MeinTicketbot
Sign in

Privacy policy

Last updated: 9 November 2026

This is a courtesy translation. Only the German version is legally binding.

1. Controller

MeinAppwerk
Inh. Thorsten Janßen
Kappelwindeckstr. 48
77815 Bühl
Email: kontakt@meinticketbot.de

2. Overview

MeinTicketbot is a ticket and support platform for Discord servers. We only process the data required for operation. We do not use any advertising services or third-party analytics services and we do not sell data. For visitor statistics we use our own method on our server (section 3).

For the data generated by the bot on a Discord server (tickets, forms, transcripts, ratings), the operator of the respective server is also responsible alongside us. They decide whether and how the bot is used there.

3. Visiting the website

When you access the website, the web server processes technically necessary data such as IP address, time, requested address and browser information. This serves secure operation. To protect against abuse, we also count requests per IP address for a short time. The legal basis is Art. 6 (1) (f) GDPR.

Visitor statistics. To see how the website is used, we count visits to the public pages ourselves on our server, without external services. For this we only use information your browser sends with the request anyway: the page requested, time, the domain of the referring website, the rough device type (desktop, smartphone, tablet) and the language. We do not store the IP address or the browser identifier. To count visitors rather than just page views, we create a hash from the IP address, browser identifier and a random daily value. The daily value is generated anew every day and then deleted, so a visitor can only be recognised within one day and cannot be traced back to a person. If your browser has “Do Not Track” enabled, we do not count you. The legal basis is our legitimate interest in measuring reach and improving the website (Art. 6 (1) (f) GDPR). We delete page views after 400 days.

If a link contains a source tag (for example ?quelle=topgg), we store it with the page view. It only tells us through which channel the link was shared and cannot be traced back to you.

Only if you choose “Accept all” in the cookie notice do we additionally set the statistics cookie mtb_vid with a random identifier. This lets us recognise returning visitors on later days, and an open page briefly reports every 30 seconds so that the live view is accurate. The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer.

Live demo. At demo.meinticketbot.de you can try the dashboard with sample data, without signing in and without Discord. The demo is a separate installation with its own database. For this we set the necessary session cookie mtb_session. To prevent abuse we limit starts per IP address and only store a hash of the address for at most one hour. Your demo server and everything you enter there are deleted automatically after two hours. None of it is sent to Discord. Please do not enter real personal data there. The legal basis is Art. 6(1)(f) GDPR.

4. Signing in with Discord

When you sign in with Discord, we receive the following with your consent via the identify and guilds scopes:

Of your servers, we only store those you are allowed to manage and the servers the bot is on. For each, we store the name, icon, ID and your permissions. On servers with the bot, the bot also checks your roles on that server to see whether you have a support role. We cache the result (yes or no) for 5 minutes. We also store the language you choose in the dashboard. We do not request your email address when you sign in. The legal basis is Art. 6 (1) (b) GDPR.

Two-factor authentication. If you turn it on voluntarily, we store the secret for your authenticator app encrypted, the time of setup, the last used time step (against reused codes) and your recovery codes only as a non-reversible hash. Your app generates the codes on your device, the QR code is created on our server without third-party services. When you turn it off, we delete this data. The legal basis is Art. 6 (1) (b) and (f) GDPR (protection of your account).

Customer roles on our Discord server. If you are a member of our own support server, the bot automatically assigns the role “Customer” there if you use MeinTicketbot on at least one of your servers, and “Premium customer” with an active Pro, Business or Enterprise plan. For this we match your Discord ID with this information and store the result and the time of the check. Anyone who confirms the rules on the support server via the button gets the role “Member” there. The legal basis is Art. 6 (1) (f) GDPR (recognising customers in support).

