01 Who We Are
Null Labs Limited (RC 9592210), a company registered in Nigeria, operates NullBot ("NullBot", "we", "us"). We are the data controller for personal data processed through every NullBot product listed under Products This Policy Covers, this website and store.nullbot.io (together, the "Service").
This policy explains what we collect, why, who processes it, how long we keep it, and your rights under the data protection laws that apply to you, including the EU and UK General Data Protection Regulation (GDPR), US state privacy laws such as the California Consumer Privacy Act (CCPA), and the Nigeria Data Protection Act 2023. The general sections apply to every product; each product also has its own section. Contact us about your data at any time on Discord.
02 Products This Policy Covers
- NullBot Dashboard, the web app at app.nullbot.io.
- NullBot Minter, a Discord app.
- NullBot Intelligence, a Discord app.
- NullBot Verify, a Discord app.
- NullBot Raffles, a Discord app and the website raffles.nullbot.io.
- The NullBot Telegram bot.
- NullBot on X, the NullBot X account.
- NullBot RPC, paid blockchain API access, managed at console.nullbot.io and served at rpc.nullbot.io.
Your Dashboard, Telegram, Minter and Raffles identities can belong to one NullBot account. Where they are linked, data from one product can be shown in another, for example your wallets and plan.
03 Data We Collect Across NullBot
Account data: the identifiers of the sign-in methods you use or link, such as your Google or X sign-in (through Clerk), Telegram user ID, Discord user ID and username, and X user ID and handle. Each product section lists exactly what it stores.
Wallet data:
- The public addresses of wallets you create, import or enter.
- For wallets you create or import in the Dashboard, the Telegram bot or NullBot Minter: their private keys, encrypted with AES-256 before storage. A key is decrypted in memory only to sign a transaction you set up. Keys are never logged or shared.
- We never request or store a seed phrase.
Activity data:
- Mint jobs, Copy Mint mirrors, Automation (Auto Sell) configs, gas and sweep settings, and notification preferences.
- The history of mints and transfers we run for you, and of the listings, offer acceptances, cancellations and sales Auto Sell makes for you.
- Notifications we send, and support tickets you open.
Payment data: your personal deposit address, the amount, network and transaction hash of each subscription payment, and whether you opened that checkout in the Telegram bot or on the Dashboard. We never handle cards or bank details.
Security data: a log of account actions such as key exports, wallet imports, plan changes and account links, and a sign-in record each time you start a new session on the Dashboard or NullBot Raffles. A sign-in record holds the IP address, the approximate location Cloudflare derives from it (country, and region and city where Cloudflare provides them), and the device and browser from your browser's user agent. We use these to protect your account, spot account takeover and abuse, and help you with support.
04 NullBot Dashboard
- Sign-in: you sign in with Google or X through Clerk, our sign-in provider. Clerk holds your email address, name and profile picture, and the Dashboard shows them to you. Our database stores only your Clerk user ID, linked to your NullBot account.
- Data: the account, wallet, activity and payment data described above.
- Analytics: a random visitor ID stored in your browser, the pages you open, how long they stay open, and your country (from Cloudflare). If you are signed in, visits are linked to your account. We do not store your IP address with page visits.
- Sign-in records: when you start a new session, we keep the IP address, approximate location and device described under Security data. Our team can see them when supporting or securing your account.
- Automation: if you create an Auto Sell config, we store it and run it as described in our Terms, including placing listings and accepting offers on OpenSea from your wallets.
- Push notifications: if you turn them on, your browser's push endpoint and keys, and your browser's user agent.
- Who can see it: you, and our team where needed to run and support the Service.
05 NullBot Minter (Discord)
- What it does: minting, scheduling, wallets, history and eligibility checks inside a Discord server.
- Discord permissions: View Channels, Send Messages, Read Message History, Embed Links, Attach Files, Add Reactions, Manage Messages, Manage Channels and Manage Roles. It uses the Server Members and Message Content intents.
- Messages: Minter receives messages in channels it can see, but only acts on a message that mentions it. It then reads that message, and the message it replies to, to understand the request. It does not store other messages.
- Account data: the first time you use Minter, we create a NullBot account for you with your Discord user ID and username. You can link it to your Telegram account with a one-time code.
- Other data: your wallets, jobs, history and settings; the private channels and roles Minter creates for you; in-progress command steps; and the server's settings, plan and payments.
- Usage counts: we count how many members use Minter in each server each day. Member IDs are used only in memory for this; only the count is saved.
- Who can see it: you. Server staff see the server's settings and plan. Replies Minter posts in a public channel are visible to that channel.
06 NullBot Intelligence (Discord)
- What it does: posts mint and volume alerts about NFT collections into a server. Alerts contain public on-chain and marketplace data, not personal data.
