camelBot Privacy Policy

CamelQA, Inc., doing business as camelAI ("we", "us"), runs camelBot at bots.camelai.com. People use camelBot to build Discord bots with an AI assistant, camel-builder, and publish them to their servers. Bots run on our shared Discord app (Camel's app, whose bot user is "camel"), or on a server owner's own Discord app connected to camelBot; both are handled the same way. This policy covers two groups of people: those who sign in to camelBot to build bots, and those in Discord servers where a camelBot bot runs.

The short version

• A bot gets a server's messages and events only when its owner set it up to, and camelBot stores messages and events only when a bot receives them.
• We don't, and never will, train AI models on anything from Discord, such as server messages, member data, or your DMs with camel. We don't sell Discord data or share it for advertising.
• We may use two things to train AI that builds bots: camel-builder conversations in our web app, and the bot code camel-builder writes on the web or through ChatGPT. We never use ChatGPT conversations for this. We remove personal information, secrets, and Discord data first, and you can object.
• Most of what bots receive is deleted within days. A bot's own saved data is deleted when the bot is.
• A bot records a voice call only if its owner allowed recording, and camel says so in the channel first.
• Anyone can ask us to delete their data at support@camelai.com.

1. If you build bots

When you sign in with Discord, we receive your Discord user ID, username, display name, avatar, the language you set in Discord, and your email address if Discord has verified it. Cloudflare, which sits in front of camelBot, tells us which country you're signing in from, based on your IP address. We keep the country, not the IP address. We use your language and country to understand where camelBot's users are and, as we add translations, to show camelBot in your language. You can also give us a different email address and confirm it with a code. We check which servers you're in when you add a bot, but we don't store that list. If you first message camel in Discord instead, we create your account from your Discord profile.

We also keep what you create: your conversations with camel-builder (including pictures and voice messages you send it), your bots' code, settings, names, and pictures, and the data your bots save. If you connect your own Discord app, we keep its bot token encrypted. If you give a bot secrets, such as API keys for other services, we keep them encrypted with AWS Key Management Service and add them only to the requests your bot's code sends to other services. They never appear in your bot's code, saved data, versions, exports, or logs, or in camel-builder's conversations: camel-builder sees only their names. They're deleted with the bot. If you connect camelBot to ChatGPT, ChatGPT receives your bots' names, status, and the servers and channels they're in. If you buy credits or camelBot Plus, Discord handles the payment and your card details and tells us what you bought, and we keep a record of your purchases and AI usage.

If you sign up through someone's referral link, we keep who referred you, when, and whether the referral earned credits. The person who referred you sees your Discord display name and whether it earned credits.

If you apply to be a creator, we keep the links and code you send us. People who open your code's link see your Discord display name, and we count the views, sign-ups and new bots it brings in.

When you use someone's camelBot bot, we keep one-way hashes of your Discord ID, so we count you once when we give its owner free credits. We don't keep your name or anything you said with them, and the owner isn't told who you are. If you don't have a camelBot account, one of those hashes lasts 30 days.

We use your email only to tell you when one of your bots needs attention, such as when it goes offline, and to answer you when you ask for help. You can turn offline notices off in your account menu. bots.camelai.com uses cookies to keep you signed in and a first-party visitor cookie for automatic journey measurement. The visitor cookie connects your earlier visits to camelai.com with your account and actions such as signing up, publishing a bot, and adding it to a server. We retain your original source separately from later visits and advertising clicks so we can understand traffic and conversion journeys.

For Google Ads conversion measurement, we can connect a recorded ad click to a confirmed product action and send the conversion to Google Ads. These conversion exports do not include your email address, Discord user identity, messages, prompts, bot code, bot names, or server names. This pipeline does not enable personalized advertising. See the camelAI Privacy Policy for details about the shared visitor cookie and Google’s partner-site data policy for how Google uses data.

