Privacy Policy
Last updated: August 12, 2026TBot hosts voice servers and supporting tools for Tibia guilds. This policy explains which personal data we process, why, who we share it with, and what you can require of us in respect of it. It covers the tbot.run website, the panel at panel.tbot.run, and the voice servers we deliver.
The processing described here is governed by Brazilian Law No. 13.709/2018 (the General Data Protection Law, or LGPD). For the purposes of this policy, TBot is the data controller.
1. What we collect
Data you give us:
- Your email address, given at sign-up. It identifies your account and is how we reach you.
- Your password, stored only as a cryptographic hash. We cannot read it and cannot recover it — only replace it.
- The subdomain you choose for your voice server, and the settings you configure in the panel.
- The contents of any message you send us by email, WhatsApp or Discord when asking for support.
Data generated by using the service:
- IP address, date and time of access to the panel and the API.
- IP address, nickname and client identifier used when connecting to the voice server, plus the connection and disconnection records the voice software itself produces.
- Technical error and performance records, used to diagnose faults.
- The state of your subscription: plan, slot count, region, renewal date and payment status.
Payment data:
- We do not receive, process or store your card number. Payment is handled entirely by Stripe, within Stripe's own environment.
- What we receive from Stripe and retain are customer and subscription identifiers, the last four digits of the card, the card brand, and the outcome of each charge.
Website browsing data:
- We use Microsoft Clarity on the public pages of tbot.run. It records pages visited, clicks, scrolling, pointer movement and device and browser characteristics, and reconstructs a recording of the browsing session from them.
- That recording covers the public pages only. It is not used to identify you by name and does not receive the contents of password fields.
2. Why we process it
Each purpose below has a corresponding legal basis under art. 7 of the LGPD.
- Creating and maintaining your account, provisioning and operating the voice server you bought, billing the subscription and providing support — performance of a contract (art. 7, V).
- Sending operational email: sign-up confirmation, password recovery, receipts, billing, suspension and termination notices — performance of a contract (art. 7, V). These are not marketing and carry no unsubscribe link, because without them the service does not work.
- Retaining application access logs — compliance with a legal obligation (art. 7, II), under art. 15 of the Brazilian Civil Rights Framework for the Internet.
- Retaining tax and financial records of transactions — compliance with a legal obligation (art. 7, II).
- Protecting the infrastructure against fraud, abuse and attack, and investigating breaches of the Terms of Use — legitimate interest (art. 7, IX).
- Understanding how people use the website in order to improve it, by way of Microsoft Clarity — legitimate interest (art. 7, IX).
We do not use your data for behavioural advertising, we do not sell it, and we do not pass it to third parties for marketing.
3. Who we share it with
Running the service depends on the providers below. They act as processors and handle personal data only as far as their function requires. This list is complete as at the date of this policy.
Beyond these, we may share data with public authorities where a court order or a legal demand obliges us to. If that happens we will tell you, unless the order itself forbids us from doing so.
4. International transfers
As the table shows, part of the processing happens outside Brazil, mostly in the United States. That transfer is necessary for the performance of the contract between you and TBot, under art. 33, VI of the LGPD, and takes place under each provider's contractual clauses and data protection commitments.
If you buy a server in the South America region, the voice server itself runs in Brazil. Your account and billing data remain subject to what is described above.
5. How long we keep it
- Account and configuration data: for as long as the account exists.
- The voice server and its contents: where payment fails, the server is suspended on day 14 and terminated on day 28, at which point that server's data is destroyed. The same retention window applies if you cancel.
- Account data after termination: up to 12 months, to answer disputes and reactivation requests. After that, erased or anonymised.
- Application access logs: 6 months, under art. 15 of the Brazilian Civil Rights Framework for the Internet.
- Tax and financial records: for the period required by tax law and the applicable limitation period.
- Microsoft Clarity session recordings: for that service's own retention period, which we do not control.
6. Security
The technical measures we take include:
- Traffic encrypted in transit (HTTPS/TLS) across the website, the panel and the API.
- Passwords stored only as hashes, using an algorithm intended for the purpose.
- Communication between the application and the voice hosts confined to a private network, with no administrative port exposed to the public internet.
- Your server's administrative credentials shown once, at delivery, and not recoverable afterwards — not even by us.
- Access to the production database limited to what operating the service requires.
None of this eliminates risk. Should a security incident occur that may cause you relevant risk or harm, we will notify you and the Brazilian data protection authority (ANPD), under art. 48 of the LGPD.
7. Your rights
Art. 18 of the LGPD entitles you, at any time, to:
- Confirmation that we process your data, and access to it.
- Correction of incomplete, inaccurate or out-of-date data.
- Anonymisation, blocking or erasure of data that is unnecessary, excessive, or processed unlawfully.
- Portability of your data to another provider, on express request.
- Erasure of data processed on the basis of your consent, save where art. 16 requires us to retain it.
- Information about who we share your data with — which the corresponding section already answers.
- Information about the option not to give consent, and about what follows from refusing.
- Withdrawal of consent, where consent is the basis for the processing.
- Objection to processing based on legitimate interest, where the law has not been complied with.
To exercise any of them, write to admin@tbot.run from the email address registered on the account. We may ask for further information to confirm your identity before acting — not out of bureaucracy, but because granting somebody else's erasure request against your account would be worse than refusing it.
You may also complain directly to the Brazilian data protection authority (ANPD) through its official channels.
8. Cookies and similar technologies
- Strictly necessary cookies: these keep your panel session authenticated and remember preferences such as light or dark theme. The panel does not work without them, so they do not depend on consent.
- Microsoft Clarity: stores an anonymous identifier in your browser to recognise browsing sessions on the public website.
You can block or delete cookies in your browser settings, and you can block Clarity with any tracker-blocking extension. Blocking the necessary cookies will stop the panel from working; blocking Clarity affects nothing you use.
9. Children and young people
TBot is not directed at anyone under 18, and only adults of 18 or over may buy the service, as the Terms of Use state. We do not knowingly collect data from children or adolescents. If we learn that an account was created by a minor, we will erase the data. If you are a parent or guardian and believe this has happened, write to admin@tbot.run.
10. Changes to this policy
This policy may change to reflect changes in the service, in our providers, or in the law. The update date at the top of the page is always that of the version in force. Where a change is material — in particular a new processing purpose or a new provider with access to data — we will give notice by email before it takes effect.
11. Contact
Questions about this policy, data subject requests and incident notifications: admin@tbot.run.