- Discord permissions: View Channels, Send Messages, Read Message History, Embed Links and Manage Channels. It uses no privileged intents and does not read members' messages or member lists.
- Server data: the server's alert channels, ping roles and on/off settings. This is deleted when the app is removed from the server.
- When you tap Mint on an alert: your Discord user ID, the server, channel and message are passed to NullBot Minter so it can start the mint for you. Minter discards a request it has not picked up within 60 seconds.
- AI comments: alerts can include a short comment written by an AI provider (xAI). Only public collection, mint and market data is sent to write it, never member or personal data.
- Usage counts: per server per day, the number of alerts posted and of Mint and OpenSea button taps. These are totals, not linked to members.
- Who can see it: server staff see the settings. Alerts are visible to everyone who can see the alert channels.
07 NullBot Verify (Discord)
- What it does: checks new members with a captcha (a code shown in an image, entered with buttons or typed), and optionally a DM check and a rules step, before giving them the server's Verified role.
- Discord permissions: View Channels, Send Messages, Read Message History, Embed Links, Attach Files, Manage Channels, Manage Roles, View Audit Log, Kick Members, Ban Members and Moderate Members. It uses the Server Members intent to see when members join, and reads the audit log only to find who added the app so it can send them setup help.
- During a check: a salted hash of the correct answer, the keys you have entered and your progress, held for up to 5 minutes. We never store the answer itself. A flag that you passed is kept for 24 hours.
- Failed attempts: for each member and server, the number of failed attempts, any cooldown and the time of the last failure. This is deleted when you pass or when the server's final action applies.
- Event log: a record of verification events per server, such as passed, failed, action taken, code used, lockdown and Raid Shield, with the member's Discord user ID where one applies. Events are deleted after 90 days.
- Raid Shield: the Discord user IDs of recent joiners, kept for up to 2 hours so staff can act on a raid.
- Access codes: codes created by staff, with the Discord user ID of the staff member who created them.
- Not collected: Verify has no web page and does not collect your IP address, browser, username or messages.
- Who can see it: if a server sets a staff log channel, Verify posts events there, mentioning the member. Server staff also see daily and weekly totals. When the app is removed from a server, that server's Verify settings, codes, attempts and events are deleted.
08 NullBot Raffles
Sign-in and linked accounts:
- Sign-in is handled by Clerk, the same sign-in provider as the Dashboard. You can sign in with Discord, X or Google, and link the others later.
- From Clerk we copy into your Raffles profile your Discord user ID, username, display name and avatar, your X handle, and your Google email address, for whichever of these you have linked.
- Discord: sign-in asks for the identify and guilds scopes. We use your server list only to show which servers you can create a team for, and to check server and role requirements. Entering a raffle needs a linked Discord account, because winners are announced and messaged in Discord.
- We never read your X posts or followers, and never access your Gmail, Drive or any other Google service.
- Your Raffles sign-in uses the same NullBot account as other NullBot products.
Data we store:
- Wallets: up to 5 public addresses per network (EVM, Solana, Bitcoin and Zcash). Only public addresses, never private keys.
- Entries: for each raffle you enter, your Discord user ID and username, your X handle, the wallet you entered, whether you entered on the web or in Discord, and the time.
- Tasks: when you open an X task link, we record that you opened it and when. We do not check X to see whether you completed it.
- Draws: the random seed used to draw winners, members skipped because they no longer met a requirement, and re-rolls with their reason and who ran them.
- Teams and servers: team details and members, the Discord server's ID, name, icon and owner, and the channels and roles used for posting.
- Sessions: a session record with a hashed session token, the time you were last seen and your browser's user agent, plus the sign-in record described under Security data.
- We do not record your IP address or device with entries or task clicks.
Who can see it:
- Hosts (team owners, admins and managers) see the entries to their raffles. Team managers and above can download a CSV of winners with each winner's Discord ID, Discord username, X handle, wallet and draw time.
- Once winners are announced, their Discord username and avatar, X handle and wallet are shown publicly on the raffle page, and winners are mentioned in the host's Discord channel and sent a DM.
- Hosts are responsible for how they use winner data after they download it.
Project profiles: to show project pictures and banners, we fetch the public X profile picture and banner of project accounts through FxTwitter (a free service that reads public X profiles) and store a copy. This covers project accounts only, not entrants.
Discord permissions for the Raffles app: View Channels, Send Messages, Read Message History, Embed Links, Mention Everyone and Use External Emojis. It uses no privileged intents. When it is added to a server, it sends the server owner a setup DM.
Unlinking and removal: you can unlink X or Google and remove wallets at any time on your account page. Signing out deletes your session. Discord is your sign-in method, so it cannot be unlinked; ask us to delete your account instead.
09 Telegram Bot
- Data: your Telegram user ID, username and first name, when you were last active, your settings, when you accepted the Terms, and the account, wallet, activity and payment data described above.