2. If you're in a server where a camelBot bot runs

A bot's Discord app sees what Discord shows it in a server, and camelBot checks each message or event as it arrives. Anything no bot is set up to receive is dropped, never stored. A bot receives:

• Messages in the channels its owner added it to (which needs the Manage Server permission), messages that use its name, prefix, or @mention or reply to it anywhere in its servers, and direct messages sent to it.
• Other events it was set up to handle, such as commands, buttons, and forms you use; reactions; edited and deleted messages; members joining or leaving the server or its voice channels, and the server's member list; moderation actions; and invites and boosts. These come with the Discord user IDs, display names, and avatars of the people involved.
• Voice, for bots that can listen. When such a bot joins a voice channel, camel posts a notice in that channel's chat. The audio goes to an AI provider to be transcribed, and the bot may answer aloud. We don't store the audio unless the bot records the call (below). The bot receives the text with the speaker's Discord user ID and name. You can avoid a listening bot by leaving the voice channel.
• Voice recordings, only for bots whose owner allowed recording when publishing them. camel posts in the voice channel's chat before a recording starts (if it can't, the recording doesn't start), tells people who join while it's recording, and says when it stops. A recording captures everyone in the call, lasts at most 4 hours, and ends when the bot leaves. The bot's code decides what happens to it, such as posting it in a channel or transcribing it, and it's then kept wherever the code puts it. We keep the recording files for 30 days so the bot can use them, then delete them; the bot's code can delete them sooner, and deleting the bot deletes them at once. Our team doesn't listen to them, though staff with production access could reach them. Bot owners are responsible for asking for consent where the law requires it.

For each server Camel's app is in, we also keep basic server details from Discord, such as its name, owner, member count, and language.

Roblox account links. At bots.camelai.com/roblox/link, you can link your Roblox account to your Discord account, so bots in servers you share can see which Roblox account is yours. You sign in with Discord (we ask only who you are), then prove which Roblox account is yours by signing in with Roblox (we ask only for your basic profile: the openid and profile scopes) or by putting a code in your Roblox profile's About. We revoke both sign-ins' tokens right away. We keep your Discord user ID, your Roblox user ID, username, and display name, how you proved the link, and when. You can unlink on the same page at any time, and linking another account replaces it.

Other sources bots can use. Bots can also receive data from outside Discord, when their owner sets them up to:

• Twitch. Bots can follow Twitch channels, to announce when they go live, and read public channel, stream, clip, and video information, all through our own Twitch app; nobody connects a Twitch account. We keep the channel names each bot follows until it stops following them or is deleted. Twitch's go-live and offline notices reach the bot as events, kept like other events.
• Webhooks. A bot's owner can give it webhook addresses so other services can send it events. Each address contains a secret token: anyone who has it can send the bot events, so owners should keep it private, and they can replace it at any time. We keep what's sent (its body, headers, and query) only while it's delivered to the bot, then erase it, normally within minutes and at most about an hour. We drop the sender's IP address before storing it. Our web request logs, which only our team can access, record each request's address, token included, for 90 days.
• ER:LC servers. A bot whose owner connects an Emergency Response: Liberty County private server, with the server's key kept as one of the bot's secrets, can read the server and receive its logs. The log entries, which include players' Roblox names and IDs and the commands they type in the game, reach the bot as events and are kept like other events. While a bot listens to a server, we keep the server's name and our place in its logs.
• Game-server status. Bots can look up public game servers, such as Minecraft and FiveM servers. The results, which can include a server's name and up to 20 public player names, are held in memory for 45 seconds and not stored.
• RSS and Atom feeds. Bots can follow public feeds. While a bot follows a feed, and for up to a day after, we keep the feed's address and latest items. We keep a scrambled record of which items were already seen for 30 days.

Beyond what's described here, what a bot receives from these sources is kept only if its code saves or logs it.

3. How we use it

We use this data to run camelBot: to deliver each message and event to the right bot, run its code, send its replies and other actions back to Discord, let owners see what their bots did, and keep camelBot working and safe, including debugging failures and reviewing published bots' code for abuse. To keep camelBot working and safe, we also count which website domains each bot's code contacts each day: the domain only (such as example.com), never the full address or what was sent.

We don't use Discord message content or member data to train AI models, and we don't sell it or share it for advertising.

