1. Who we are
WaveBank is run by HeavyTesting / HVTLabs ("HVTL," "we," "us"). This policy covers the WaveBank Discord bot, the WaveBank website and dashboard, and any other services or features we offer now or later (the "Services"). HVTL is responsible for your personal information as described here. Contact: wavebank@email.hvtlab.net.
2. The short version
- We collect what the Services need to work: your Discord ID and username, your accounts and balances, and the economies and servers you're part of.
- We don't keep a history of your payments in our database. Activity is posted to Discord log channels instead.
- We can't read your Discord messages, and we never see your Discord password.
- We don't sell your personal information, and we don't show ads.
- Optional permissions, like letting WaveBank see your server list or add you to linked servers, are only used if you allow them through Discord, and you can withdraw them.
3. What we collect and how long we keep it
| Information | Why we use it | How long we keep it |
|---|---|---|
| Your Discord user ID, username and display name | To know whose accounts are whose, and to show names in panels, on the website and in logs | While you use the Services |
| Bank accounts: names, numbers, balances, frozen status | To run economies | Until the account is closed or wiped, or the economy is deleted |
| Economies: name, currency, settings, owner, team permissions, linked servers (IDs and names), log channel IDs | To run and manage economies | While the economy exists, and up to 30 days after it's deleted (so it can be restored) |
| Restrictions (bans, freezes, link bans): who, why, who set them, until when | Moderation by economy teams and by HVTL | Until lifted or expired; platform bans until lifted |
| Income collection times and rate-limit counters | So income can be collected once per period, and to stop spam and abuse | Counters about a day; collection times while the economy exists |
| Your acceptance of our Terms and other agreements (which ones, which version, when) | To record what you agreed to | While you use the Services, and afterwards as long as needed to show what was agreed |
| Log posts and direct messages waiting to be sent | To deliver them reliably | Deleted once sent, or after 7 days if they can't be |
| Error reports (what failed, who and where) | To find and fix problems | 14 days |
| Staff records (which staff member looked at or changed what, and why) | To keep staff access accountable | Posted to HVTL's staff log channels |
| Website sign-in: your Discord ID, username, avatar and email address, as Discord shares them with our sign-in provider | To sign you in to the dashboard and keep your account secure. We don't send you marketing email. | While your website login exists |
| Your Discord server list, only if you press "Show servers I can link" and allow it on Discord's page | To show which of your servers you can link, and what's missing | Not stored: read when you ask, then discarded |
| Permission to add you to servers, only if you allow it on Discord's page (when this feature is available) | To add you to Discord servers linked to economies you belong to or choose to join | Stored encrypted until you withdraw it, it expires, or you ask us to delete your data |
| Invite links WaveBank creates for linked servers (when this feature is available) | To let members of an economy join its linked servers | Until the invite expires or the server is unlinked |
| Purchases of paid features (when available): what you bought, when, and its status. Your card details are handled by the payment provider, not us. | To provide what you paid for, handle billing questions, and meet tax and accounting rules | As long as the law requires for financial records |
| Messages you send us (support requests, reports, emails) | To answer you and keep the Services safe | As long as needed to resolve the matter, then up to 2 years |
| Website analytics, only if you accept analytics cookies: pages visited, clicks on buttons and links, page speed, errors, device and browser type, approximate country, and a random visitor ID. Clicked text and details on the dashboard are hidden, and numbers that could identify you are removed from addresses. | To understand which parts of the website are used, and to find and fix problems | Kept in PostHog under the retention limits of our PostHog plan, unless we delete it sooner. You can stop new collection at any time under Cookie settings |
| Technical data handled by our hosting providers (such as IP addresses and request logs) | To deliver the website and Services securely | Kept briefly by those providers, under their policies |
We don't store a history of payments, income or other money movement in our database. Each payment shows you a receipt, the receiver gets a direct message, and the details are posted to log channels as described below.
4. Discord log channels
WaveBank posts activity to Discord channels, where it's then held under Discord's and that server's control:
- Economy log channels, chosen by each economy's team: payments (amount, sender, receiver, note), moderation, settings, team and account changes, and new members.
- HVTL staff channels: the same kinds of events across all economies, new users, errors, staff actions, and every command, button and form used with what was typed into it. Secret keys such as ECOKEYs are hidden.
Once posted, these messages are stored by Discord. WaveBank doesn't keep a copy. Deleting your WaveBank data doesn't delete messages already posted in Discord.
5. How we use information
- To provide the Services you ask for, including economies, payments, income, moderation tools, the dashboard, and features we add later.
