Privacy Policy
This policy explains what personal data we process when you use GSv2.0 — the websites under gsv2.com, your GSv2.0 account, and the products Kiksi OS, Shiina and Mira — why we process it, how long we keep it, and what you can demand from us.
Subscriptions and advertising fund our services. Website advertising uses Google AdSense; its use of data and personalisation depend on your privacy choices. Sections 6 and 8 explain the recipients, technologies and controls.
1. Controller
GSv2.0 Studio UG (haftungsbeschränkt) i.G.
Kornstraße 29
38640 Goslar
Germany
- support@gsv2.com
We have not appointed a data protection officer: we are below the threshold of § 38 BDSG. Write to the address above for any data protection matter — it reaches the people who run the service.
2. Data We Process
2.1 Your account
- Account identity — the identifier of your GSv2.0 account, and, once you link Discord, your Discord ID, username and avatar. One account is valid across all our products.
- Session data — a signed session cookie valid across gsv2.com and its subdomains, plus the expiry of that session.
- Profile — display name, avatar, biography and whether your profile is public. Everything here is optional and yours to delete.
- Entitlements — which subscription you hold and when it expires.
2.2 When you use a Discord bot
- Server identity — server ID and name, so your configuration can be stored against the right server.
- Message content — read to generate AI replies, to moderate (spam, profanity, toxicity) and to translate. Raw messages are not stored; conversation history is held in memory only while the conversation is going on. See section 5.
- Derived facts — short notes the AI keeps about you, for example a stated preference such as "always reply in German". Capped per user, fade when unused, deleted on request.
- Safety records — GlobalChat warnings and bans, and messages held for review.
- Server configuration — every module setting an administrator chooses for their server.
2.3 Rewards, purchases and support
- Vote records and Coin balance — which vote listing credited you and when, and the resulting balance.
- Vote link clicks — IP address and user agent, kept briefly to detect abuse of the reward system.
- Purchases — which item you bought, when, and the payment reference of our payment provider. We never receive your card number or wallet credentials.
- Support and feedback — bug reports, feature requests and messages you send us, including anything you attach.
2.4 When you visit our websites
- Server and delivery data — IP address, requested URL, time, referrer and user agent, processed to deliver the page and to defend against attacks (Art. 6 (1) (f) GDPR).
- Approximate location — the country your connection comes from and, where Cloudflare supplies it, the region and city, derived from your IP address. We use it to show prices in your currency and, in Shiina, send it along with your message so that local questions such as tomorrow's weather are answered for your area. It is not stored (Art. 6 (1) (f) GDPR).
- Advertising and consent data — on pages with ads, Google and advertising partners may process your IP address, page URL, browser and device details, ad interactions, cookie identifiers and privacy choices. See sections 6 and 8.
3. Why We Process It
| Purpose | Legal basis |
|---|---|
| Providing your account, subscriptions and purchases | Performance of a contract — Art. 6 (1) (b) GDPR |
| Operating the bots and the dashboard for a server | Performance of a contract — Art. 6 (1) (b) GDPR |
| AI replies, translation and language detection | Legitimate interest in providing the feature you invoked — Art. 6 (1) (f) GDPR |
| Moderation, anti-spam, anti-abuse and security | Legitimate interest in a safe service — Art. 6 (1) (f) GDPR |
| Cross-server chat (GlobalChat) and its translation | Consent — Art. 6 (1) (a) GDPR, given by the administrator enabling it and by you writing in that channel |
| Transfers to AI providers outside the EU/EEA | See section 6 — Art. 49 GDPR |
| Advertising that requires consent, including personalisation and non-essential cookies | Consent — Art. 6 (1) (a) GDPR; storage or access on your device under § 25 (1) TDDDG |
| Recording and applying your privacy choices | Meeting consent obligations — Art. 6 (1) (c) GDPR; necessary storage under § 25 (2) no. 2 TDDDG |
| Meeting legal obligations, for example keeping invoices | Legal obligation — Art. 6 (1) (c) GDPR |
4. How Long We Keep It
Most of these periods are enforced automatically by the same code that runs the clean-up — this table is generated from it, so what you read here is what actually happens.
| Data | Retention |
|---|---|
| Account, profile, Coin balance | Until you delete the account or ask us to |
| Sessions | Until they expire or you sign out |
| Conversation history with the AI | Only while the conversation is going on — in the bot's memory on Discord, in your own browser for the web chat. Never written to a database. |
| Dashboard request logs (IP address, endpoint) | 1 day |
| Vote records (which listing, when) | 14 days |
| Bug reports, once resolved | 30 days |
| Translation cache | 1 day |
| GlobalChat warnings | 7 days |
| GlobalChat messages held for review | 14 days |
| Support ticket queue entries | 1 day |
| Support ticket feedback | 30 days |
| Cross-server message links (needed to mirror edits and deletions) | 7 days |
| AI derived facts | Fade when unused; deleted on request |
| Server configuration after the bot is removed | 30 days, then permanently deleted |
| Record that a server removed the bot | 90 days |
| Giveaway participation | 30 days after the giveaway ends |
| Sign-in links and codes (email address) | 1 day |
| Uploaded background images | Until you delete them or your account |
| AI request log (time of each request and a one-way fingerprint of the message — keeps the free AI fair) | 7 days |
| Automatic flags for script-like AI use | 30 days after the last detection; a reviewed decision stays |
| Email delivery log (address, subject, outcome) | 90 days |
| Attack detection records (IP addresses of hostile traffic) | Fade daily; removed once no longer hostile |
| GlobalChat bans | While the ban stands — a ban that forgets itself protects nobody |
| Invoices and payment records | Up to 10 years, as required by German commercial and tax law |
Google and other advertising partners apply their own retention periods to the advertising data they receive. These periods are not controlled by our database clean-up. See Google's advertising and retention information and the partner privacy policies linked in the consent dialog.
