OPSCOM ("OPSCOM", "we", "us") is an online platform for managing military simulation (milsim) communities, available at https://opscom.one. OPSCOM is run by OPSCOM, registered with the Netherlands Chamber of Commerce (KvK) under number 42049425.
Contact for privacy matters: opscom.contact@gmail.com
This policy explains what personal data we process, why, who we share it with, how long we keep it, and what rights you have. It should be read together with our Terms of Service.
Signing in requires a Discord account. With your permission, Discord shares the following with us (OAuth scopes identify, email and guilds):
We use the server list only at sign-in, to match you to OPSCOM communities linked to those servers. We do not store the list.
We also store the Discord access token and refresh token from your sign-in. We need them to keep your community memberships up to date without asking you to sign in again. We use them only to read your Discord server list.
If you create a community, we also process:
When an owner connects their Discord server, our Discord bot syncs that server's member list into the community. This creates a personnel record even for members who have never signed in to OPSCOM. For each member we store:
If you later sign in, that record is linked to your account. Owners can exclude specific users and roles from the sync.
Depending on which features a community uses, its staff may record:
This covers images (community logos, rank insignia, unit insignia, award and device images, operation and training covers, member avatars), attachments, documents, tactical maps (TacMaps) and their share links, Google Drive links you paste in, and messages scheduled to be sent by Discord direct message.
Some uploaded files are public by link. Images, member avatars and training attachments are stored so that anyone with the direct link can open them. Operation attachments are private. Don't upload anything to OPSCOM that you wouldn't want to be viewable by someone holding its link.
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in, linking you to your communities | Performance of a contract (Art. 6(1)(b)) |
| Providing community features to owners and their members | Performance of a contract with the owner (Art. 6(1)(b)). For members without an account: the owner’s legitimate interest in managing their community (Art. 6(1)(f)) |
| Billing, subscriptions and trials | Performance of a contract (Art. 6(1)(b)) |
| Service emails, such as your trial ending soon | Performance of a contract (Art. 6(1)(b)) |
| Verifying community owners with a linked Google account | Legitimate interest in preventing abuse of trials and paid communities (Art. 6(1)(f)) |
| Security, preventing abuse, enforcing bans, audit logs | Legitimate interest in keeping the platform safe (Art. 6(1)(f)) |
| Keeping accounting records | Legal obligation (Art. 6(1)(c)) |
We use the following service providers, each only for the purpose shown:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU (Frankfurt, Germany) |
| Vercel | Website hosting and server logs | Processed in the EU (Frankfurt, Germany). Vercel Inc. is a US company |
| Discord | Sign-in, server member sync, bot messages and webhooks | USA |
| Account linking for community owners | USA | |
| Stripe | Payment processing and subscriptions | USA / EU |
| Resend | Sending service emails | USA |
Within your community: other members of the same community can see your personnel record, as allowed by that community's permission settings. If a community sets up Discord webhooks or scheduled direct messages, information such as names and event details is posted to Discord.
Authorities: we may disclose data when the law requires it. As our Terms state, we report child sexual abuse material to the relevant authorities.
| Data | How long |
|---|---|
| Account data (Discord profile, email, sign-in tokens) | Until your account is deleted |
| Community data, personnel records, audit logs | Until the community deletes it, or the community itself is deleted |
| Members who have left a community’s Discord server | Marked inactive, then deleted automatically after the community’s grace period (30 days by default; each community can change it) |
| Subscription records | For as long as the subscription exists. Invoices and payment records are kept by Stripe, and we keep the records Dutch tax law requires us to keep (up to 7 years) |
| Platform ban records | For as long as the ban is in force |
| Backups | We don’t keep separate backups of our database. Deleted data is removed from our live database straight away |
| Server logs | Kept by our hosting provider for a short period (no more than 30 days) |
We use only what the service needs to work:
opscom-theme) and whether you've collapsed the sidebar (sidebar-…). This never leaves your device.We don't use tracking, analytics or advertising cookies.
Under the GDPR you have the right to:
To use any of these rights, email opscom.contact@gmail.com from the address linked to your account, or contact us on our Discord. We will respond within one month.
Deleting your account: there is currently no self-service delete option. Email us and we will delete your account and the personal data linked to it. Records that a community keeps about you are that community's records (see section 2). We will forward your request to the community, or delete those records ourselves where the law requires it.
You can also stop Discord sharing data with OPSCOM at any time: in Discord, go to User Settings → Authorized Apps and remove OPSCOM.
Complaints: you have the right to complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens. You can also complain in the EU country where you live.
No system is perfectly secure. If a data breach is likely to put your rights at risk, we will notify the Autoriteit Persoonsgegevens and you as the GDPR requires.