Last updated: 17 August 2026. This policy is reviewed at least once every twelve months.
TicketToolX is a support ticketing application for Discord. It runs as a bot inside servers that have installed it, and provides a web dashboard where server administrators configure it and support staff answer tickets. This policy covers both, and it is the whole of our privacy notice.
We are the data controller for the personal information described here. Discord is a separate controller for the data it holds about you, governed by Discord's own privacy policy, not this one.
The service is operated by the TicketToolX team.
Either address reaches us, and either one may be used to exercise any right described in this policy. We answer data requests within 30 days, free of charge. We have not appointed a Data Protection Officer, because we are not required to; the addresses above are the contact point.
We do not read messages outside ticket channels. The application is built without Discord's message content intent for general channels, so that content is not available to us even in principle.
This section matters if you have never used the dashboard and never installed anything.
If another person opens or participates in a ticket and names you, mentions you, or attaches something concerning you, we may hold that information about you without having collected it from you. The source is that Discord server and its members. The categories are the same as in section 2.1. Where we hold such data and can identify and reach you, we will tell you within one month, unless doing so is impossible or would involve disproportionate effort.
You have every right in section 6 over that data, exactly as if you had given it to us yourself.
We never see or store your card details. Purchases are handled by Discord's own payment system or by our payment processor, who act as merchant of record. We receive only a record that a purchase happened and what it entitles you to.
Under the UK and EU GDPR we must name a specific lawful basis for each purpose rather than one basis for everything. These are ours.
You may object to any processing based on legitimate interests. See section 6.
You may withdraw consent at any time, and doing so is as easy as giving it: switch the integration off in the dashboard, or email us. Withdrawal does not affect processing already carried out.
We share personal data only with these categories of recipient:
We do not sell, licence, rent or otherwise commercialise your data. We do not use it for advertising or ad targeting, and we do not disclose it to advertising networks, data brokers or any similar monetisation service. This is both our own commitment and a requirement of Discord's Developer Policy.
Our infrastructure is located in the United States, so personal data of users in the European Economic Area, the United Kingdom and Switzerland is transferred there.
Where that transfer is not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum for United Kingdom data, as the safeguard under Article 46. You may obtain a copy of the clauses we rely on by emailing privacy@claritya.com.
Wherever you are, you may ask us to:
Two ways to make a request, and you may use either: email privacy@claritya.com, or use the data request control in the dashboard once signed in. We respond within 30 days and do not charge.
A note on tickets in someone else's server. If you opened a ticket in a server you do not control, that server's administrators can see it, and they hold their own copy of what was said. We will act on your request against our own systems, and we will tell you where a request needs to go to that server's administrators instead.
You have the right to lodge a complaint with a data protection supervisory authority. In the EEA this is the authority in your country of residence, work, or where the issue arose; the full list is published by the European Data Protection Board at edpb.europa.eu. In the United Kingdom it is the Information Commissioner's Office at ico.org.uk. We would prefer you raise it with us first, but you are not required to.
This section applies if you live in California, and uses the terms of the CCPA as amended by the CPRA.
Categories of personal information collected in the past twelve months: identifiers (Discord user ID, username, avatar, and email address if you provided one); internet or network activity (dashboard usage and diagnostic logs); commercial information (what you purchased and what it entitles you to); and the contents of ticket messages, where a server has enabled transcripts. Sources and business purposes are set out in sections 2 and 3.
We do not collect sensitive personal information as that term is defined, and so there is nothing for you to limit the use of.
We have not sold or shared personal information in the past twelve months, and we do not do so. We do not share personal information for cross-context behavioural advertising. There is therefore no "Do Not Sell or Share My Personal Information" mechanism to offer, because there is nothing to opt out of. We nonetheless honour Global Privacy Control signals sent by your browser.
We do not sell or share the personal information of anyone we know to be under 16.
Your rights are to know, access, delete, correct, opt out of sale or sharing, limit the use of sensitive information, and not be discriminated against for exercising any of them. We will never give you a worse service or price for making a request. Use either of the two methods in section 6. An authorised agent may act for you with written proof.
These are actual periods, not "as long as necessary".
We delete End User Data within 7 days of any of the following, which is the standard Discord's Developer Policy sets and which we apply as our own:
The only exception is data we are legally required to retain, such as billing records, which is kept for that purpose alone and nothing else.
Removing the bot from a server deletes that server's configuration. Export anything you want to keep before removing it.
Where a server enables AI answering:
We do not make decisions producing legal or similarly significant effects about you by automated means. The service routes, sorts and drafts, and a human can always review, change or override any of it. AI-generated answers are suggestions, not decisions, and are labelled as machine-generated where they are shown.
Data is encrypted in transit and at rest. Access is limited to the people who need it to run the service. Credentials are stored encrypted and are never written to logs.
No system is perfectly secure. Where a breach is likely to result in a risk to your rights we will notify you and the relevant supervisory authority within the time the law requires, and we will notify Discord of any unauthorised access to data obtained through their API.
The dashboard sets cookies that are strictly necessary: one to keep you signed in and one to protect the sign-in against cross-site request forgery. We use no advertising cookies, no analytics cookies and no third-party trackers, so there is no consent banner because there is nothing to consent to.
Discord requires users to be at least 13, and older where local law sets a higher age. TicketToolX is not directed at anyone below that age and we do not knowingly collect their personal data. If you believe a child has provided us data, email privacy@claritya.com and we will delete it.
Providing your Discord identifiers is a contractual necessity: the service cannot create a ticket for you or sign you in without knowing who you are, so if you do not provide them we cannot provide the service. Everything else, including your email address and every optional integration, is genuinely optional and refusing costs you nothing but that feature.
The dashboard and ticket messages may link to sites we do not control. This policy does not cover them, and we are not responsible for their practices.
We may update this policy. Material changes are announced in the dashboard and the date at the top changes. We review this policy at least annually whether or not anything has changed, so the date at the top is always meaningful.