Privacy Policy

Last updated: 25 April 2026.

Who is responsible for your data

The data controller for this website and the Clocked service is:

  • WEB LAB FACTORY SL
  • NIF: B55246456
  • Registered office: C/ Camí de Siurana 14, 17469 El Far d'Empordà (Girona), Spain
  • Contact: [email protected]

What data we collect

Clocked is designed to handle as little personal data as possible. Specifically:

  • Account data (when you log in): Discord user ID, username, global name, email and avatar hash provided by Discord through OAuth2.
  • Subscription data (when you subscribe): Stripe customer ID, Stripe subscription ID, plan status and the Discord server (guild) ID associated with each subscription. Card data is handled and stored exclusively by Stripe; we never see or store it.
  • Voice activity (collected by the bot inside Discord): user ID, channel ID and timestamps for voice channel join and leave events on servers where the bot has been invited and configured by an administrator. We never read messages, never record audio, and never process any other server content.

Legal basis for processing

  • Performance of a contract (Art. 6.1.b GDPR): processing your account and subscription data to provide the service you sign up for.
  • Legal obligation (Art. 6.1.c GDPR): keeping invoicing and accounting records as required by Spanish tax law.
  • Legitimate interest (Art. 6.1.f GDPR): operating the bot inside Discord servers whose administrators have invited it, and producing aggregated, cookieless analytics about how the website is used.

How long we keep it

  • Account and subscription data: while your subscription is active, plus 30 days after cancellation, then deleted — except invoicing records, which we keep as long as required by Spanish accounting and tax law (typically up to 6 years).
  • Voice activity: while at least one subscription on the relevant server is active. Once tracking stops or the bot is removed, data is purged after 30 days.
  • Web server access and error logs: up to 90 days.

Who we share it with

We do not sell your data and we do not share it for marketing purposes. We do rely on a small number of processors to deliver the service:

  • Discord, Inc. — to operate the bot and authenticate you. Discord is located in the United States; transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Stripe Payments Europe, Ltd. — to process payments and manage subscriptions. Stripe may transfer data to the United States under the EU-US Data Privacy Framework.
  • Matomo, self-hosted by us on infrastructure inside the European Union — to produce anonymous, cookieless usage statistics about this website.
  • The underlying VPS hosting provider for clocked.club, located inside the European Union.

Cookies and local storage

This website uses the strict minimum needed to function. Specifically, one first-party cookie:

  • clocked_session — strictly necessary session cookie. It stores a random session identifier so we can keep you logged in after you authenticate with Discord and remember the result of authorisation checks. HttpOnly, Secure, SameSite=Lax, lifetime 30 days. It does not contain personal data, is not used for tracking and is not used for advertising.

For analytics we use Matomo configured in cookieless mode (_paq.push(["disableCookies"])): no tracking cookies are set and no identifiers are stored in your browser. Because no consent-requiring cookies are placed, no cookie banner is shown, in line with AEPD guidance for strictly necessary cookies and equivalent first-party analytics.

Stripe and Discord may set their own cookies on their own domains when you are redirected to Stripe Checkout, the Stripe Customer Portal, or Discord's OAuth screens. Those cookies are governed by their respective privacy policies.

Your rights

Under the GDPR and Spanish data protection law (LOPDGDD) you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, email [email protected] from the address linked to your Discord account so we can verify your identity.

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you believe your rights have not been respected.

Opt-out from voice tracking

Any member of a Discord server where Clocked is active can opt out of voice tracking at any time by running /clocked-optout in that server. Past data is kept but excluded from all rankings and stats.

Security

The website runs over HTTPS only, sessions are HttpOnly and Secure, and access to production systems is restricted to the company's authorised personnel. Despite reasonable measures, no online service can be guaranteed to be fully secure.

Changes to this policy

We may update this policy to reflect changes to the service or to legal requirements. The "Last updated" date at the top will always reflect the current version.