until the owner sets a period. Neither the current subscription system nor the new portal has a deletion routine for accounts, licences or grants. |
| Payment references | Indefinite today, until the owner sets a period. The current system keeps every payment row; the portal’s billing history is designed to outlive the order it came from. Whatever period is set will be bounded below by tax record-keeping law. |
| Hardware identifiers | The record of a machine that signed in: for as long as the licence exists. Staff can clear a recorded machine. The portal also keeps an append-only history of every hardware identifier an account’s licences have ever presented — indefinite today, until the owner sets a period — because that history is what stops a once-per-person trial being taken twice. |
| IP addresses in authentication logs | Portal: the address a sign-in came from is kept on the session record for the life of that session — at most 7 days idle or 30 days absolute for a member, 12 hours for staff — and is never used to authorise anything. Failed-sign-in counters are held in memory and decay within 30 minutes. A visitor’s assistant conversation is keyed to an address bucket for at most one hour of idle time. Current system: authentication records exist and have no recorded retention period. |
| Website server logs | Live host: rotated, with a retention period nobody has recorded — until the owner sets one. Portal deployment: the web server’s access and error logs rotate daily and 30 days are kept; the portal’s own request log goes to the system journal, where 30 days is the configured target. |
| Assistant questions and answers | Portal: a conversation — the questions and the answers — is deleted once it has been idle past its limit: 1 hour for a visitor, 7 days for a signed-in member, 24 hours for staff. A per-call spend ledger (token counts, cost, timing; no text) is kept indefinitely, until the owner sets a period. The current Discord support bot keeps its conversation archive indefinitely — see the next row. |
| Support tickets | Portal: the ticket record (reference, summary, a pointer to the conversation) is kept indefinitely, until the owner sets a period. Discord support bot: a ticket channel closes after 24 hours without a reply (21 days when it is waiting on a software fix); its transcript is archived before the channel is removed, and that archive, the closed-ticket register and the bot’s Discord message archive are kept indefinitely, until the owner sets a period. |
| Data after an account is closed or deleted | No deletion routine exists in either system today. A closed account’s records stay for the periods above, until the owner sets a period. Payment records will stay subject to tax record-keeping law whatever is decided; see section 7. |
| Backups | Portal deployment: a daily encrypted archive, of which the 14 most recent copies are kept on the server; the off-site copy’s retention is not yet configured. Data deleted from the live system remains in those backups for that long. |
Honest summary: most rows are “indefinite because nobody has decided otherwise”, which is the default state of most systems, including this one, and is difficult to defend under the GDPR. The table now says so plainly instead of leaving the cells blank. A recommendation, to accept or replace: keep the minimum that each purpose actually requires, set a defined period for each row that says until the owner sets a period, and delete on schedule automatically rather than by intention.
7 · Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have data deleted
- object to or restrict processing
- receive your data in a portable format
- withdraw consent where processing is based on consent
- complain to your data protection authority
To exercise any of these, contact us — see section 11.
Owner decision required: what deletion actually does
Deletion versus support records. If a hardware identifier is deleted on request, the record staff use for support and abuse checks goes with it, and so does the once-per-PC trial check. Decide and state what actually happens on a deletion request from an active subscriber.
Deletion versus records. Payment records are usually subject to mandatory retention under tax law and cannot simply be deleted. State that plainly rather than promising deletion you will not perform.
8 · Security
We protect data with access controls and encryption in transit.
Owner decision required: confirm every security claim, and the breach process
What is stated here must be true of the system as built, not aspirational. Do not claim a control that does not exist. Decide the breach-notification process before it is needed rather than during.
9 · Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from children.
10 · Changes
We will post changes to this page and update the date at the top. Material changes will be announced in the Discord community.
11 · Contact
Owner decision required: a contact address for privacy requests
A Discord handle is not sufficient for a data subject access request.
This page is a draft. It must be reviewed by a qualified professional, and the retention periods the owner has not yet set must be set, before publication.