Sekure Privacy Policy

This Privacy Policy explains how Surf Online ("we", "us", or "our") processes personal data when you are a member of a Discord server where Sekure is installed or when you interact with Sekure.

Sekure is a trade name of Surf Online, a company registered in the Netherlands (KvK 42127201). For data processed to operate Sekure, Surf Online acts as the data controller. Server administrators configure security rules; they may also have independent obligations to their communities under applicable law.

Depending on server configuration, we may process:

• Discord identifiers and profile fields: for example user id, username, display name, avatar, and account creation date, needed to enforce rules and display actions.
• Guild and membership metadata: for example server id, roles, channels, join times, and permission-related signals, for anti-raid, verification, and moderation features.
• Verification and security events: for example captcha or join-gate outcomes, risk scores, and related timestamps.
• Message and content data when required for security, such as message text or attachments only to apply configured rules (for example spam, links, or policy matches). Sekure is not designed as a general message archive; we do not maintain a standing database of all server messages for browsing or analytics.
• Enforcement records when applicable: for example warnings, kicks, bans, and notes tied to moderation actions.
• Technical logs limited to operating and securing the bot: for example error diagnostics and abuse prevention signals on our infrastructure.

We use personal data to:

• Provide, operate, and improve Sekure security features.
• Detect, prevent, and respond to abuse, raids, spam, and security threats.
• Apply server-configured rules and enforcement actions.
• Maintain the integrity and availability of the Service.
• Comply with law and enforce our terms.

Where the GDPR or UK GDPR applies, we rely on legitimate interests in securing Discord communities and preventing abuse, and on legal obligations where required. In some cases, processing may be necessary to perform steps requested by server administrators at your direction before you enter or remain in a server using configured protections.

We do not sell personal data from Sekure.

Sekure runs on infrastructure operated by Surf Online through Meridian (meridian.surf). Backend hosting, configuration storage, and related platform processing are described in our Meridian Privacy Policy. That policy covers Meridian developer accounts and platform services; this policy covers Sekure-specific processing of Discord server members as described above.

We may share personal data:

• With Discord, as required for the bot to function under Discord's policies and APIs.
• With infrastructure providers that host Meridian and Sekure on our behalf, under contractual safeguards.
• When required by law, regulation, legal process, or to protect rights, safety, and security.
• In connection with a merger, acquisition, or asset sale, with notice where required by law.

Sekure does not keep a general-purpose security log database of all server activity. We retain personal data only as long as needed for the purposes in this policy, including:

• Sanctions and enforcement records (such as warnings, bans, and related context) while they remain relevant to enforce server rules or resolve disputes.
• Short-lived processing for real-time checks (for example screening a message against a rule), after which content is discarded unless it is stored as part of an enforcement record.
• Technical data for security and operations, typically for limited periods unless needed for an investigation.

When data is no longer needed, we delete or anonymize it. Removing Sekure from a server stops new processing for that server; existing enforcement records may be retained as described above.

We use technical and organizational measures appropriate to the risk, including access controls and encryption in transit where supported. No method of transmission or storage is completely secure. Report concerns to security@meridian.surf.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to data portability or withdrawal of consent where processing is consent-based.

To exercise rights relating to Sekure, contact privacy@surfonline.eu. We may need to verify your request. You may also contact your server administrators regarding server-specific moderation decisions. You can lodge a complaint with your local supervisory authority.

Surf Online is based in the Netherlands. Personal data may be processed in the European Economic Area, the United Kingdom, the United States, and other countries where our hosting providers operate. Where required, we use appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses.

Sekure is intended for users who meet Discord's minimum age requirements (at least 13 years old in most regions). We do not knowingly collect personal data from children under 13.

In the EEA, UK, and similar jurisdictions, the age of digital consent for information society services is often 16 (it may be 13 to 16 depending on your country). If you believe we have processed data about a child in violation of applicable law, contact privacy@surfonline.eu.

We may update this Privacy Policy by posting a revised version at /compliance/sekure/privacy. The last updated date at the top will change when we do.

Privacy inquiries: privacy@surfonline.eu. Sekure is a trade name of Surf Online, a company registered in the Netherlands (KvK 42127201).