This policy explains how your personal data is processed when you use the SHIELD website (the "Site") and our services connected to our Discord server. The controller of your personal data is SHIELD ("we", "us"). By using the Site you acknowledge the processing described in this policy. We do not process data for advertising, profile selling or tracking.
1. Information we collect
- Discord account data: your Discord user ID, username, display name, avatar and banner, and the verified email address Discord shares with us. See section 2 for details.
- Site account and profile: your account number, sign-up and last sign-in times, account role (member/admin), the optional "About me" text, your profile appearance settings (colour, frame, cover) and whether your profile is public.
- Public information: if your profile is public, your name, avatar, cover, join date, Discord username and bio can be seen by anyone who has your profile link, and signed-in members can see you in the Members list. Your email address is never shown. You can hide your profile on the My profile page.
- Orders and payments: order number, items and quantities in your cart, amounts and currency, the cryptocurrency and network you chose, the payment address and locked rate shown to you, the blockchain transaction ID (TXID), amount received and number of confirmations, any transaction ID you report, your order note, the order status history and the delivery note. We do not collect card or bank details. Blockchain transactions are public by nature; the wallet address you pay from is visible on the blockchain.
- Support requests and messages: what you write to us through the contact form or the Messages page and our team's replies. These requests are also forwarded to private support channels on our Discord server so our team can answer them.
- Reviews, favourites and stock alerts: reviews and ratings you write for products you bought (shown publicly with your name and avatar after approval), products you add to favourites and your "notify me when back in stock" requests (the alert is sent as a Discord direct message).
- Security data: sign-in and code attempts and, for successful/failed sign-in notices, your browser and operating system type, a shortened form of your IP address (e.g.
85.105.•.•) and, if available, the country code reported by Cloudflare. Your IP address is processed briefly in server memory for rate limiting and abuse prevention; it is not stored in the database with your account. - Visit statistics: daily totals of page views, product views and "buy" clicks, without cookies. To avoid counting the same visit twice, a one-way digest of your account or IP address is created with a key that changes every day; raw IP addresses and account numbers are not written to the analytics tables. Bots are not counted.
- Error logs: technical errors in the Site's own code (error message, page path, code line). Emails, tokens and connection details are masked before logging; query strings are not recorded.
- Preferences: your language, currency and theme choice (stored in your browser; see the Cookies Policy).
2. Discord authentication
Your Discord account is the only way to sign up for and sign in to the Site. You do not create a password or a separate email account.
- Discord authorisation: when you choose "Continue with Discord" you are taken to Discord's own page and approve these permissions:
identify(user ID, name, avatar, banner),email(your email address verified on Discord) andguilds.join(so we can add you to our Discord server). We never see your Discord password. We do not store the access token Discord issues; we only use it during that sign-in to fetch your details and, if needed, add you to our server. - Server membership requirement: the Site is only open to members of our Discord server. If you are not on the server when you sign in, we add you automatically; accounts banned from the server cannot sign in. Your membership is checked at sign-in and on important actions; if you leave or are removed from the server, your sessions on the Site end immediately.
- Verification code by Discord DM: on every sign-up and sign-in our bot sends you a 6-digit one-time code on Discord. The code is valid for 1 minute and can be tried at most 5 times. The code itself is never stored in plain text (only a one-way digest bound to your browser is kept). You also receive Discord notices for successful sign-ins, wrong code attempts and expired codes. To receive these messages you must allow direct messages from our server.
- Account creation: once the code is verified your account is created; your name, avatar and banner are taken from Discord (a copy of the banner is saved to our storage as your profile cover, and images are served through our server). No separate email address is registered on the Site; the verified email Discord shares is kept only to match your account, for security and to contact you.
- Session: after sign-in a session cookie valid for 7 days, which JavaScript cannot read, is placed in your browser; after 7 days you are signed out automatically and sign in with Discord again. Sessions are stored in the database only as one-way digests.
