Privacy Policy

Please read this Policy before accessing or using the Services. The Services may expand or change at any time, with or without prior notice, at Boomerang’s discretion. By accessing or using the Services, you acknowledge that your data is processed in accordance with this Policy. If you disagree with any part of this Policy, do not use the Services.

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify you through the Services or other appropriate means. The effective date appears above. Continued use after the effective date constitutes acceptance of the updated Policy.

• Public user information (usernames, unique identifiers, and avatars).
• Public server (guild) information (names, unique identifiers, roles, icons, and channels).

Administrators who connect or configure the App acknowledge that related configuration and usage information they submit may be logged to our systems to operate and troubleshoot the Services.

• Configuration data (roles, channels, strings, options, and settings you provide or adjust).
• Feature and command parameters needed to deliver functionality.

• Command, feature, and API usage logs (user, command or endpoint, parameters where relevant, timestamps, server identifiers, and technical metadata).
• Device and technical data (IP address, user agent, log files, diagnostics, performance metrics, and crash reports).

Content you submit when opening a support ticket through our Discord server, together with any categorisation, routing information, or draft responses generated from that content.

We use cookies and similar technologies on the Site. See the "Cookies and Tracking Technologies" section for details.

• Provide, operate, and maintain the Services.
• Configure and deliver features you choose to use.
• Provide customer support and respond to enquiries.
• Analyse and route support requests submitted through our Discord server using automated tools, including generating draft responses for review.

• Monitor, secure, and protect the Services, including fraud prevention and abuse detection.
• Comply with legal obligations and enforce our Terms of Service.

• Analyse Service usage to improve reliability, performance, and user experience.
• Conduct aggregated, de-identified analytics and reporting.

• Process payments and manage subscriptions.
• Communicate about billing, changes, and service updates.

If you purchase access to the Services, payments are processed by third-party providers including Stripe and Chargebee. Boomerang does not store full payment card details.

Information handled by payment processors is subject to their privacy policies and compliance frameworks (for example, PCI DSS). You should review their privacy policies for details: stripe.com/privacy and www.chargebee.com/privacy/.

• Essential cookies: required for core functionality.
• Functional cookies: remember preferences and settings.
• Analytics cookies: help us understand usage and improve the Services.

Where required by law, we request consent for non-essential cookies. You can control cookies through your browser settings; disabling cookies may affect functionality.

We use analytics and monitoring providers to help operate, measure, and improve the Services, including Mixpanel and New Relic.

• Mixpanel: product analytics for feature usage and engagement. Privacy Policy: mixpanel.com/legal/privacy-policy/
• New Relic: performance and availability monitoring. Privacy Policy: newrelic.com/termsandconditions/privacy

These providers may receive pseudonymous identifiers, event data, and technical telemetry. We configure them to avoid collecting unnecessary personal data and to respect applicable platform policies.

Where required by law, we request consent for analytics cookies and similar technologies. Some providers offer their own opt-out mechanisms; consult their policies for details.

We do not sell personal data. We may disclose personal data to service providers and processors (e.g., hosting, storage, security, analytics, payments) under appropriate contracts.

We use Groq as an AI inference provider to process support requests submitted through our Discord server. Groq acts as an independent processor, does not sell or share this data, and retains it only as long as necessary to provide the service. Privacy Policy: groq.com/privacy-policy/

We may share information with platform partners (e.g., Discord) in line with your authorisations and their policies.

• Professional advisers (e.g., legal, accounting) under duties of confidentiality.
• Law enforcement, regulators, and courts where required by law or to protect rights, safety, and the integrity of the Services.
• Transferees in connection with a corporate transaction, subject to appropriate safeguards.

Your information may be transferred to, stored in, and processed in countries other than your own. Our primary infrastructure is hosted in the United States of America, including New York and other destinations, and in other jurisdictions where our providers operate.

If you are outside Australia and choose to provide information, you acknowledge that your data may be transferred to and processed in Australia and the United States. Where required by law (e.g., UK or EEA), we implement appropriate safeguards for international transfers, such as standard contractual clauses or equivalent mechanisms.

We implement administrative, technical, and organisational measures designed to protect personal data. No system is perfectly secure, and transmission over the internet carries inherent risks.

Only authorised personnel may access user data for legitimate purposes and subject to confidentiality obligations. We continuously work to improve safeguards and limit sensitive data collection.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

Operational logs and analytics may be retained for longer periods where needed for security, auditing, and improvement, and may be aggregated or de-identified.

Subject to applicable law, you may have the right to access, rectify, erase, or port your personal data, and to restrict or object to certain processing. Where processing relies on consent, you may withdraw consent at any time; this does not affect the lawfulness of processing prior to withdrawal.

To exercise your rights, email [email protected] with sufficient detail to identify you and your request. We may need to verify your identity. We do not accept such requests via our support server, direct messages, or other channels.

Residents of some jurisdictions may also have the right to lodge a complaint with a supervisory authority. In Australia, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au/.

You may request deletion of personal data by emailing [email protected]. We will assess and action requests in accordance with applicable law and our operational requirements. Certain records (for example, security logs or audit trails) may be retained where we have a lawful basis, including for safety, fraud prevention, and compliance.

If we delete your core account data, your ability to use the Services will cease. Publicly available artefacts or de-identified operational records may be retained where legally or operationally necessary.