법적 고지
개인정보 처리방침
2026년 9월 24일 업데이트
- 연동 정보는 AES-256으로 암호화해요
- 비밀번호는 받지 않아요
- 요청하면 바로 완전히 지워요
Article 1 (Personal Information Collected and Collection Methods)
Nix (hereinafter "Service Provider") lawfully collects and processes the minimum personal information necessary for the performance of service agreements or with the consent of the data subject, pursuant to Articles 15 and 16 of the Personal Information Protection Act (PIPA).
🔒 Minimum Collection Principle: Nix does not collect any unnecessary personal identifying information (real name, national ID, contact information, etc.) beyond the Discord identifiers and encrypted sessions essential for service operation.
| Category | Source | Items Collected | Purpose |
|---|---|---|---|
| Core Bot Service | Discord API | User IDServer IDChannel IDRole IDMessage ID | User and server identification, command permission checks, per-server configuration storage, and core feature delivery |
| Anonymous Community (Bamboo Forest) | User modal / file input | Story body textAttachment URL/filenameSpoiler flagAnonymous hash saltUser ID/tag (admin audit log) | Publishing anonymous stories and files to the Bamboo Forest channel, preventing duplicate reaction votes, and recording a private admin audit log to prevent misuse of anonymity (obscene content, defamation, terrorism, etc.) |
| 1:1 Support Ticket | User conversation input | User IDTicket channel IDFull conversation transcript | Providing private 1:1 consultation with server staff and backing up conversation transcripts upon ticket closure for dispute prevention |
| Chat Leveling & Ranking | Automatic chat activity tracking | User IDExperience Points (XP)LevelServer Rank | Calculating level based on chat activity, displaying leaderboard rankings, and automatically awarding role rewards upon reaching target levels |
| Real-time Alerts & Utilities | User settings and input | Stream channel / creator IDGame discount filter settingsPrivate memoReminder message & schedule | Sending live stream and new video notifications (CHZZK/SOOP/YouTube), delivering game discount alerts, storing/retrieving personal memos, and sending scheduled reminders |
| Valorant Shop Integration (Optional) | User direct input | Discord User IDEncrypted session cookie (ssid)Riot PUUIDService regionSkin wishlist settings | Viewing daily Valorant shop, Night Market, and owned currency (VP/RP), and sending DM alerts when wishlisted skins appear in the store |
| Web Dashboard | Discord OAuth2 | User IDUsernameProfile avatar URLGuild ID & admin permissionsEmail (optional, with consent) | Web dashboard login authentication, server admin permission verification, and inquiry replies |
| Operations & Security Logs | Automatically generated | Access IPUser-AgentCommand execution historyError logs | Detecting fraudulent use and abnormal traffic, analyzing system errors, and maintaining service security |
No Password Storage Principle
The Riot account password entered by users for Valorant login is never stored on servers or in databases. The password is used solely for a one-time communication with Riot's authentication server to issue tokens and is permanently erased from memory immediately upon completion of token exchange.
Collection Method Summary
- Discord OAuth2 Integration: Automatically provided through Discord's official authentication upon web dashboard login.
- Discord Command Interaction: Collected by entering bot commands or directly inputting into buttons or modal windows.
- Web Browser Cookies: Generated upon website visits for language (
lang), theme (theme), and session maintenance.
Article 2 (Purposes of Use of Personal Information)
The Service Provider uses collected personal information solely for the following purposes. If the purpose changes, prior consent will be sought pursuant to Article 18 of PIPA.
- Member Identification & Core Features: Discord user identification, server management features (pooling, CAPTCHA verification, auto voice channel creation, slow mode, embeds, etc.), and entertainment points (wallet) and mini-game data management
- Anonymous Community (Bamboo Forest) Operations: Assigning random dynamic identifiers, posting anonymous stories, files, and spoilers to the Bamboo Forest channel, preventing duplicate reaction votes, and recording a private admin audit log to prevent anonymity abuse (obscene content, defamation, etc.)
- 1:1 Support Ticket Consultation: Opening a private consultation channel between server staff and users, handling inquiries, and backing up conversation transcripts upon ticket closure for dispute prevention
- Chat Leveling & Activity Ranking: Calculating experience points (XP) based on server chat participation, leveling, displaying server leaderboard rankings, and automatically awarding role rewards upon reaching target levels
- Live Stream & Game Discount Alerts: Sending live stream and new video upload notifications for CHZZK, SOOP, and YouTube, and delivering personalized game discount and free giveaway alerts by platform
- Valorant Shop & Skin Alerts: Viewing daily 4-item rotation shop, Night Market deals, owned VP/RP balance, and sending Discord DM alerts when wishlisted skins appear in store
- Server Settings & Configuration: Storing per-guild module on/off settings, autorole, and welcome/leave message configurations
- Service Safety & Security: Blocking abuse, macros, and system breach attempts, and sanctioning illegal actors (blacklist management)
- Customer Support & Inquiry Handling: Accepting bug reports and rights infringement reports and informing of processing results
Article 3 (Retention and Use Period of Personal Information)
The Service Provider in principle destroys personal information without delay after the purpose of collection and use has been achieved. However, the following retention periods apply pursuant to applicable laws and operational policies.
