This Privacy Policy explains how Billo Chhetri ("DMALL", "we", "us", or "our") handles personal data when you use the DMALL OAuth2 application (the "OAuth2 App") and the DMALL service at dmall.tech (together, the "Service").
The OAuth2 App is the Discord application used to sign you in and verify which Discord servers you own or manage. It is separate from the DMALL sender bots that deliver broadcasts. The OAuth2 App does not join your server, send messages, read your direct messages, or request access to message content.
1. Scope
This policy applies to the OAuth2 App, the DMALL website and API, the console, and support communications. It does not apply to Discord itself or to third-party websites and services. Discord's own privacy policy governs Discord's processing of your account and messages.
The OAuth2 App is not a bot installation. When you authorize it, Discord asks you to approve the identify and guilds scopes. We do not request email, connections, guilds.join, bot, or any message-related scope.
2. Data we collect
Discord account data
When you sign in, Discord provides your Discord user ID, username, global display name, and avatar. We use this to create and identify your DMALL account, display your session, and associate actions with the correct account. We do not receive your Discord password, email address, phone number, payment card details, or private messages through the OAuth2 App.
Server access data
With the guilds scope, Discord provides a list of servers you belong to, including each server's ID, name, icon, whether you are the owner, and your computed permissions. We use this list to determine which servers you own or can manage, populate the server picker, and enforce access to server workspaces. We store a snapshot of this list so the console can load without asking Discord for a fresh list on every request. A fresh snapshot replaces the previous one when you sign in or refresh it.
OAuth tokens
We exchange the Discord authorization code for an access token and, where provided, a refresh token. These tokens are stored server-side, are never returned to your browser, and are used only to request your current Discord identity and server list. You can revoke the OAuth2 App at any time in Discord under User Settings → Authorized Apps.
Session and technical data
We use a short-lived OAuth state value during sign-in and an HttpOnly session cookie to keep you signed in. We may also record request IDs, timestamps, routes, actor IDs, user-agent strings, and truncated or hashed IP addresses in security and audit logs. We use this information to operate the Service, prevent abuse, investigate errors, and maintain an audit trail for sensitive actions.
Service and broadcast data
When you use the broadcast features, we process the server and channel information you select, templates and message content you create, targeting and exclusion settings, run and delivery status, sender-bot records, wallet and ledger entries where applicable, and related audit records. Sender bots may access the member list and presence information of a server in which they are installed in order to build the audience you requested and deliver your messages. We do not use the OAuth2 App to read message content.
Support communications
If you contact us, we receive the information you choose to provide, such as your Discord username, the issue, and any attachments. We use it to respond and keep a record of the support request.
3. How we use data
- Authenticate you and maintain your session.
- Verify server ownership or management permissions and enforce workspace access.
- Provide the console, templates, broadcasts, delivery records, wallet, and sender-bot features.
- Protect the Service, prevent spam and abuse, enforce rate limits, and investigate security events.
- Debug errors, maintain reliability, and provide support.
- Comply with legal obligations and enforce our Terms of Service.
We do not sell your personal data. We do not use OAuth2 data for advertising, and we do not use third-party advertising or cross-site tracking cookies.
4. Legal bases (EEA and UK)
Where the General Data Protection Regulation or UK GDPR applies, we rely on: performance of a contract (providing the Service you request); our legitimate interests (security, abuse prevention, service integrity, and support); consent where we specifically ask for it; and legal obligation where applicable. You may object to processing based on legitimate interests, subject to our compelling legitimate grounds.
5. Cookies and similar technologies
We use a session cookie to keep you signed in and a short-lived OAuth state cookie to protect the sign-in flow. These cookies are necessary for the Service. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics cookies. You can clear cookies in your browser, but doing so will sign you out.
6. How we share data
We share personal data only as needed to operate the Service:
- Discord, to authenticate you, retrieve your identity and server list, and deliver messages and bot actions you request. Discord processes data under its own privacy policy.
- Infrastructure providers, such as hosting, database, logging, and support providers, under contracts that restrict their use of the data.
- Our personnel and contractors, where they need access to operate, secure, or support the Service, subject to confidentiality obligations.
- Legal and safety disclosures, when required by law or necessary to protect rights, safety, and security, or to investigate fraud or abuse.
- Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.
We do not sell or rent personal data.
7. International transfers
The Service and its providers may process data in countries other than yours. Where required, we use appropriate safeguards for international transfers, such as standard contractual clauses or an adequacy decision. You can contact us for more information about the safeguards used.
8. Retention
We keep account and server-access data while your account is active and as needed to provide the Service. Server snapshots are replaced when refreshed. OAuth tokens are retained only while needed to refresh your Discord data or as required for security and legal purposes. Broadcast, delivery, wallet, and audit records are retained as needed to operate the Service, resolve disputes, prevent abuse, and meet legal, tax, or accounting requirements. Security logs are retained only as long as reasonably necessary for those purposes.
If you request deletion, we will delete or anonymize the relevant data within 30 days unless we are required or permitted by law to retain it, or unless it is needed to investigate an ongoing security or abuse issue. Some records may remain in backups for a limited period before being overwritten.
9. Security
We use HTTPS, restrict access to production systems and stored credentials, keep OAuth tokens server-side, and maintain audit records for sensitive actions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account or a token has been compromised, contact us immediately.
10. Your rights and choices
Depending on your location, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to receive a portable copy, and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local data protection authority. If you are in Nepal, you may also have rights under applicable Nepalese privacy law.
To exercise these rights, contact us at [email protected]. We may need to verify that you control the relevant Discord account before acting on a request. You can revoke the OAuth2 App at any time in Discord under User Settings → Authorized Apps; revocation stops future OAuth access but does not automatically delete data already stored by DMALL. The console's global message block stops broadcasts to your account but does not delete your data.
If you are a California resident, you have the right to know, delete, and correct personal information, and to be free from discrimination for exercising those rights. We do not sell personal information or share it for cross-context behavioral advertising.
11. Children
The Service is not directed to children under 13, or under the minimum age required to use Discord or to consent to data processing in your country, whichever is higher. If you are below the age of majority where you live, you may use the Service only with the involvement of a parent or guardian. If we learn that we have collected data from a child who is not permitted to use the Service, we will take reasonable steps to delete it.
12. Changes to this policy
We may update this policy to reflect changes to the Service, legal requirements, or our practices. We will post the updated policy on this page and change the effective date. If a change is material, we will provide reasonable notice before it takes effect where required by law.
13. Contact
Billo Chhetri
Sangam Chowk, Ward No. 4
Birtamod Municipality, Jhapa, Nepal
Email: [email protected]
Phone: +977 9746612184