Privacy Policy

Who is responsible

BST is the responsible party for personal information processed through this website. Privacy contact: our contact form (choose "Privacy request").

What we collect, and why

• Your BST account (Discord sign-in): when you sign in with Discord we receive your Discord user ID, username, display name and avatar. We never receive or ask for your Discord password, and we discard the Discord access token immediately after reading your profile. Purpose: to create your account and link your orders to your permanent Discord ID.
• Discord server membership: our bot may check whether your Discord ID is a member of, or banned from, the BST Discord server. Purpose: account linking, role assignment and moderation.
• Orders: the package, price, optional note and status history. Purpose: to process and fulfil your order.
• Account security log: sign-ins, new devices, sessions, order submissions, significant account changes and restrictions, with the time, IP address, browser, device and operating system category, and approximate country. You can see your own security history in Account security. Purpose: protecting your account and investigating abuse.
• Support, contact and partner messages: your Discord username or email, optional name, topic and message. Purpose: to answer your enquiry or review your application.
• Website security records: time, page visited, a random session identifier, IP address and browser/device category for every visit, and whether the visit looks automated. Purpose: securing the website and preventing fraud and abuse.
• Optional analytics (only with your consent): referring website, device, browser and country breakdowns, and whether you have visited before.

IP addresses come only from our own web servers, never from Discord. We do not use advertising trackers, invasive browser fingerprinting or third-party geolocation services. An IP address on its own is never treated as proof of who someone is.

Legal basis

We process account, order and support data to provide the service you request. We process security records for our legitimate interest in keeping the website and accounts secure and preventing fraud. Optional analytics are processed only with your consent, which you can withdraw at any time. This is consistent with South Africa's Protection of Personal Information Act (POPIA) and other applicable privacy law.

Cookies

• Essential (always on): bst_sid (random visit identifier, ends when you close the browser), bst_session (keeps you signed in, up to 30 days), bst_consent (remembers your cookie choice), bst_admin (staff sign-in only).
• Analytics (only if you allow it): bst_rv marks returning visits, for up to one year.

You can change your choice at any time with the "Cookie settings" link in the footer. Rejecting analytics does not affect security logging, which is required to operate the site safely.

Who can see it

Access is limited to authorised BST administrators, with role-based permissions. IP addresses are shown masked by default, and viewing a full IP address requires a documented reason that is logged. Minimal, masked details (for example 203.0.113.xxx) are sent to private Discord channels operated by BST for order and security notifications. Discord processes that content under its own terms. We never publish visitor IP addresses.

Retention

Website and account security records, and full IP addresses on sessions, are deleted automatically after 30 days. IP addresses attached to orders and support messages are removed after 365 days. Consent records are kept for 365 days as proof of your choice. Orders themselves (package, price, status) and moderation records may be kept longer for accounting, dispute and safety purposes.

Your rights

You may ask to access, correct or delete personal information we hold about you, or object to its processing. Signed-in customers can submit an access or deletion request from Account security; otherwise use the privacy contact above and include your order ID or Discord username. You may also complain to the Information Regulator (South Africa) or your local data protection authority.

Security

The site uses HTTPS in production, server-side access control, multi-factor authentication for administrators, audit logging of access to sensitive records, and encrypted storage of integration secrets.

Last updated: 29 October 2026. These documents describe how the service operates and should be reviewed against your actual practices and local law before relying on them.