| Category | Items Retained | Retention Period | Legal Basis |
|---|---|---|---|
| Basic Account & Settings | Discord ID, per-server settings | Until termination of service agreement (withdrawal / bot removal) | Performance of service agreement |
| Bamboo Forest Stories & Audit Logs | Story body, attachment links, audit log (author ID/tag) | Upon story post deletion or per server admin retention policy | Community safety and policy violation monitoring |
| Ticket Conversation Transcripts | Full ticket conversation (transcript text) | Per server admin retention policy after ticket closure | Customer dispute resolution and history preservation |
| Chat Leveling Data | User ID, per-server XP, level | Until service withdrawal or server admin resets level | Server activity ranking and reward maintenance |
| Personal Memos & Reminders | Memo text, reminder message & schedule | Permanently destroyed upon user deletion or immediately upon delivery | Immediate destruction upon data subject request |
| Valorant Linked Account | Encrypted session cookie, PUUID, region | Immediately destroyed upon unlinking (/발로상점 로그아웃) | Immediate destruction upon data subject request |
| Skin Wishlist Alerts | Registered skin UUID and skin name | Immediately destroyed upon alert deletion (/발로상점 알림삭제) or account logout | Immediate destruction upon data subject request |
| Server Settings Recovery Data | Settings backup of removed servers | 30 days from the date of server removal | Convenience restoration upon re-invitation |
| Service Access Logs | IP address, time records | 3 months | Protection of Communications Secrets Act |
| Fraud Sanction Records | User ID, reason for sanction | 1 year | Service abuse prevention and re-registration restriction |
| Inquiry & Dispute Resolution Records | Inquiry records and action results | 3 years | Act on Consumer Protection in Electronic Commerce |
Article 4 (Third-Party Disclosure of Personal Information)
The Service Provider does not provide personal information to external parties without the consent of the data subject. However, the following exceptions apply.
- When separate consent has been obtained from the data subject
- When there is a special provision in law or when unavoidable for compliance with statutory obligations
- When investigative agencies request information for investigation purposes by presenting a warrant or other legal process as prescribed by law
Article 5 (Entrustment of Personal Information Processing)
The Service Provider entrusts personal information processing to the following specialized companies for stable infrastructure operation, and implements security measures and supervision pursuant to Article 26 of PIPA in entrustment contracts.
| Processor | Entrusted Tasks |
|---|---|
| Discord Inc. | Bot interaction communication, user authentication, DM and message delivery infrastructure |
| Supabase Inc. | Cloud database hosting and encrypted user data storage |
| Vercel Inc. | Website and web dashboard hosting infrastructure |
| Cloudflare Inc. | DDoS protection, security firewall, and global network traffic optimization |
| EmailJS | Web customer support inquiry email relay |
Article 6 (Cross-border Transfer of Personal Information)
Due to the use of global cloud, Discord, and Riot Games API environments, personal information may be transferred overseas as follows.
| Recipient | Country | Items Transferred | Purpose & Method | Retention Period |
|---|---|---|---|---|
| Discord Inc. | United States | Discord ID, interaction commands, messages | Real-time communication via API calls | Per Discord policy |
| Riot Games, Inc. | United States | Riot auth tokens, PUUID, region | Valorant shop and wallet information retrieval (HTTPS) | Per Riot Games policy |
| Supabase Inc. | USA, etc. | Encrypted session data, server settings | Real-time cloud DB transmission and storage | Same as Article 3 retention period |
| Vercel Inc. | USA, etc. | Access IP, request logs | HTTPS web request processing | Up to 3 months |
Refusing Cross-border Transfer
Users may refuse cross-border transfer of personal information. In this case, you may terminate the service agreement or stop the integration through the relevant feature (e.g., /발로상점 로그아웃).
Article 7 (Destruction Procedures and Methods for Personal Information)
Immediate Hard Delete of Valorant Linked Account
When a user executes the /발로상점 로그아웃 command, the encrypted session cookie, PUUID, region settings, and all skin alert wishlists stored in the database are processed as an immediate permanent hard delete (not a soft delete), leaving no residual information whatsoever.
① The Service Provider permanently destroys personal information without delay (in principle within 5 days) when it becomes unnecessary due to expiration of the retention period or achievement of the processing purpose.
② Personal information recorded and stored in the form of electronic files is safely deleted by applying technical methods (permanent deletion of database records and destruction of encryption keys) that render recovery and regeneration impossible.
③ In particular, for Valorant integration information, executing the /발로상점 로그아웃 command immediately and permanently deletes (Hard Delete) the database record, leaving no residual information.
Article 8 (Rights and Obligations of Data Subjects and Legal Representatives and Exercise Methods)
① Data subjects may at any time exercise the following rights against the Service Provider: the right to request access to personal information, request for correction of errors, request for deletion, and request for suspension of processing.