5. AI Processing
AI replies, moderation, translation, language detection and summarisation run through a pool of AI providers with automatic failover. When a feature runs, your message, the prompt and — for conversations — recent history (in Shiina also your approximate location, see section 2.4) are sent to whichever provider handles that request, solely to produce the result you see.
None of these providers is permitted to retain that content to train models, and we do not opt in to any retention feature they offer. Conversation history lives in memory for the duration of the conversation and is never written to a database; only the short derived facts described in section 2.2 are stored, and only until they fade or you delete them.
An administrator can disable AI channels for a whole server, and you can simply not write in an AI channel — no AI feature runs on a message outside one. You can also object under Art. 21 GDPR or ask us to delete your derived facts at support@gsv2.com.
Voice
In Shiina you can dictate a message or talk in conversation mode. The recording is sent to one provider of the AI pool, which turns it into text — or, as a fallback, transcribed on our own hardware. A reply that is read aloud is produced by a provider from the reply's text. We do not store recordings or the audio of replies; the same providers and safeguards apply as for text (section 6).
6. Recipients
We use the following companies to operate the service, process payments and display advertising. Advertising partners and their processing purposes are also identified in the consent dialog.
Platform, payment and advertising
| Recipient | Location | Data shared | Purpose |
|---|---|---|---|
| Discord Netherlands B.V. / Discord Inc. | Netherlands and United States | OAuth2 tokens, your Discord ID, username, avatar, list of servers you administer | Authentication and operation of the bot — the platform the service runs on |
| Cloudflare, Inc. | United States | HTTP request data, IP address, security cookies, browser signals for the human check | Content delivery, DDoS protection and bot filtering for our websites; the human check (Turnstile) before the free AI answers |
| Google Ireland Limited / Google LLC (AdSense) | Ireland and United States | IP address, page URL, browser and device details, ad interactions, cookie identifiers and consent choices | Serving and measuring ads, preventing invalid traffic and managing consent; personalisation according to your privacy choices |
| Stripe Payments Europe, Ltd. | Ireland (European Union) | Billing details you enter at checkout, amount, purchased item | Card and wallet payments. We never see or store your card details. |
| BitPay, Inc. | United States | Transaction data of the cryptocurrency payment, amount, purchased item | Cryptocurrency payments. We never see or store your wallet credentials. |
| Top.gg and Discord Bot List | United States | Your Discord ID, vote timestamps | Recording votes so the reward (Coins) can be credited to your account |
For AdSense, Google processes advertising data as an independent controller. The consent dialog lists the additional advertising partners used on our pages, with links to their privacy policies. For Google's processing, see How Google uses information from sites or apps that use its services.
AI providers
This list is generated from the provider pool our software actually uses, so it cannot quietly fall out of date.
| Recipient | Location | Data shared | Purpose |
|---|---|---|---|
| Mistral AI SAS | France (European Union) | Prompt content, recent conversation history, message text (in transit only) | AI text generation and background tasks |
| Cohere Inc. | Canada | Prompt content, recent conversation history, message text (in transit only) | AI text generation and moderation (failover) |
| Cerebras Systems Inc. | United States | Prompt content, recent conversation history, message text (in transit only) | AI text generation, translation |
| Cloudflare, Inc. (Workers AI) | United States | The description of an image you ask the AI to create, translated to English (in transit only) | AI image generation |
| Google Ireland Limited / Google LLC | Ireland and United States | Prompt content, recent conversation history, message text (in transit only) | AI text generation (failover) |
| Groq, Inc. | United States | Prompt content, recent conversation history, message text (in transit only) | AI text generation, moderation, translation |
| OpenRouter, Inc. | United States | Prompt content, recent conversation history, message text (in transit only) | AI text generation and related tasks (failover) |
| SambaNova Systems, Inc. | United States | Prompt content, recent conversation history, message text (in transit only) | AI text generation, moderation, translation |
| Z.AI (Zhipu AI) | China | Prompt content, recent conversation history, message text (in transit only) | AI text generation, moderation (last-resort failover) |
| AI Horde (Haidra) and its volunteer workers | Worldwide | The description of a picture you ask the AI to create (in English) and the resulting picture — the volunteer computer that draws it sees both | AI image generation, including 18+ pictures where you unlocked them |
7. Transfers Outside the EU/EEA
Some recipients are based outside the European Economic Area. The safeguard we rely on depends on the country:
| Country | Safeguard |
|---|---|
| Netherlands and United States | United States — Standard Contractual Clauses (Art. 46(2)(c) GDPR) where the provider offers them, otherwise the transfer is necessary to perform the service you requested (Art. 49(1)(b) GDPR). |
