Frostbite
Frostbite Data Processing Agreement
Last updated 2026-10-07
This Data Processing Agreement ("DPA") supplements the Frostbite Terms of Service and Privacy Policy and governs the processing of personal data by Frostbite on behalf of Discord server owners ("Controllers").
1. Parties
This Agreement is entered into between:
- The Controller: The Discord server owner or administrator using Frostbite.
- The Processor: Frostbite and its developer ("Processor").
2. Purpose
The Processor processes personal data solely for the purpose of providing moderation, automation, logging, reporting, and community management functionality requested by the Controller. This includes measuring and improving the accuracy of Frostbite's scam detection, as described under Message Classification in the Privacy Policy.
The Processor shall not process personal data for advertising, profiling, or unrelated commercial purposes.
3. Categories of Personal Data
Depending on enabled features, Frostbite may process:
- Discord User IDs
- Guild IDs
- Channel IDs
- Role IDs
- Message IDs
- Usernames and display names
- Message content
- Uploaded attachments
- OCR results
- Image hashes
- Moderation history
- Reports
- Configuration data
- Audit logs
4. Categories of Data Subjects
Personal data may relate to:
- Server owners
- Administrators
- Moderators
- Members
- Individuals interacting with Frostbite
5. Processing Activities
Processing may include:
- Collection
- Storage
- Retrieval
- Analysis
- Automated moderation
- Scam detection
- Automated message classification
- OCR processing
- Image hashing
- Reporting
- Logging
- Deletion
6. Instructions
The Processor shall process personal data only:
- As instructed by the Controller through Frostbite's configuration.
- As necessary to provide Frostbite's services.
- As required by applicable law.
7. Confidentiality
The Processor shall ensure that individuals with access to personal data are bound by appropriate confidentiality obligations.
8. Security Measures
Reasonable technical and organizational measures are implemented to protect personal data, including:
- Access controls
- Authentication mechanisms
- Encryption where appropriate
- Infrastructure monitoring
- Regular software updates
No security system is infallible, and absolute security cannot be guaranteed.
9. Subprocessors
The Processor may engage subprocessors necessary to operate Frostbite, including:
- Hosting providers
- Database providers
- Content delivery networks
- Discord
- OCR providers
- Translation providers
- AI service providers, to help review stored message samples
The Processor remains responsible for ensuring subprocessors provide appropriate safeguards.
10. International Transfers
Where personal data is transferred internationally, reasonable safeguards will be implemented where required by applicable law.
11. Data Retention
Personal data shall be retained only for as long as necessary to:
- Operate Frostbite
- Provide moderation functionality
- Maintain server configuration
- Resolve abuse reports
- Comply with legal obligations
Message text stored to test the scam classifier is deleted after 30 days.
Data no longer required will be deleted or anonymized where reasonably practicable.
12. Data Subject Requests
Where the Processor receives a request relating to access, correction, deletion, portability, or restriction of processing, the Processor will make reasonable efforts to assist the Controller where applicable.
Requests may be submitted to:
13. Personal Data Breaches
If the Processor becomes aware of a confirmed personal data breach affecting stored personal data, reasonable efforts will be made to notify affected Controllers without undue delay where required by applicable law.
14. Audit Rights
Due to the shared nature of the service, individual security audits are not permitted.
Reasonable information regarding security practices may be provided upon legitimate request.
15. Termination
Upon termination of the Controller's use of Frostbite, personal data shall be deleted or anonymized within a reasonable period unless retention is required by law or necessary for security, fraud prevention, or abuse investigations.
16. Contact
Questions regarding this Agreement or data processing practices should be directed to: