Privacy Policy

Compliance Notice: This Privacy Policy governs the processing of personal data across the LuaProtect platform, API endpoints, SDKs, and telemetry runners in full compliance with the European General Data Protection Regulation (GDPR / Regulation EU 2016/679) and § 25 TDDDG.

1. Data Controller & Contact Information

LuaProtect operates as the Data Controller (Art. 4(7) GDPR) for developer account credentials, dashboard sessions, and billing metadata. Privacy & Data Inquiries [email protected] Data Export & Erasure Direct self-service export in Dashboard Settings or via API

2. Categories of Personal Data Processed

• Developer & User Accounts: Email address, username, cryptographically salted bcrypt password hashes, 2FA/TOTP secrets, and Discord account identifiers when linked via OAuth.
• In-Game Client Telemetry: Roblox User IDs, usernames, Hardware ID (HWID) hashes, public IP addresses, approximate geographic location (country/city derived via geoip-lite), place/game IDs, and executor environment signatures.
• Operational & Security Logs: System event logs, administrative audit trails, WebSocket connection handshakes, webhook delivery traces, and rate-limiting counters.

3. Legal Bases for Processing (Art. 6(1) GDPR)

Performance of Contract (Art. 6(1)(b) GDPR): Provisioning developer accounts, authenticating script executions, enforcing key-gated access control, compiling obfuscated Luau VMs, and dispatching real-time updates. Legitimate Interests (Art. 6(1)(f) GDPR): Defending platform infrastructure from DDoS attacks, brute-force requests, reverse-engineering exploits, unauthorized API abuse, and enforcing platform bans. Consent (Art. 6(1)(a) GDPR): Voluntary account registration, voluntary Discord account linkage, and optional telemetry features.

4. Device Access & Terminal Equipment Telemetry (§ 25 TDDDG)

In accordance with § 25 TDDDG (formerly TTDSG) and the European ePrivacy framework, our script runners inspect client runtime attributes (including HWID hashes and executor platform signatures). This access is performed solely for the technically necessary purpose of verifying valid execution licenses, enforcing anti-tamper safeguards, and protecting developer intellectual property.

5. Data Retention & Automated Purging Horizons

We enforce automated lifecycle cleanup schedules across all databases:

• Heartbeats and temporary runner keys expire automatically upon disconnection.
• IP mapping logs and API call history automatically purged after 30 days.
• Inactive player telemetry and hardware links purged after 90 days.
• Automated deletion of user-submitted script diagnostic reports.
• Live account records erased immediately. Encrypted disaster recovery snapshots (local & Cloudflare R2) rotate and overwrite permanently within 14 days.

6. Sub-processors & International Transfers

We engage vetted technical service providers under strict data processing agreements:

• Hosting & Infrastructure: Dedicated European cloud VPS nodes running encrypted databases and Redis instances.
• Transactional Email: Resend, Inc. for password resets and verification emails under Standard Contractual Clauses (SCCs).
• Authentication & Cloud Storage: Discord, Inc. (OAuth2 verification) and Cloudflare, Inc. (Turnstile bot mitigation & encrypted R2 backup storage).

7. Your Statutory Rights (Art. 15–22 & Art. 77 GDPR)

As a data subject in the European Union, you have the right of Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Data Portability (Art. 20), and Objection (Art. 21). You also possess the explicit statutory right to lodge a complaint with a competent Data Protection Supervisory Authority ( Datenschutzaufsichtsbehörde ) under Art. 77 GDPR.

8. Security of Processing (Art. 32 GDPR)

All network traffic is encrypted via TLS 1.3 / WSS. API keys are hashed using HMAC-SHA256 with a dedicated cryptographic pepper, user passwords use high-cost bcrypt hashing, and database queries are strictly partitioned by tenant isolation boundaries.