- Linking: you can link Discord and X to your account with one-time codes from the bot.
- Who can see it: you, and our team where needed to run and support the Service.
We are moving features to Discord and the web, and over time the Telegram bot will focus on notifications.
10 NullBot on X
- If you link your X account, we store your X user ID and handle.
- When you mention NullBot in a public post, we read that post to understand the request.
- NullBot may reply publicly. Replies can show the collection, the result and the transaction, which anyone on X can see.
11 NullBot RPC
NullBot RPC gives you paid JSON-RPC access, over HTTPS and WebSocket, to Ethereum, Robinhood, Ink and Arc, served from our own nodes. You manage it at console.nullbot.io and send requests to rpc.nullbot.io.
Data we store:
- Account: you sign in with Google or an emailed code through Clerk. The console has its own sign-in, separate from our other products: signing in to the dashboard or Raffles does not sign you in here. Clerk holds your email address and how you sign in, and our database links your Clerk user ID to your NullBot RPC account. Starting a new session creates a sign-in record (IP address, approximate location and device), as described under Security data.
- API keys: up to 2 per account on Starter and 5 on Builder. For each key we store a hash of it, a short prefix so you can tell keys apart, the name you give it, when it was created and when it was last used. We never store the full key; it is shown to you once, when you create it.
- Plan and payments: your plan and paid-until date, and for each checkout its deposit address, the wallet that paid, the transaction hash, the amount and the chain. The payment details are also public on-chain.
- Usage counts: per minute, the number of requests for each method and chain, how many succeeded or failed, how many hit the rate limit, and how long responses took, grouped into time ranges. We show these to you on the console.
What we do not store:
- We never log or store the contents of your requests, such as their parameters, the addresses you query or transaction data, or the responses.
- Our RPC gateway does not record the IP address your requests come from.
- A signed transaction you send with eth_sendRawTransaction is passed to the network, and like any transaction it becomes public on-chain.
Status: the public status shown on the console says only whether the service is operational. It contains no customer data.
Who can see it: you, and our team, who see usage totals and payment status to give support and to prevent abuse.
12 Server Data and Announcements
For every Discord server a NullBot app is in, we keep the server's ID, name and member count, when the app joined and when it was removed, and daily usage totals for that server. We use these to run the apps and to understand their use. We delete a server's records 12 months after the last NullBot app is removed from it.
We send service announcements to servers from our admin tools. Each goes to the server's updates channel, or, if there is none, to the server owner as a DM. We log for each server whether delivery worked. We do not track who reads or clicks announcements.
13 Google User Data
On the Dashboard, signing in with Google requests only the standard openid, email and profile scopes, through Clerk. We use them to create your account, sign you in, and show your name and picture in the Dashboard.
On NullBot Raffles, signing in with or linking Google also goes through Clerk and requests only the openid and email scopes. We use your verified email address to identify your linked Google account.
We do not request access to Gmail, Drive, Contacts or any other Google service. We do not use Google user data for advertising, do not sell it, and share it only with the sign-in provider that processes it on our behalf.
NullBot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
14 How We Use Your Data
- To provide the Service: running the jobs and Automation configs you set up, signing and broadcasting the transactions and marketplace orders they need, verifying members, running raffles, and showing you results.
- To run NullBot RPC: checking API keys, applying rate limits, counting usage and showing it to you.
- To send notifications and announcements to the places you or your server choose.
- To manage your plan, confirm payments and apply account credit.
- To answer support requests and communicate about your account.
- To keep the Service and your account secure, and to detect and prevent fraud and abuse, such as multiple accounts in raffles.
- To understand usage in aggregate and improve the Service.
- To meet legal obligations.
We do not sell personal data or use it for advertising. We do not make decisions about you that produce legal effects based solely on automated processing. Raffle winners are drawn at random, and Verify outcomes follow settings chosen by each server's staff.
15 Lawful Bases
Where the law requires a lawful basis, for example under the GDPR, the UK GDPR and the Nigeria Data Protection Act 2023, we rely on:
- Contract: to provide the Service you signed up for or use. That covers your account, wallets, jobs, notifications, plan, verification, raffle entries, and your NullBot RPC keys and usage counts.
- Legitimate interests: to secure the Service and your account (including sign-in records), prevent abuse, run Discord apps on behalf of the servers that install them, and improve the Service, where those interests are not overridden by your rights.
- Consent: for optional features such as push notifications and linking extra accounts. You can withdraw consent at any time.
- Legal obligation: to keep records the law requires, and to respond to lawful requests.
Data we process under contract is needed to provide the Service; without it, the feature that relies on it cannot work.
17 International Transfers
Our servers and several of our providers are in other countries, including the United States, so your data may be processed outside the country where you live.
