Privacy Policy

The controller of the personal data collected through oxa.gg, the bot, and the OXA Discord server ("OXA", "we") is Pol Navarro Oliver, Spanish tax ID (NIF) 41633052Q, with address at Carrer Pas d'en Marges, 22 — 08360 Canet de Mar (Barcelona), Spain. For any data-protection matter you can write to [email protected] or reach us on the OXA Discord server.

Depending on how you use our services, we may process:

• Account data (Discord OAuth2): user ID, username, avatar, and associated email.
• Community activity data: messages, voice time, levels/XP, honor, economy (OXA), and clan participation.
• Profile data: the information you voluntarily share on your profile (bio, links, presentation, images).
• Payment data: when you buy a product, payment is processed by Stripe. OXA does not store your card details; we only receive a payment confirmation and an identifier.
• Interactions with Flor (AI assistant): the messages and audio you send to it are processed to generate its replies (see sections 6 and 7).
• Technical data: IP address, browser type, and error logs, needed to serve the site securely and diagnose issues.

We process your data to:

• Manage your account and authentication via Discord.
• Show your public profile, stats, and ranking position.
• Run clans, their economy, tournaments, and events.
• Process purchases and prevent fraud.
• Provide the AI assistant (Flor) and improve the experience.
• Keep the service secure, prevent abuse, and meet legal obligations.

• Performance of a contract / service provision: to give you access to your account, profile, clans, and the purchases you request.
• Consent: for cookie-based analytics and for signing in with Discord; you can withdraw it at any time.
• Legitimate interest: to keep the service secure, prevent abuse, and improve it, in a proportionate way.
• Legal obligation: where a law requires us to retain or disclose certain data (e.g. invoicing).

We do not sell your data or use it for advertising. To provide the service we share strictly necessary data with providers acting as processors:

We may also disclose data where required by law or a competent authority.

Some of these providers are located outside the European Economic Area (for example, in the United States). In those cases, transfers are made with appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses or applicable adequacy frameworks (e.g. the EU–US Data Privacy Framework where the provider is certified).

Flor is a conversational character based on AI models. The messages and audio you send to it, along with some channel context, are sent to AI providers to generate its replies and may be stored (including a long-term memory) to keep the conversation consistent. Do not share sensitive data with it that you don't want processed. You can request deletion of what Flor remembers about you (see section 9).

We keep your data while your account is active and as long as it's needed for the purposes described. If you leave the Discord server, activity data is kept for up to 12 months before being anonymized or deleted, unless a legal obligation requires keeping it longer. You can request deletion at any time.

You have the right to access, rectify, erase, restrict, or object to the processing of your data, and to data portability. You can also withdraw your consent at any time.

To exercise them, contact us on the OXA Discord server or at the privacy email shown on the site. We will respond within the timeframes set by law.

If you believe we have not handled your request properly, you can lodge a complaint with your supervisory authority. In Spain this is the Spanish Data Protection Agency (AEPD, www.aepd.es).

Our services are aimed at people who meet the minimum age required by Discord and by the laws of their country. We do not knowingly collect data from minors below that age; if we detect such a case, we will delete the data.

We apply reasonable technical and organizational measures: encryption in transit (HTTPS), restricted access to data, environment separation, and input sanitization.

We may update this policy. Any change will be reflected in the update date at the top of this document.