Android app. If you use our Android app, you sign in via Discord in your browser and confirm the connection. We then store an access token only as an irreversible hash, the device name, the time of setup and last use and, where notifications are possible, a device identifier for Firebase Cloud Messaging. On your device, the token is stored encrypted along with recently loaded server lists and tickets. Data on the device is deleted when you sign out or uninstall; the details held by us become invalid when you sign out or after 180 days without use. The legal basis is Art. 6(1)(b) GDPR.

Notifications in the app. For a new ticket we send the ticket number, server name, server ID and the creator's name to your device via Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to the USA in the process). You can turn this off at any time in the app or in the Android settings. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We do not use Google Analytics or advertising identifiers in the app.

5. Bot and tickets

When the bot is added to a server, we store the server’s ID, name, icon and owner ID as well as the bot’s permissions. This allows us to show the bot status and missing permissions.

When a server sets up tickets, we store the panels with their texts, options, channels, categories and support roles. When a member opens a ticket, we store:

When a team member opens a ticket in the dashboard, the bot loads the latest messages of the ticket channel directly from Discord and displays them without storing them for that purpose. For statistics, the bot reads the history of open tickets and only remembers the time of the first response, not the content. To prevent clicks from being processed twice, we store the ID of each Discord interaction for 24 hours.

The legal basis is the provision of the ticket service for the server (Art. 6 (1) (b) and (f) GDPR).

6. Transcripts

When a ticket is closed and before its channel is deleted, we store a transcript: the messages of the ticket channel with author, time, content and links to attachments. Only the managers and the team of the server can see transcripts in the dashboard. A manager can create a share link with an expiry date and revoke it at any time. Anyone who knows the link can read the transcript until it expires. Depending on the server’s plan, we automatically delete transcripts after 90, 365, 730 or 1,825 days.

7. Automations

Servers can set up rules, such as reminders on inactivity or automatic closing. For this, we regularly check the time of a ticket’s last activity. We log executed actions with ticket, rule, time and result.

Creator notifications. If a manager sets up notifications, we store the entered address, the name of the channel or feed, the Discord channel, the role and the text. Our server regularly queries the sources (YouTube, Twitch or the entered feed) and remembers which posts have already been announced. No member data is transmitted in the process.

Automatic assignment and business hours. If a server uses an “Assign round robin” rule, we pick the person with the fewest open tickets among the selected team members or everyone who has signed in to the dashboard at least once. Their name and Discord ID are then stored as the assignee of the ticket, and a notice about the assignment appears in the ticket. Business hours are stored as a server setting and contain no personal data.

Push notifications. If you enable them for a device in the dashboard and allow them in your browser, we store the delivery address of your browser’s push service, the associated keys, a rough device name and the servers you selected. For a new ticket we send a message with the ticket number, server name, creator’s name and a link to the dashboard. It is delivered end-to-end encrypted through your browser’s push service (depending on the browser, for example Google, Mozilla or Apple, including in the USA). The service sees the delivery address and the time, not the content. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the dashboard under “Account & security” or in your browser settings.

8. Ratings

If a server has enabled ratings, the bot sends the creator a direct message after closing. If the creator rates the ticket, we store the stars (1 to 5) and, if provided, their comment with the ticket. Managers of the server see ratings and comments in the statistics and can hide comments. Anyone who does not allow direct messages from the server will not receive a request. Rating is voluntary. The legal basis is Art. 6 (1) (f) GDPR, the server’s interest in the quality of its support.

9. Audit log

We store changes to panels, options, forms, rules, share links, plan and rating settings with the time, name and Discord ID of the person acting, as well as the state before and after. Managers of the server see the log in the dashboard. This keeps track of who changed what (Art. 6 (1) (f) GDPR).

10. Plans and payments

If a manager requests a plan, we store the server, the requested plan, name, Discord ID and the message, and send them to us by email.

If a manager books a paid plan, we forward them to the payment page of the chosen payment provider. You only enter payment details such as card or account numbers there; they do not reach us. We transmit the plan, the price, the server ID and your Discord ID so that the payment can be assigned to the right server. From the provider we receive the subscription ID, its status, the amount and the paid period. We store this information together with the server, plan and your Discord ID.

