PRIVACY POLICY

1. Introduction

Community Juice LTD (trading as “Community Studios”, “we”, “us”, or “our”) operates the CEEJAY platform, a Discord analytics and community relationship management service. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our services.

We are registered with the Information Commissioner's Office (ICO) in the United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Registered Company: Community Juice LTD
Trading As: Community Studios
Jurisdiction: England & Wales, United Kingdom
Contact: privacy@communitystudios.xyz

2. Definitions

• Data Controller: Our customers (Discord server owners/administrators) who determine the purposes and means of processing their community members' data.
• Data Processor: Community Juice LTD, which processes personal data on behalf of our customers.
• Data Subjects: Discord community members whose personal data is processed through our services.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Dashboard Users: Our B2B customers who access the CEEJAY dashboard.

3. Data We Collect

3.1 From Dashboard Users (Our Customers)

• Discord OAuth profile information (username, email address, avatar)
• Authentication tokens and session data
• Server configuration preferences
• Login timestamps and dashboard usage analytics

3.2 From Discord Community Members (via Bot)

When a server administrator adds CEEJAY to their Discord server, we collect:

• Discord user ID (snowflake identifier)
• Username and display name
• Message metadata (channel, timestamp, word count)
• Message content, which we store for as long as CEEJAY is in the server, together with the sentiment, topics and summaries we derive from it
• Voice channel activity (join/leave times, duration)
• Server membership events (join date, leave date)
• Role assignments
• Reaction data
• Activity information from Discord presence (the game, application or media a member is using, when, and for how long)

3.3 Automatically Collected Data

• Website analytics via Google Analytics (anonymised, IP anonymisation enabled, consent required)
• Dashboard usage analytics via PostHog (anonymised, EU-hosted)
• Browser type and device information (anonymised)
• Page views and feature usage patterns

4. How We Collect Data

• Discord Bot API: Our bot collects data from Discord servers where it has been authorised by a server administrator.
• Discord OAuth: Dashboard users authenticate via Discord's OAuth 2.0 flow.
• PostHog Analytics: Dashboard usage is tracked via PostHog (EU-hosted at eu.posthog.com) with privacy-preserving defaults including text masking and input masking.
• Google Analytics: Website traffic and conversion tracking via Google Analytics 4 with IP anonymisation and Consent Mode v2 enabled. No cookies are set until the user provides consent.

5. Purpose and Legal Basis

We process personal data under the following lawful bases (UK GDPR Article 6):

6. Marketing Communications

• We may send service-related emails (such as billing notifications, security alerts, and feature updates) without separate consent, as they are necessary for contract performance.
• Marketing and promotional communications are only sent with your explicit consent.
• You can unsubscribe from marketing communications at any time via the unsubscribe link included in every marketing email.

7. Discord-Specific Data Handling

CEEJAY operates as a Discord bot under Discord's Developer Terms of Service. We only collect data from servers where an administrator has added our bot. The bot reads messages, member events, voice activity, reactions and presence (activity) updates for that server only.

If you are a member of a Discord server that uses CEEJAY: the administrator of that server is the data controller and CEEJAY processes your data on their behalf. Everything we hold about you is only ever shown to that server's administrators. We do not combine your data across servers, sell it, or use it for advertising. Administrators choose which channels are sent for sentiment analysis (this is off for every channel until they turn it on) and can hide channels from analytics.

We store message content in full, together with the sentiment, topics and summaries we derive from it, so that administrators can see what their community is discussing over time. We keep it for as long as CEEJAY is in the server and delete it 30 days after the bot is removed. You can ask us to delete your data at any time (see section 12).

8. AI and Automated Processing

We use large language models to provide sentiment analysis, topic detection, summaries, an AI assistant for administrators, and search within the CEEJAY platform.

• Message content is sent to Anthropic (Claude models) for analysis and to Voyage AI for search embeddings. Both are used through their APIs under commercial terms that prohibit them from training models on our data. Voyage AI's training opt-out is in force.
• We do not use your data to train AI models, and our AI providers are contractually prohibited from doing so.
• AI results are stored per server and shown only to the administrators of the server the data came from. Content from one server is never used to produce results for another.
• AI results are analytics for administrators. They are not used to make decisions that have legal or similarly significant effects on any member.