When personal data from the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. When it leaves Nigeria, we rely on the safeguards the Nigeria Data Protection Act 2023 permits. Contact us for details of the safeguard that applies.
18 Public Blockchain Data
Transactions on a blockchain are public and permanent. Anyone can see a wallet address and its activity, including mints and subscription payments. We cannot change, hide or delete data once it is on-chain, and your rights over personal data, including deletion, do not extend to public blockchain records.
19 How Long We Keep Data
- Account, wallet and activity data, across all products: for as long as your account exists.
- Payment records and the security log: payment records for 6 years for accounting and tax purposes, and the security log, including sign-in records, for 12 months.
- Dashboard analytics: individual visits for 90 days. After that only daily totals remain, with no link to you.
- NullBot Verify: check sessions for up to 5 minutes, pass flags for 24 hours, Raid Shield join lists for up to 2 hours, failed-attempt records until you pass or the final action applies, and events for 90 days. A server's Verify data is deleted when the app is removed from it.
- NullBot Intelligence: server settings until the app is removed from the server.
- NullBot Raffles: sign-in sessions and linked accounts are held by Clerk, as for the Dashboard. Raffle entries, task clicks, draws and winner data are kept for 12 months after a raffle ends, then deleted.
- Server records and daily usage totals: see Server Data and Announcements.
- NullBot RPC: key records and usage counts for as long as your account exists, like other account data, and RPC payment records like other payment records.
- When you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep it by law or this section gives a longer period.
20 Security
We protect personal data with technical and organisational measures. Private keys and stored sign-in tokens are encrypted at rest, and the encryption key is stored separately from the database. Access to production systems is restricted, each Discord app uses its own restricted database access, and connections to the Service are encrypted in transit.
No system is completely secure. Use dedicated mint (burner) wallets and keep only what you need in them.
If a personal data breach is likely to put your rights at risk, we will notify the relevant data protection authority and, where required, you, within the time the law sets (for example 72 hours under the GDPR).
21 Your Rights
Depending on where you live, you have the right to:
- be informed about how your data is processed
- access your personal data and get a copy of it
- correct inaccurate or incomplete data
- have your data erased
- restrict or object to processing, including processing based on legitimate interests
- receive your data in a portable format
- withdraw consent at any time, without affecting earlier processing
- not be subject to a decision based solely on automated processing that significantly affects you.
Many controls are built in:
- Dashboard: export private keys from Wallets, change or turn off notifications in Account, and remove wallets and mirrors at any time.
- NullBot Raffles: unlink X or Google, and remove wallets, on your account page.
- NullBot RPC: see your usage, and create or revoke API keys, on the console.
- Discord apps: server staff can remove any NullBot app from their server at any time.
To make a request or a complaint about how we handle your data, message us on Discord and say what it is about. We will acknowledge it, may need to verify your identity, and will respond within one month, or sooner where your law requires. We may extend that by up to two more months for complex requests and will tell you if we do. We do not charge for requests unless they are clearly unfounded or excessive. To delete your account, ask the same way. Export your private keys before asking us to delete your account; once it's deleted, they cannot be recovered. Deleting your account does not remove on-chain records, or winner data a raffle host has already downloaded.
You can also complain to a data protection authority, for example the one where you live or work: a supervisory authority in the EU, the UK Information Commissioner's Office, or the Nigeria Data Protection Commission.
22 US State Privacy Rights
If you live in California or another US state with a consumer privacy law, this section adds to the rest of this policy.
In the last 12 months we collected these categories of personal information, from you, from the services you sign in with, and from your use of the Service, for the purposes under How We Use Your Data:
- Identifiers: account and platform IDs, usernames, email address (if you sign in with Google or an emailed code), wallet addresses and IP addresses.
- Commercial information: plans, payments and on-chain transactions you run through NullBot.
- Internet or network activity: pages viewed, actions taken, sign-in records and NullBot RPC usage counts.
- Approximate geolocation: country, region and city derived from an IP address. We do not collect precise geolocation.
- Sensitive personal information: wallet private keys and account sign-in data, used only to provide the Service and keep it secure.
We do not sell personal information, or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share data of anyone under 16. Because we neither sell nor share, opt-out preference signals such as Global Privacy Control have nothing to switch off, and we treat them as a request not to.
You can ask to know, access, correct or delete your personal information, and to limit the use of sensitive personal information. Ask on Discord; an authorised agent can ask for you with your signed permission. We will verify the request, respond within 45 days, and will not treat you differently for using these rights. If we refuse, you can appeal by replying to our answer, and if we turn down the appeal you can contact your state attorney general.
24 Children
The Service is only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
25 Changes to This Policy
We may update this policy. We will change the "Last updated" date and, for material changes, tell you in the product you use before they take effect.
26 Contact
Null Labs Limited (RC 9592210), Nigeria. Discord.
See also our Terms of Use and FAQ.