- To keep the Services secure and fair: preventing spam, fraud, cheating and abuse, and enforcing our Terms.
- To provide support and tell you about changes to the Services or our terms.
- To fix problems and improve the Services, for example by looking at errors and how features are used.
- To meet legal obligations and respond to lawful requests.
If the law where you live requires a legal basis (for example in the EU or UK), we rely on: performing our agreement with you; our legitimate interests in running secure, working Services; your consent for optional permissions and for website analytics (which you can withdraw at any time); and legal obligations.
6. Who can see your information
- You: your own accounts, in Discord and on the dashboard.
- Economy teams: members' names, accounts, balances and restrictions in their economy, depending on their permissions, and whatever is posted to that economy's log channels.
- Other members: your name when you pay them or appear in shared panels or logs.
- HVTL staff: when operating the Services, providing support, investigating problems or enforcing our Terms. Staff access is logged.
- Service providers that run the Services for us, under contracts that limit how they use data: Supabase (database, the bot, and website sign-in), Cloudflare (website hosting), Discord (where the bot runs and messages are delivered), PostHog (website analytics, US servers, only if you accept analytics cookies), and, when used, a payment provider and an email provider.
- Others when required: if the law requires it, to protect people's safety or our rights, or as part of a merger, acquisition or sale of assets (with notice where required).
We don't sell your personal information or share it for targeted advertising.
7. What we don't collect
- Your Discord messages. WaveBank only sees the commands, buttons and forms you use with it.
- Your Discord password. Signing in happens on Discord's own page.
- Your full payment card details. Payments, when available, are handled by the payment provider.
8. Cookies and your browser
The website never uses advertising cookies. It uses essential storage in your browser, and analytics cookies only if you allow them.
Essential (always on, because the site needs them):
- Your cookie choice, so the banner isn't shown again.
- If you sign in: your sign-in session, so you stay signed in. Signing out removes it.
- While you link a server: which dashboard page to return to after Discord's permission page. It's removed as soon as you're back.
Analytics (off unless you choose "Accept all" or turn it on in Cookie settings): PostHog sets a cookie and browser storage (names starting with ph_) holding a random visitor ID, so we can count visits and see how the site is used. It records pages visited, clicks, page speed and errors. We don't identify you, record your screen, or send your name or Discord ID, and on the dashboard the text and details of what you click are hidden. The data goes through our own website address to PostHog's servers in the United States. If your browser sends "Do Not Track" or "Global Privacy Control", analytics stays off.
You can change your mind at any time: open Cookie settings (also in the footer of every page). Turning analytics off stops it and removes PostHog's cookie and storage from your browser.
Fonts and every other part of the site are served from WaveBank's own website, so loading a page doesn't contact Google or other third parties.
9. Where your information is processed
Our database and bot run in the United States (AWS us-west-2, Oregon, through Supabase), and our providers may process data in other countries. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for transfers.
10. Security
We protect information with access controls, encryption in transit, secrets kept out of code, and logging of staff access. Permissions you give through Discord that we need to keep (such as permission to add you to servers) are stored encrypted. No system is perfectly secure; if a breach affects your information, we will notify you and the authorities as the law requires.
11. Your rights and choices
- See or copy the information we hold about you.
- Correct information that's wrong.
- Delete your information. This removes your accounts and balances in every economy, and can't be undone.
- Withdraw permissions you gave through Discord at any time in Discord (User Settings, Authorized Apps) or by asking us.
- Object or restrict certain uses, where the law gives you that right.
Ask at wavebank@email.hvtlab.net or in the WaveBank support server. We may need to confirm the request comes from your Discord account. We will answer within the time the law requires (usually 30 days in the EU and UK, and 45 days in US states with privacy laws). If you're in the EU or UK, you can also complain to your local data protection authority. Residents of US states with privacy laws, including California, have these rights too, and we won't treat you differently for using them. If we refuse a request, you can appeal by replying to our answer.
Some information may be kept after a deletion request where we need it to meet legal obligations, resolve disputes, prevent abuse (for example, a record that an account was banned), or enforce our agreements.
12. Children
The Services are for people who are at least 13 years old, or the minimum age to use Discord in their country if that is higher. We don't knowingly collect information from children under 13. If you believe a child under 13 is using the Services, contact us and we will delete their information.
13. Changes to this policy
We will update this policy as the Services change, for example when we add features. If a change is important, we will tell you through the Services and update the date above, and ask for your consent again where the law requires it.
14. Contact
HeavyTesting / HVTLabs (also known as HVTL)
Email: wavebank@email.hvtlab.net
Support: the WaveBank support server at discord.gg/BjpgZKMZst