| United States | United States — Standard Contractual Clauses (Art. 46(2)(c) GDPR) where the provider offers them, otherwise the transfer is necessary to perform the service you requested (Art. 49(1)(b) GDPR). |
| Ireland and United States | For AdSense, transfers to certified Google entities in the United States use the EU-US Data Privacy Framework (Art. 45 GDPR); Google's Controller Terms provide Standard Contractual Clauses where applicable. See Google's data transfer frameworks and Google's Controller-Controller Data Protection Terms. |
| Ireland (European Union) | Processed within the EU/EEA — no third-country transfer. |
| France (European Union) | Processed within the EU/EEA — no third-country transfer. |
| Canada | Canada — covered by the European Commission's adequacy decision for recipients subject to PIPEDA (Art. 45 GDPR). |
| Ireland and United States | United States — Standard Contractual Clauses (Art. 46(2)(c) GDPR) where the provider offers them, otherwise the transfer is necessary to perform the service you requested (Art. 49(1)(b) GDPR). |
| China | China — no adequacy decision exists. The transfer relies on your explicit consent (Art. 49(1)(a) GDPR), given by choosing to use an AI feature, together with Art. 49(1)(b) GDPR. |
| Worldwide | Volunteer computers in any country — no adequacy decision can apply. The transfer relies on your explicit consent (Art. 49(1)(a) GDPR), given by asking the AI for a picture, together with Art. 49(1)(b) GDPR. |
A transfer under Art. 49 GDPR is not backed by an adequacy decision. It means the data protection level in that country may be lower than in the EU and that enforcing your rights there can be harder. You avoid transfers to China entirely by not using AI features.
8. Cookies and Similar Technologies
Necessary storage
We set a session cookie so you stay signed in, and we store your language and appearance choices in your browser. Storage needed to provide the functions you request is used under § 25 (2) no. 2 TDDDG. Your advertising privacy choices are stored so they can be remembered and communicated to the participating providers.
Cloudflare sets security cookies such as __cf_bm to tell humans from bots. They carry no profile of you. Before the free AI answers, Cloudflare Turnstile checks now and then — usually without you noticing — that a person and not a script is writing; it reads browser signals only for that check.
Google AdSense
The service pages of gsv2.com can carry Google AdSense advertising; our products carry none. Google and other advertising partners can place or read cookies, use local storage, web beacons and other identifiers to deliver and measure ads, limit repetition and detect invalid traffic. Where you consent to personalisation, these technologies may use your visits to this and other websites to select ads. Turning off personalisation does not by itself mean that no cookies or advertising data are processed.
Where consent is required, Google's consent dialog lets you accept, refuse or manage the purposes and partners before the processing that requires consent. You can review the partner list and change or withdraw your consent at any time through the privacy and cookie settings link that Google's consent dialog keeps on pages with ads. Withdrawal does not affect the lawfulness of processing before it.
You can also turn off Google's personalised advertising in Google's ad settings. This separate Google setting does not replace your privacy choices on our pages. Your browser lets you block or delete cookies; deleting consent storage may cause the dialog to appear again. Details: Google's advertising and retention information.
9. Security
Data is stored in a single database on a server in Germany that is not reachable from the public internet; traffic reaches it through an encrypted tunnel. We use signed sessions, strict origin checks, rate limits and input validation across our API, and access to the machine is limited to the people who operate it.
10. Your Rights
Under the GDPR you can demand the following from us:
- Access (Art. 15) — a copy of the data we hold about you.
- Rectification (Art. 16) — correction of anything inaccurate.
- Erasure (Art. 17) — deletion of your data. We delete your account, profile, balance, vote history, playlists, reports and AI derived facts. Ban records and invoices can outlive this where safety or tax law requires it — we tell you which.
- Restriction (Art. 18) — that we hold off processing while something is disputed.
- Portability (Art. 20) — your data in a machine-readable format.
- Objection (Art. 21) — to any processing we base on legitimate interest. Tell us your situation and we stop unless we can show compelling grounds.
- Withdrawal of consent (Art. 7 (3)) — at any time, without affecting what happened before.
Write to support@gsv2.com. We answer within 30 days and we do not charge for it. We may ask you to prove you are the account holder — not to stall, but so nobody else can request your data.
11. Supervisory Authority
The supervisory authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen).
You may also lodge a complaint with the supervisory authority of your habitual residence or place of work. Exercising this right costs you nothing and does not affect any other remedy.
12. Children
Our service is not directed at children under 13, and Discord requires the same minimum age. We do not knowingly process data of children under 13. Tell us at support@gsv2.com if you believe we have, and we will delete it.
13. Changes
We update this policy when the service changes. The date at the top always reflects the current version, and we announce material changes in the product before they take effect.