Lumen's Discord bot asks for exactly six permissions, and every one of them is read-only. It cannot post, change a role, remove a member, or touch a single setting on your server.
For your community's data, you are the controller and ELO Studio Ltd acts as your data processor under Article 28 of the GDPR. A Data Processing Agreement is available on request.
Core data infrastructure runs in the EU: Supabase (Ireland) for the database, Hetzner Online GmbH (Helsinki, Finland) for bot hosting. Other processors are bound by data processing agreements.
Account data is kept while your account is active and for six months after termination. Discord message, member, presence and moderation data is retained for 12 months.