② Rights may be exercised by submitting a written or electronic request via the website Contact or the official Discord support channel. The Service Provider will take action without delay (within 10 days) after verifying the identity of the data subject.
③ For Valorant integration data, users can directly exercise immediate access blocking and permanent deletion by executing the /발로상점 로그아웃 command.
Article 9 (Security Measures for Personal Information)
Military-grade Encryption (AES-256-GCM) Applied
Valorant session tokens are securely encrypted and stored using AES-256-GCM, an algorithm supporting integrity verification based on authentication tags (Auth Tags), so any unauthorized tampering or exfiltration attempts result in immediate decryption refusal.
The Service Provider implements the following technical, administrative, and physical security measures to prevent loss, theft, leakage, falsification, alteration, or damage to personal information, pursuant to Article 29 of PIPA.
- High-strength Data Encryption (AES-256-GCM): Sensitive authentication information such as users' Riot session identifiers (cookies) is securely encrypted and stored using AES-256-GCM, an industry-standard high-strength symmetric-key encryption algorithm.
- No Password Storage Principle: User account passwords are never recorded or stored on servers and are immediately destroyed from memory after one-time authentication.
- Transmission Encryption: All network communications with Discord and Riot Games are transmitted via TLS 1.3 and HTTPS encryption protocols.
- Ephemeral Interaction Processing: Discord responses containing sensitive information, such as shop lookups and login modals, are protected by applying the Ephemeral message flag, which makes them visible only to the requesting user and prevents exposure to others.
- Minimal Access Rights & Control: Database and server access rights are restricted to a very small number of administrators, with mandatory two-factor authentication (2FA) applied.
⚠️ Honest and Transparent Notice Regarding Technical Limitations of Security
Nix applies strict security measures such as immediate password memory erasure, AES-256-GCM session encryption, and TLS transport encryption to protect users' personal information.
However, due to the nature of all existing internet and cloud environments, it is technically impossible to absolutely guarantee 100% perfect integrity or invulnerability from breach. Should the Service Provider face unexpected external breaches, zero-day vulnerabilities, or force majeure network events, it will immediately notify the relevant facts and faithfully implement emergency security measures and incident response procedures pursuant to applicable laws.
Article 10 (Operation and Refusal of Cookies and Automated Collection Devices)
① The Service Provider uses web browser cookies (Cookie) to enhance the convenience of web dashboard users.
② Cookies are used for maintaining login sessions, saving multilingual selection (lang) and theme settings (theme), and third-party tracking cookies for marketing or customized advertising profiling are not used whatsoever.
③ Users may specify whether to allow cookies or delete existing cookies through web browser option settings.
Article 11 (Personal Information Processing Related to Music, Voice, and Temporary Voice Channels)
No Voice Recording Principle
In voice channels and temporary voice rooms, the bot is solely responsible for outputting (playing) the audio stream and does not collect, listen to, record, or analyze users' microphone audio.
① When using the music feature (/음악), only the text metadata essential for feature implementation—such as the requested song title, search keywords, playback queue, and requester ID—is processed, and voice conversation content is never collected under any circumstances.
② In personal voice channels opened through the temporary voice room auto-generator (/통화방설정), users' microphone voice conversations are also not recorded or stored, and when all participants have left the room, the channel is immediately automatically deleted (destroyed) with no residual data.
Article 12 (Personal Information of Children Under 14)
This Service does not target children under 14as users, in accordance with Article 22-2 of PIPA, and does not intentionally collect children's personal information. If the Service Provider becomes aware that personal information of a child under 14 has been collected, it will promptly destroy the relevant account and data.
Article 13 (Privacy Officer and Contact)
A privacy officer has been designated as follows to handle inquiries, complaints, and remedies related to personal information processing.
- Privacy Officer
- Moka (Nix Project Lead)
- Official Contact Channel
- Website Contact or official Discord support server
- Contact Email
- admin@nixbot.xyz
- Response Deadline
- In principle within 48 hours of receipt (business days)
Article 14 (Remedies for Rights Infringement)
Data subjects may apply for dispute resolution or consultation at the following agencies to receive remedies for personal information infringement.
| Agency | Phone Number | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Personal Information Infringement Report Center (KISA) | 118 (no area code) | privacy.kisa.or.kr |
| Supreme Prosecutors' Office Cyber Investigation Division | 1301 (no area code) | www.spo.go.kr |
| National Police Agency Cyber Bureau | 182 (no area code) | ecrm.police.go.kr |
Article 15 (Compliance with Applicable Laws)
This policy was established in strict compliance with the Republic of Korea's Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, Protection of Communications Secrets Act, Act on Consumer Protection in Electronic Commerce, and related guidelines.
Article 16 (Changes to the Privacy Policy)
This policy may be revised due to legislative amendments, government guideline changes, or service feature additions/modifications. When revised, notice will be provided through website announcements at least 7 days before the effective date (30 days for significant changes to data subjects' rights).