- Administrators: our team confirms critical actions (updates, backup downloads, payment approvals) with a password or an extra code sent on Discord.
How Discord processes your data is governed by Discord's own Privacy Policy.
3. How we use your information
- Account and sign-in: to create your account, recognise you, keep you signed in and verify your server membership (performance of a contract).
- Orders: to keep your cart, calculate the payment address and amount, verify payment on the blockchain, approve, deliver and refund your order and notify you of its status on Discord (performance of a contract).
- Support: to answer your messages and follow up your request through Discord support channels.
- Community features: public profiles, reviews, favourites and stock alerts; giving you the customer role on our Discord server.
- Security: to block bots and brute-force attacks (Cloudflare Turnstile and rate limits), notify you of unauthorised sign-ins, detect and fix errors and take backups (legitimate interests).
- Improving the service: to understand which pages and products are popular using cookie-free aggregate statistics (legitimate interests).
- Legal obligations: accounting, tax and responding to lawful requests from authorities (legal obligation).
We do not use your data for automated decision-making or profiling that produces legal effects for you. We do not send marketing emails.
5. International data transfers
Some of our service providers are located outside Türkiye, outside the European Economic Area (EEA) or in the United States, or process data on infrastructure in several countries (in particular Discord and Cloudflare; Supabase data is kept in the data centre of the region where our project is hosted). Signing in with Discord necessarily involves such a transfer.
We carry out these transfers using mechanisms permitted by applicable law: for Türkiye, adequacy decisions, standard contracts (notified to the Turkish Personal Data Protection Authority within 5 business days of signature) or the other appropriate safeguards and exceptions listed in Article 9 of Law No. 6698 (KVKK); for the EEA and the UK, adequacy decisions (e.g. the EU–US Data Privacy Framework and its UK Extension) or Standard Contractual Clauses (SCCs) with the UK Addendum. Connections are always encrypted with HTTPS.
6. Data retention
- Deletion of inactive accounts: if you do not visit the Site for 30 days, your account and all data linked to it (profile, avatar and cover, favourites, stock alerts, cart, sessions, support requests and messages) are deleted automatically everywhere, including the database and storage. Administrators are exempt. Visiting the Site before 30 days have passed since your last visit keeps your account.
- Reviews of deleted accounts: approved product reviews of an account deleted for inactivity remain published with your name so they keep helping other buyers; your avatar is not shown and your profile link leads to a "Profile deleted due to inactivity" page. If you want your review removed too, just write to us.
- Account and profile data: for as long as your account exists. When an account is deleted (at your request, by an administrator or for inactivity), its profile, favourites, stock alerts, cart, sessions and contact messages are deleted; avatar and cover files are removed and member/customer roles on the Discord server are revoked.
- Deleted account archive (30 days): right before an account is deleted, a PDF report is created containing the account and Discord details, order history (with payment and transaction IDs), support request history (with all messages) and reviews. This report is kept for 30 days in a server folder accessible only to administrators, is used only to answer lawful requests from competent authorities, investigate fraud and abuse and protect our legal rights, and is deleted automatically after 30 days.
- Order records: kept for accounting for the period required by tax and commercial law (generally 5 to 10 years in Türkiye). If the account is deleted, orders are detached from it; your email and order note are erased and unpaid orders are cancelled.
- Sessions: 7 days; expired sessions are purged every hour.
- Verification codes: the code lasts 1 minute and a verification flow at most 10 minutes; digests of recent codes are kept for 24 hours so the same code is never sent twice.
- Visit statistics: daily pseudonymous digests and their keys for 2 days; aggregate counts for up to 400 days.
- Error logs: the latest 200 distinct errors; our team can clear them at any time.
- Backups: daily backups of the database and files are kept on our server; by default the newest 7 are kept and older ones are deleted automatically. Deleted data disappears from backups at the end of that period.
- Discord messages: notices sent on Discord and support channel messages are subject to Discord's own retention rules.
