LEO Privacy Policy

Last updated: October 28, 2026

LEO ("Service") places importance on the personal information of users and complies with the Personal Information Protection Act and related laws. This Policy describes the items of personal information collected by the Service, collection methods, purposes of use, retention periods, provision to third parties, destruction procedures, users' rights and how to exercise them, and other matters.

Article 1 (Items and Methods of Personal Information Collected)

The Service collects the following personal information.

Information Item	Collection Method	Purpose of Collection and Use	Retention Period
Discord user ID (numeric)	Discord bot events, OAuth2 login	Identification of leveling data, provision of the Service	For the period of use of the Service, or until server data is deleted
Discord server (guild) ID	Discord bot events	Per-server data isolation and management	For the period of use of the Service, or until server data is deleted
Chat XP, voice XP, levels	Automatic recording of message and voice channel activity	Operation of the leveling system, provision of statistics	For the period of use of the Service, or until server data is deleted
Discord OAuth2 access token	When logging in to the web administration panel	Administrator authentication and verification of permissions	Immediately destroyed upon termination of the login session
LEO AI conversation records (questions, answers, settings, channels and message content queried by the AI, approval/rejection of changes, raw responses from the AI provider)	When using LEO AI in the web panel or Discord (only when the operator has enabled collection)	Improvement of LEO AI response quality and model training	Until deleted by the operator or until exclusion is requested by the server administrator

Before storage, LEO AI conversation records have Discord IDs replaced with irreversible pseudonymous IDs, and server names, email addresses, tokens and API keys are removed. Server administrators may remove their own server from the training data at any time on the LEO AI page of the web panel, and upon removal, the records collected from that server are also deleted immediately.

The Service does not collect personally identifiable information (PII) such as name, email address, phone number or postal address. The Discord user ID is an internal identifier of Discord and is not directly linked to a real name.

Article 2 (Purposes of Collection and Use of Personal Information)

The Service uses collected personal information for the following purposes.

• Operation of the per-server leveling system (XP accrual, level calculation, automatic role assignment)
• Authentication for the administrator-only web management panel and management of access rights
• Generation of server activity statistics and dashboard data
• Service improvement and error analysis
• Improvement of LEO AI response quality and AI model training (pseudonymized conversation records)
• Handling of user inquiries and complaints

Article 3 (Retention and Use Period of Personal Information)

• User leveling data is retained for as long as the relevant Discord server uses the Service.
• If the server administrator requests deletion of data, or if the bot is removed from or leaves the relevant server, the related data is destroyed without delay.
• The OAuth2 access token is temporarily held only within the server session (memory) and is destroyed immediately upon logout or session expiry. It is not stored permanently.
• Where retention is required under applicable laws, the information may be retained for the period prescribed by such laws.

Article 4 (Provision of Personal Information to Third Parties)

In principle, the Service does not provide users' personal information to third parties. However, the following cases are exceptions.

• Where the user has given prior consent
• Where required by the provisions of laws, or where an investigative authority makes a request for investigation purposes in accordance with the procedures and methods prescribed by law
• Where the minimum necessary data is transmitted to Discord Inc. in the course of using the Discord API to provide the Service (the Discord Privacy Policy applies)

Google AdSense advertisements are displayed on the website. Third-party advertising providers, including Google, may use cookies to display advertisements based on users' visit history to this site and other sites. Users may Google Ad Settings to opt out of personalized ads, and for details, see Google Ad Policies.

Article 5 (Outsourcing of Personal Information Processing)

To provide the Service smoothly, the Service does not outsource personal information processing tasks to external parties. If outsourcing becomes necessary in the future, the Service will give prior notice of the outsourcee, the content of the outsourced tasks, the outsourcing period and other details, and will obtain consent where necessary.

Article 6 (Destruction Procedures and Methods of Personal Information)

• Personal information for which the retention period has elapsed or the processing purpose has been achieved shall be destroyed without delay.
• Information in electronic file form is permanently deleted by a method that makes restoration impossible.
• Per-server SQLite database files (db/{guild_id}.db) are securely deleted from the system upon a deletion request from the server administrator or when the bot leaves the server.
• If the backup function is enabled, backup data is subject to a separate retention period and is destroyed after that period has elapsed.

Article 7 (User Rights and How to Exercise Them)

Users may exercise the following rights at any time.

• Access to personal information: Users may view their own leveling data in the relevant Discord server through the /rank command.
• Request for correction or deletion of personal information: Users may make a request to the server administrator or the Service operator via Discord DM or the support channel.
• Request to suspend processing: If you do not wish specific data to be processed, you may request the server administrator to suspend its processing.

The operator shall take action within 10 days from the date of receiving a user's request to exercise rights and notify the result thereof.

Article 8 (Measures to Ensure the Security of Personal Information)

To ensure the security of personal information, the Service takes the following measures.

• Administrative measures: Minimization of access rights to personal information, and regular security training
• Technical measures: Restriction of access to database files, and application of server security patches
• Physical measures: Physical access control over servers and database files (hosting provider's security policies apply)

However, as the Service is a personally operated project and may not have enterprise-grade security infrastructure, backup of important data and additional security measures are carried out under the responsibility of the server administrator.

Article 9 (Chief Privacy Officer)

The Service is responsible for overall matters concerning personal information processing and, in order to handle user complaints and provide remedies for damages, has designated the following Chief Privacy Officer.

Article 10 (Remedies for Infringement of Rights and Interests)

Users may contact the following organizations for relief from and consultation on infringements of personal information.

• Personal Information Infringement Report Center (privacy.kisa.or.kr / dial 118 without area code)
• Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
• Cyber Investigation Division, Supreme Prosecutors' Office (www.spo.go.kr / dial 1301 without area code)
• Cyber Safety Bureau, National Police Agency (cyberbureau.police.go.kr / dial 182 without area code)

Article 11 (Policy Changes and Notice)

• This Policy may be revised in accordance with amendments to relevant laws, changes to the Service's policies, advances in security technology, and the like.
• If this Policy is changed, the changes and the effective date shall be announced in advance, at least 7 days before the effective date, through the Service's notice section or the support channel.
• If there are material changes (such as changes to the items collected or the addition of third-party provision), separate consent may be obtained.