Privacy Policy

This Privacy Policy explains how Dock handles personal information across its websites, dashboards, APIs, Discord bot, Roblox integrations, verification and account-linking features, security and detection systems, billing, profile customization, analytics, and support.

This Policy applies to services operated under the Dock name (the "Services").

Dock's public privacy contact is [email protected]. Legal notices may be sent to [email protected], and the public operator contact is @officialsteam on Discord.

Where applicable law requires additional controller, merchant, representative, or operator information, Dock may provide that information through the legally required notice, transaction flow, contracting process, or other required channel.

The information Dock handles depends on the features you use.

Stripe or another authorized payment processor handles payment-card details. Dock does not intentionally store full card numbers or CVC values in its own production database.

Dock processes IP and related network information where needed to operate and protect the Services, including for:

• account and session security;
• rate limiting and abuse prevention;
• fraud and credential-misuse detection;
• verification integrity;
• troubleshooting and reliability;
• enforcement-evasion investigation; and
• detection functionality where the particular use is permitted.

Depending on the system, Dock may use raw values for short-lived technical processing, encrypted values, keyed hashes or protected lookup values, subnet/network information, coarse location, or VPN/proxy/hosting classifications.

Protected, hashed, encrypted, or pseudonymous values may still be personal information when they remain linkable to a person or device.

Dock may use a first-party device or browser identifier for security or another documented purpose where that use is enabled and permitted. Dock does not treat an identifier as automatically available for a customer-facing detection purpose merely because it is also useful for first-party security.

Dock supports user-authorized account linking and may provide security, abuse-prevention, verification, and detection functionality.

A user-authorized link is treated differently from an inferred association.

Where Dock provides an inferred risk or association result, the result is a review signal rather than verified proof of common ownership or wrongdoing. Unless Dock expressly documents a score as a calibrated probability, a numeric score is a relative indicator and should not be interpreted as a percentage likelihood.

Legitimate circumstances such as shared households, schools, workplaces, mobile networks, VPNs, proxies, or shared devices can create similar signals.

Dock restricts detection processing and disclosure based on the purpose, data source, customer scope, privacy requirements, platform rules, and technical authorization that apply to the feature. Some evidence may be available for first-party security but unavailable for a customer-facing result.

Ordinary customer-facing features are not intended to disclose raw stored IP histories, device secrets, complete login histories, billing records, payment identifiers, or Dock's private detection logic.

Dock may use information to:

• provide accounts, verification, linking, dashboards, bots, APIs, and profile features;
• authenticate users and maintain sessions;
• enforce permissions, limits, and configured settings;
• secure Dock and investigate fraud, abuse, credential misuse, attacks, or evasion;
• provide permitted detection and moderation-support functionality;
• process subscriptions, payments, refunds, disputes, and entitlements;
• respond to support, legal, privacy, and security requests;
• maintain logs reasonably necessary for reliability, debugging, security, and auditing;
• enforce Dock's Terms and profile-content rules;
• establish, exercise, or defend legal claims;
• comply with law or valid legal process; and
• complete a legitimate transfer or reorganization of the Services.

Dock does not treat acceptance of this Privacy Policy as consent to processing that legally requires separate consent.

Dock may receive information:

• directly from you;
• automatically when you use Dock;
• from a Customer or guild administrator using Dock;
• from Discord, Roblox, Stripe, Cloudflare, and other integrated platforms;
• from service providers supporting hosting, storage, networking, monitoring, communications, payments, or security; and
• from Dock's own security, verification, moderation, and abuse-prevention systems.

Dock may share information with:

Service providers

Providers supporting hosting, networking, databases, payments, storage, monitoring, authentication, communications, security, and similar operations, as reasonably necessary for their role.

Integrated platforms

Discord, Roblox, Stripe, and other platforms where necessary for a user-requested integration, authentication, payment, profile update, verification flow, or platform interaction.

Authorized Customers

Where a configured feature is permitted, Dock may provide the relevant Customer with information such as verification status, user-authorized account-linking results, limited risk or review signals, profile configuration, moderation information, or aggregate analytics.

Customer access does not create permission to obtain unrelated private account information or raw internal security data.

Legal and safety disclosures

Dock may preserve or disclose information when reasonably necessary to comply with valid legal process, protect rights or security, investigate serious abuse or fraud, or establish or defend legal claims.

Business transfers

Information may be transferred as part of a legitimate incorporation, acquisition, financing, reorganization, or sale of the Services, subject to applicable law.

Dock does not sell raw payment-card information.

Some laws use broad definitions of "sale," "sharing," profiling disclosure, or data-broker activity. If a law applies to Dock and classifies a particular compensated disclosure that way, Dock will apply the controls required by that law to that processing.

A Customer that decides why Dock is configured for its guild, community, or users may have its own privacy obligations.

Where Dock processes personal data solely on a Customer's documented instructions and applicable law treats Dock as a processor, service provider, or contractor, separate data-processing terms may be required.

Dock may independently determine the purposes and means of first-party account security, fraud prevention, service-wide abuse prevention, and other processing for which Dock is legally the responsible party.