7. Your rights
Depending on where you are, you have the right to:
- find out whether we process data about you and get a copy of it (access),
- have inaccurate or incomplete data corrected (your name, avatar and cover come from Discord and can be changed on the My profile page),
- have your data and account deleted,
- restrict processing or object to processing based on legitimate interests,
- receive your data in a structured, commonly used format (portability),
- withdraw consent where processing is based on consent,
- lodge a complaint with a data protection authority.
You can send requests through the channels in section 11. To verify your identity we may ask you to send the request from your Site account or the Discord account linked to it. We answer requests free of charge within 30 days at the latest (a fee set by law may apply where extra cost is involved). You can remove the Discord authorisation at any time under Discord → User Settings → Authorized Apps; this blocks new sign-ins but does not delete your account on the Site.
8. Additional rights for users in Türkiye (KVKK)
Under Law No. 6698 on the Protection of Personal Data ("KVKK") the data controller is SHIELD. Your personal data is processed by automated means for the purposes described above, based on the legal grounds in Article 5 of the KVKK: "establishment or performance of a contract", "compliance with a legal obligation", "establishment, exercise or protection of a right" and "legitimate interests, provided your fundamental rights and freedoms are not harmed". Transfers abroad comply with Article 9 of the KVKK (see section 5).
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, request information about it, learn the purpose of processing and whether it is used for that purpose, know the third parties in Türkiye or abroad to whom it is transferred, request correction of incomplete or inaccurate data, request erasure or destruction under the conditions in Article 7, request that correction and erasure be notified to third parties to whom data was transferred, object to a result against you arising exclusively from automated analysis, and claim compensation for damage caused by unlawful processing.
You can apply in writing or via registered electronic mail in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, or through the channels in section 11; we conclude requests within 30 days at the latest depending on their nature. If your application is rejected, you find the answer insufficient or we do not answer in time, you may file a complaint with the Personal Data Protection Board (kvkk.gov.tr).
9. Additional rights for EEA users (GDPR)
If you are in the European Economic Area, we process your data under the General Data Protection Regulation ("GDPR") on these legal bases: performance of a contract (Art. 6(1)(b); account, sign-in, orders, support), legal obligation (Art. 6(1)(c); accounting records) and legitimate interests (Art. 6(1)(f); security, abuse prevention, error tracking, cookie-free statistics, backups). You may object to processing based on legitimate interests on grounds relating to your particular situation.
Under Articles 15–22 GDPR you have the rights of access, rectification, erasure ("right to be forgotten"), restriction, data portability and objection, and you are not subject to automated decision-making. You may also lodge a complaint with the data protection supervisory authority in the EEA country where you live, work or where you believe an infringement occurred (list of authorities). Transfers outside the EEA are protected by the safeguards in section 5.
10. Additional rights for UK users (UK GDPR)
If you are in the United Kingdom, your data is processed under the UK GDPR and the Data Protection Act 2018 on the legal bases listed in section 9. You have the rights of access, rectification, erasure, restriction, portability and objection. We ask that you contact us first, but you may complain at any time to the Information Commissioner's Office (ico.org.uk). Transfers outside the UK use UK adequacy regulations or the International Data Transfer Addendum (IDTA Addendum).
Children's privacy
The Site is not intended for anyone under 18 and we do not knowingly collect data from people under 18. To open a Discord account you must meet Discord's minimum age. If you believe someone under 18 has given us data, contact us and we will delete the account.
Security
All connections are encrypted with HTTPS; sessions and verification codes are stored only as one-way digests; secret keys are kept only on the server; admin actions require extra confirmation; and regular backups are taken. No system is completely risk-free; if a data breach occurs we will inform the relevant authority and affected users within the legal deadlines.
Changes
We may update this policy from time to time. The current version is always on this page and the "Last updated" date above changes. We announce important changes on the Site or on our Discord server.
11. Contact
For any question or request about this policy or your data:
- Data controller: SHIELD
- Email: [email protected]
- On the Site: after signing in, the contact form or the Messages page
- Discord: a support request on our Discord server