The payment providers process your payment data under their own responsibility, including for fraud prevention, and may transfer data to third countries in doing so. The legal basis is Art. 6 (1) (b) GDPR (contract) and, for retaining booking data, Art. 6 (1) (c) GDPR in conjunction with the retention obligations under tax and commercial law.

Cancellation. When cancelling a subscription you can voluntarily give a reason and a comment. We store them with the server, plan, payment provider and billing period, but without your Discord ID, to improve our service (Art. 6(1)(f) GDPR).

Coupons and referrals. If a server redeems a coupon or referral code, we store this with the server; for referrals also which server referred it and whether the reward was granted (Art. 6(1)(b) GDPR).

Voting on Top.gg. If the voting bonus is enabled and you vote for our bot on top.gg, Top.gg sends us your Discord ID, an identifier of the vote and its weight. We store this to credit bonus days to you and record whether and for which server you redeemed them (Art. 6(1)(b) GDPR). The privacy policy of Top.gg applies to the vote on top.gg itself.

Custom branding (Enterprise). If a manager on the Enterprise plan enters a name and a logo, we store both with the server and show them in transcripts, share links and the weekly report. We send the bot display name and profile picture to Discord for this purpose. Anyone opening a share link loads the logo from our server. When the plan ends, we reset the bot in Discord.

11. Cookies and local storage

We set necessary cookies without consent, because otherwise the website would not work as requested (§ 25 (2) no. 2 TDDDG). We only set the statistics cookie with your consent.

You can change your choice at any time via cookie settings. Your theme choice stays in your browser’s local storage and is not transmitted to us. The payment pages of Stripe and PayPal are subject to their own cookie rules.

12. Email and contact form

For system messages such as replies to contact requests, notices about plan requests or security notifications, we send emails via an SMTP server. If you contact us by email, we process your details to handle your request.

Via the contact form, we process your name, your email address, the chosen topic and your message in order to answer your request (Art. 6 (1) (b) GDPR for questions about a contract, otherwise Art. 6 (1) (f) GDPR, our interest in answering requests). The message is stored by us and forwarded by email to our mailbox. We do not store your IP address in the process. To protect against abuse, we briefly count requests per IP address. For this, we only store a hash of the address, which is deleted after two hours at the latest. We delete stored messages after 180 days, or earlier on request.

We may protect the contact form and internal sign-in pages against automated requests with Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When this protection is on, the page loads a script from Cloudflare; technical data such as your IP address and browser and device details are transmitted to Cloudflare and evaluated there to detect bots. We only receive the result of the check. The legal basis is our legitimate interest in protection against abuse and spam (Art. 6 (1) (f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. More information: Cloudflare privacy policy.

13. Recipients and transfers to third countries

Sign-in and the bot use the services of Discord Inc., USA. Data may be transferred to the USA in the process. Processing by Discord is governed by the Discord privacy policy. Profile pictures and server icons are loaded directly from Discord. For Stripe and PayPal, see section 10. We also use a hosting provider that processes the data on our behalf.

The entire website is delivered via the network of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) to protect it against attacks, encrypt the connection and deliver content quickly. In doing so, Cloudflare processes technical connection data such as IP address, requested address, time and browser details. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

14. Retention period

An email to the address above is sufficient for deletion. You can also revoke access at any time in your Discord settings under “Authorized Apps”.

15. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent given at any time with effect for the future. You can also lodge a complaint with a data protection supervisory authority.

16. Security

The connection to the website is encrypted. We store access tokens, payment provider credentials and other secrets encrypted. Messages from Stripe and PayPal to us are verified with a signature.

We back up the database daily and check each backup. To protect against data loss, a complete copy including database and transcripts is also transferred daily to a computer of the controller. Deleted data may remain in backups until the periods stated in section 14 have expired (Art. 6(1)(f) GDPR).