1. Parties and incorporation
This Data Processing Agreement (“DPA”) is between the person or organization that connects a Discord server (“Customer”) and Felix Nagel, trading as Cordlytics (“Cordlytics”). It forms part of the Terms of Service. Connecting a server constitutes acceptance of this DPA by the Customer.
2. Roles and instructions
For covered Discord community data, Customer is the controller and Cordlytics is the processor. Customer instructs Cordlytics to collect and analyze selected public discussions, identify content opportunities, retain summaries and supporting examples, and perform approved YouTube research. The Terms, workspace configuration, and Customer's use of product controls are documented instructions.
Cordlytics will process community data only on those instructions, unless applicable law requires otherwise. If an instruction appears to infringe data-protection law, Cordlytics will inform Customer to the extent legally permitted.
3. Customer responsibilities
Customer confirms that it is authorized to administer each connected server and configure the selected coverage scope. Customer is responsible for the lawfulness of its instructions, its legal basis, and any transparency or rights obligations it has toward community members. Customer must not intentionally configure channels principally intended for private support, moderation, medical disclosures, individualized financial records or advice, or other sensitive personal information.
4. Confidentiality and security
Cordlytics restricts access to people and service providers who need it to operate the service and who are bound by appropriate confidentiality obligations. Cordlytics maintains technical and organizational measures appropriate to the processing risk, including encryption in transit, protected credentials, restricted access to workspace data, pseudonymous participant identifiers specific to each server, limited raw-data retention, and procedures for completing data deletion.
5. Subprocessors
Customer gives general authorization for Cordlytics to use the subprocessors on the service-provider page. Cordlytics will impose data-protection obligations appropriate to each service and remains responsible for its subprocessors as required by applicable law. Cordlytics will provide reasonable advance notice of a material new subprocessor through that page or the service.
Customer may object on reasonable data-protection grounds by emailing felix@cordlytics.com. The parties will work in good faith on a reasonable alternative. If there is none, Customer may stop the affected processing by disconnecting or deleting the workspace.
6. International transfers
Where processing involves a restricted international transfer, Cordlytics will use an applicable adequacy decision, the EU Standard Contractual Clauses, or another lawful transfer mechanism. If Customer is a controller in the EEA and Cordlytics' use of a subprocessor requires the Standard Contractual Clauses, the controller-to-processor module applies as incorporated in that provider's agreement.
7. Assistance and incidents
Taking account of the nature of the processing, Cordlytics will reasonably assist Customer with data-subject requests, security obligations, breach notifications, impact assessments, and regulator consultations required by data-protection law. Cordlytics will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer's covered community data and provide information reasonably available for Customer's response.
8. Return and deletion
Raw Discord messages and temporary collection records stored by Cordlytics are deleted within 14 days. Workspace deletion stops new collection and starts the removal of the workspace's data, including saved reports, research, Content Plans, and raw community data. On termination or Customer's documented request, Cordlytics will delete or return Customer personal data as required by law, unless retention is legally required. Provider backup and security copies expire through their normal retention cycles.
9. Information and audit
Cordlytics will make information reasonably necessary to demonstrate compliance with Article 28 GDPR available to Customer. Customer will first use current policies, provider reports, and written answers. If those are insufficient and applicable law requires more, the parties will agree on a proportionate audit that protects other customers, confidential information, and service security.
10. Processing details
- Subject and purpose: operating Cordlytics for the connected workspace, including community analysis, content research, and creator-directed content planning.
- Duration: while the workspace is connected and for the retention periods described above and in the Privacy Policy.
- Data subjects: members posting in configured public Discord channels and Customer's authorized workspace users.
- Data: message content, message and channel IDs, timestamps, server information, pseudonymous participant identifiers, selected channels, and summaries, aggregate information, or paraphrased examples derived from those discussions.
- Sensitive data: not intentionally requested. Customer must not configure channels principally intended for private support, moderation, medical disclosures, individualized financial records or advice, or other sensitive personal information.
11. Order of terms
If this DPA conflicts with the Terms on the processing of covered community personal data, this DPA controls. Otherwise, the Terms remain in effect. This DPA ends when Cordlytics has completed the applicable deletion and retention obligations for the workspace.