9. Data Retention

When CEEJAY is removed from a server, we keep that server's data for 30 days so that an administrator who removed the bot by mistake or is moving servers can reinstall it without losing history. After 30 days it is permanently deleted from our systems. A member can ask us to delete their own data sooner at any time (see section 12).

10. Third-Party Sub-Processors

We use the following sub-processors to deliver our services. This list mirrors the sub-processor schedule in our customer Data Processing Agreement.

Processors that handle community data from Discord

• Railway Corp. (US) — hosting for the bot, the dashboard and our primary database (PostgreSQL). SOC 2 Type II.
• Supabase, Inc. (US) — dashboard authentication and user accounts. SOC 2 Type II.
• Anthropic PBC (US) — sentiment, topic and summary generation via API; not used for model training.
• Voyage AI, Inc. (US) — search embeddings via API; not used for model training.
• Resend, Inc. (US) — transactional email, including emailed reports.
• PostHog, Inc. (EU-hosted) — product analytics for the dashboard, with text and input masking.
• Neo4j, Inc. (US/EU) — graph database for the Conversation Map (identifiers and topics; no message text).
• Redis (hosted with Railway) — short-lived caching of dashboard responses.

Services we use for the website and our own business only

These do not receive community data.

• Google LLC (US) — website analytics (Google Analytics 4, consent-based, IP anonymisation).
• Cloudinary Ltd. (US) — image hosting for bot avatars and uploaded media.

Platform

Discord Inc. (US) is the platform CEEJAY runs on. Discord is an independent controller of the data it holds under its own privacy policy; we access it under Discord's Developer Terms.

Each sub-processor is bound by data-processing terms with Community Juice LTD. Where a server administrator connects an optional integration (GitHub, Jira, ClickUp, Slack, YouTube, X or Twitch), data is sent to that service at the administrator's instruction under that service's own terms. We will update this list when we add or change a sub-processor. Questions: privacy@communitystudios.xyz.

11. International Data Transfers

Some of our sub-processors are located in the United States. Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the ICO, and Transfer Impact Assessments (TIAs) where required.

12. Your Rights

Under UK GDPR, data subjects have the following rights:

• Right of Access (Article 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): Request correction of inaccurate personal data.
• Right to Erasure (Article 17): Request deletion of your personal data.
• Right to Restrict Processing (Article 18): Request that we limit how we process your data.
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format.
• Right to Object (Article 21): Object to our processing of your personal data.

To exercise any of these rights, please submit a request via our Data Subject Access Request form or email us at privacy@communitystudios.xyz. We will respond within 30 days as required by UK GDPR.

Note for Discord community members: As we act as a Data Processor on behalf of your server administrator (the Data Controller), we may direct your request to the relevant server administrator where appropriate. We will verify your identity via Discord DM before processing any request.

How to ask: submit a request at communitystudios.xyz/data-request or email privacy@communitystudios.xyz with your Discord username and the server name. We verify identity by Discord direct message. Deletion covers everything we hold about you in that server, including message content, activity sessions, ticket messages and form responses. We complete requests within 30 days.

13. Data Security

We implement appropriate technical and organisational measures to protect personal data:

• TLS encryption for all data in transit
• AES-256-GCM encryption for stored integration credentials and connected-account tokens
• Database encryption at rest
• Parameterised database queries to prevent SQL injection
• Content Security Policy (CSP) headers
• Server-scoped authorisation on all API endpoints
• Production logging sanitised to exclude sensitive data
• Product analytics configured with text masking and input masking enabled
• Website analytics configured with IP anonymisation and consent mode

14. Data Breach Notification

In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects:

• We will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33.
• Affected data controllers (our customers) will be notified without undue delay.
• Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, those individuals will be notified as required by UK GDPR Article 34.

15. Cookies

Our website uses analytics cookies (Google Analytics) with your consent, and our dashboard uses essential cookies for authentication and analytics cookies via PostHog. For full details, please see our Cookie Policy.

Our website does not currently respond to “Do Not Track” browser signals. However, we use consent-based analytics and no tracking cookies are set until you provide consent via our cookie banner.

16. Children's Privacy

Our services are not directed at individuals under the age of 13. Discord's own Terms of Service require users to be at least 13 years old. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify our customers of significant changes via email or dashboard notification. The “Last updated” date at the top of this page indicates when the policy was last revised.

18. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us:

Community Juice LTD
Trading as Community Studios
Email: privacy@communitystudios.xyz
Website: communitystudios.xyz

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.