Legal roles depend on the actual processing, not merely on the label a party uses.

Dock does not use one retention period for every category of information.

Security usefulness alone does not automatically justify retaining every record indefinitely.

When Dock retains limited information after a privacy request, the retained information must remain supported by the particular law, platform rule, legal obligation, dispute, or other valid ground that applies to it. Data retained only for a restricted first-party purpose is not automatically available for a paid or customer-facing detection result.

Authenticated users may submit a privacy or deletion request through Dock's account settings where that feature is available. Requests may also be directed to [email protected] when the account flow is unavailable or another request type is needed.

For security, Dock may require reasonable verification before providing, changing, or deleting account information.

Before an authenticated Dock account deletion request can be submitted through the dashboard, all active Dock API keys associated with that account must be deleted. This requirement helps avoid leaving active credentials attached to an account that is being closed. It does not reduce any privacy right that applicable law requires Dock to provide through another appropriate process.

A valid request may result in deletion, de-identification, correction, restriction, suppression, or another legally appropriate action.

Deletion is not automatically all-or-nothing. Certain records may need to be handled differently because of:

• a legal obligation;
• a valid payment, tax, accounting, or chargeback record;
• an active legal claim or dispute;
• another person's rights;
• a lawful security or enforcement purpose; or
• a platform requirement that controls the relevant data.

Dock does not automatically deny a request because a user has been suspended or banned. A privacy request also does not automatically require Dock to reinstate a valid restriction. The retention question and the access/enforcement question are reviewed separately.

Where information used in a derived result is deleted, restricted, or no longer permitted for that result, Dock may invalidate, suppress, or recalculate affected customer-facing detection results rather than silently continuing to rely on the old input.

Dock will respond within the period required by applicable law.

Depending on where you live and which law applies, you may have rights to:

• access or obtain information about personal information Dock processes;
• correct inaccurate information;
• request deletion;
• receive certain information in a portable format;
• restrict or object to certain processing;
• withdraw consent where consent is the applicable basis;
• opt out of certain sales, sharing, targeted advertising, or profiling where a law provides that right;
• appeal a privacy-request denial where a law provides an appeal; and
• complain to an applicable regulator.

These rights are not absolute and may be subject to legally permitted exceptions.

Dock will not discriminate against a person for exercising a privacy right protected by applicable law.

Where EU GDPR, UK GDPR, or a substantially similar law applies, Dock uses the lawful basis appropriate to the specific processing.

Typical bases may include:

• contract for functionality objectively necessary to provide a requested account, verification, API, profile, or paid feature;
• legitimate interests for proportionate first-party security, fraud prevention, abuse prevention, service integrity, and legal-claim purposes where the required balancing supports that use;
• legal obligation for processing required by law; and
• consent for processing that applicable law requires to be optional and consent-based.

Customer-facing profiling or detection processing is evaluated separately from first-party security and is not assumed to be justified merely because the same signal can be useful for security.

Where Dock obtains personal data indirectly, provides services to people in a jurisdiction, or monitors behavior in a way that triggers additional transparency, representative, transfer, or assessment obligations, Dock will apply the requirements that actually apply to that processing.

Dock is operated from the United States, and service providers may process information in the United States or other countries.

Some U.S. states provide rights concerning access, correction, deletion, portability, certain sales or sharing, targeted advertising, profiling, and appeals.

These statutes have different thresholds and definitions. Dock does not represent that every state privacy statute applies to every Dock activity.

Where a covered law applies to Dock or a particular processing activity, Dock will provide the notices, controls, preference-signal handling, appeals, or other measures that law requires.

Dock is not directed to children under 13. Users must also meet Discord's, Roblox's, and other applicable platforms' minimum-age requirements.

If Dock learns that it has collected personal information from a child in circumstances requiring deletion, parental authorization, or another action, Dock will take appropriate steps consistent with the applicable law and platform requirements.

A parent or guardian may contact [email protected].

Dock uses cookies, local storage, session storage, signed tokens, browser identifiers, and similar technologies for authentication, security, preferences, verification, billing, analytics, abuse prevention, and other documented purposes.

Optional technologies are handled according to Dock's consent controls and applicable law.

See Dock's Cookie Policy for details and controls.

Dock uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, or disclosure.

Depending on the data and system, safeguards may include:

• encryption in transit;
• storage or database encryption where configured;
• application-level encryption or protected representations for selected sensitive fields;
• hashing, HMACs, signing, tokenization, masking, or redaction;
• access controls and authorization checks;
• rate limiting, monitoring, and audit logging;
• secret-management and credential-rotation practices; and
• backup and recovery controls.

No security system can guarantee absolute security.

Dock will provide security-incident notices when and to the extent required by applicable law or binding platform obligations.

Dock may update this Policy as the Services, law, integrations, or data practices change.

Dock will update the "Last updated" date and provide additional notice, renewed consent, or another action where required for a material change.

• Privacy: [email protected]
• Legal: [email protected]
• Security: [email protected]
• Support: https://discord.gg/docksys
• Public operator contact: @officialsteam