Privacy Policy

New Haven Roleplay is a community-run VMenu FiveM (Grand Theft Auto V) roleplay server, together with its supporting website and Discord. For the purposes of data protection law, New Haven is the "data controller" responsible for your personal data.

For any privacy-related request or question, contact us through the New Haven Discord (discord.gg/nhrpjoin) by opening a ticket or messaging a member of staff.

When you sign in with Discord and use the Website, we collect and store the following:

• Discord account ID. Your unique Discord user ID.
• Discord username. Your display name on Discord.
• Discord avatar. The URL of your profile picture.
• Email address. The email associated with your Discord account, provided through the Discord "email" permission.
• Discord server roles. Your roles within the New Haven Discord, read at the time of a request to determine your access and eligibility.
• Application and appeal data. The answers you submit in department applications, staff applications and ban appeals, along with their status, review notes, reviewer, and timestamps.
• Authentication tokens. Session tokens (and, where applicable, OAuth tokens) used to keep you signed in securely.

We do not knowingly collect payment details through this Website, and we do not collect special categories of data such as health, ethnicity or political opinions. Please do not include such information in free-text application answers.

We process your personal data for the following purposes and on the following legal bases:

• To provide the Website and your account (authentication, keeping you signed in, showing your profile and application history). Legal basis: performance of a contract, being our provision of the service you request.
• To process and review applications and ban appeals, and to notify you of the outcome via Discord. Legal basis: performance of a contract, and our legitimate interests in running the community.
• To assign in-community roles and verify eligibility. Legal basis: legitimate interests.
• To maintain safety and security (rate limiting, preventing abuse, moderation and enforcement of our rules). Legal basis: legitimate interests.
• To contact you where necessary about your account, application or appeal. Legal basis: legitimate interests, and performance of a contract.

We rely on trusted third-party providers to operate the Website. Your data may be processed by them solely to provide these services:

• Discord. Authentication (OAuth), role lookup and notifications.
• Vercel. Website hosting and delivery.
• Supabase. Database hosting for the data described above.
• Upstash. Rate-limiting infrastructure.
• Groq. Powering the website's support assistant. Messages you send to the assistant are processed to generate a reply.

Each provider processes data under its own privacy terms. Some of these providers may process data outside your country; where they do, appropriate safeguards such as standard contractual clauses are relied upon. We do not sell your personal data to anyone.

We keep your account and application data for as long as your account exists and for as long as needed to run the community, handle appeals, and enforce our rules. Application and ban-appeal records may be retained after a decision for moderation history and to prevent abuse. When data is no longer needed, or when you ask us to delete it (see your rights below), we will delete or anonymise it, unless we are required to keep it for legitimate safety or legal reasons.

Under the GDPR and UK GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data (the "right to be forgotten").
• Object to, or request restriction of, certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent where we rely on it, at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us through the New Haven Discord. We may need to verify your identity, for example by confirming your Discord account, before acting on a request.

We take reasonable technical and organisational measures to protect your data. Access to the database is restricted, our database uses row-level security, session cookies are HTTP-only and secure, sensitive actions are rate-limited, and access to admin tools is restricted to authorised staff by Discord role. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use a single essential cookie (nh-session) to keep you securely signed in. This cookie is strictly necessary for the Website to function and is not used for advertising or third-party tracking.

The Website and server are not intended for children under the age required to hold a Discord account in their country (generally 13, or higher where local law requires). If you believe a child has provided us personal data, contact us and we will remove it.

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Significant changes may also be announced in the New Haven Discord. Your continued use of the Website after an update means you accept the revised policy.