Training AI to build bots. We may use your conversations with camel-builder in the web app at bots.camelai.com, and the bot code it writes there or in conversations through the camelBot app for ChatGPT, to train or fine-tune AI models that help people build bots with camelBot. For conversations, that means your words and camel-builder's replies, not the pictures, voice messages, or files you send it. We use only conversations and code from after you agreed to the version of the camelBot Terms that allows it. This doesn't cover camelCode or our other products. Before any training, we remove these kinds of sensitive information:

• personal information, such as names, email addresses, and phone numbers;
• secrets, such as API keys, tokens, and passwords;
• your own words from conversations through the camelBot app for ChatGPT that end up in code, such as a bot's replies or persona; and
• data from Discord, such as your Discord account details, server, channel, role, and member names and IDs, and message content, even when it appears in a conversation or in your bot's code.

Our team may read these conversations and code to prepare them. A model that's already trained keeps what it learned, even if you later delete your data.

We never train on your conversations with camel in Discord, including DMs, or on the code camel-builder writes in them. We don't train on conversations through the camelBot app for ChatGPT either. Nothing bots receive or do in Discord is ever used for training.

A bot's owner sees its activity, including the Discord IDs and names of the members who used it, and any data the bot saves. Our small team can access camelBot's systems when needed to run, fix, and secure it, and to handle reports.

Where EU or UK law applies, we rely on our legitimate interest in running the bots added to a server, on our agreement with you for your camelBot account, and on our legitimate interest in improving camel-builder for training it. You can object to training at any time, wherever you live. Email support@camelai.com, and from then on we'll stop using your conversations and code for training. Models already trained keep what they learned.

4. Who receives it

• AI providers. When a bot or camel-builder uses AI, the provider receives what is sent to it, which can include message text, names, images, and voice audio. Our main providers are OpenRouter (which routes text to model hosts such as Baseten, Parasail, Fireworks, and DeepInfra), Microsoft Azure OpenAI, OpenAI (images, transcription, and voice), Google (voice), and ElevenLabs (voice previews). Web searches by bots and camel-builder go to Exa, Brave, Parallel, or Firecrawl.
• Hosting. camelBot runs on Amazon Web Services in the United States, behind Cloudflare. Bots' AI work runs on camelRun, our agent hosting service, which also runs on Amazon Web Services. We send email with Amazon SES.
• Tools our team uses to investigate errors: Anthropic (Claude) and GitHub, which may see error messages that quote a message a bot received.
• Training providers. If a provider trains or fine-tunes a model for us, it receives the camel-builder conversations and code described in section 3, after we remove the sensitive information listed there.
• Services bots connect to. Twitch, Roblox, PRC (for ER:LC), and the websites a bot's code contacts receive the requests needed to answer the bot, such as the Twitch channels it follows. Discord and Roblox handle your sign-ins when you link a Roblox account.
• Discord, which receives whatever a bot sends back to a server, and handles purchases of credits and camelBot Plus.
• Legal and business. When the law requires it, to protect people or camelBot, or as part of a merger, financing, or sale.

5. How long we keep it

6. Your choices

• Server staff with the Manage Server permission can remove Camel's app, or a bot's own app, from their server at any time. That stops all processing there. Data a bot already saved stays until its owner deletes the bot or someone asks us to delete it.
• Bot owners can download a bot's saved data and delete the bot in its settings. Deleting a bot deletes its data, including its secrets and voice recordings, except copies in backups, which expire on the schedule above.
• Anyone who linked a Roblox account can unlink it at bots.camelai.com/roblox/link.
• Anyone, including server members, can ask us to see, correct, or delete data about them. Email support@camelai.com or ask in our Discord support server, and include your Discord user ID. We'll verify the request and respond as the law where you live requires. Depending on where you live, you may have more rights, including complaining to a privacy regulator.

7. Security

Data is encrypted in transit and at rest, and the bot tokens of connected Discord apps and bots' secrets are encrypted with a separate key. Our databases aren't reachable from the public internet, and only our team can access production systems. A bot's owners see only their own bots' data. No system is perfectly secure. If a breach affects Discord data, we'll tell Discord, and we'll tell you as the law requires.

8. Children

camelBot is not for children under 13, and Discord requires its users to be at least 13. If we learn we hold the account of a child under 13, we'll delete it.

9. Where data lives

We're a United States company, and camelBot's data is stored in the United States. Our providers may process it in other countries, whose laws may differ from yours.

10. Changes

We'll post updates here with a new "last updated" date, and tell signed-in users in camelBot or by email before a significant change takes effect.

11. Contact

Contact CamelQA, Inc. (doing business as camelAI) at support@camelai.com or on our Discord support server.