Terms of Service

Legal Agreement: By accessing the LuaProtect dashboard, API endpoints, Lua virtual machine obfuscator, licensing servers, or client runners, you agree to be bound by these Terms of Service in accordance with applicable European and German contract law.

1. Scope & Eligibility

You attest that you are at least 16 years of age or possess authorized legal guardian consent. Creating an account, deploying API credentials, or utilizing our SDKs and runners constitutes full acceptance of these Terms.

2. Account Security & Credential Confidentiality

Developers are strictly responsible for maintaining the confidentiality of their API keys, HMAC signing secrets, runner keys, and 2FA authentication tokens. Credentials must never be embedded in plaintext within public client scripts. You agree to notify platform administration immediately upon discovering any token leakage or security breach.

3. Acceptable Use & Prohibited Activities

The platform may not be used for illicit, harmful, or destructive purposes. Prohibited activities include:

• Child Exploitation & CSAM (Zero Tolerance): Strictly prohibiting any generation, storage, promotion, solicitation, linking, or transmission of Child Sexual Abuse Material (CSAM/CSAE), child exploitation, or sexually explicit content involving minors. Violations result in immediate account termination, blacklisting, and reporting to relevant national law enforcement agencies (NCMEC/BKA).
• Automated Moderation & Real-Time Content Safety: All user-submitted text fields (flows, scripts, tickets, profiles, announcements) are subjected to real-time automated safety scanning. Content containing pornography, non-consensual violence, or predatory solicitation is rejected automatically.
• Malicious Payloads & Stealers: Hosting, distributing, or obfuscating infostealers, ransomware, Discord token grabbers, remote access trojans (RATs), or spyware targeting user devices.
• Infrastructure Attacks: Launching Distributed Denial of Service (DDoS) attacks, brute-force requests, unauthorized scraping, or stress-testing against platform endpoints.
• Unauthorized Exploitation & Sabotage: Deploying destructive scripts designed to wipe local user files, damage hardware, or execute unauthorized code on third-party computers without legal authorization (§§ 202a, 303a StGB).

4. Remote Execution & Dynamic Payloads

LuaProtect provides real-time WebSocket communication and remote script execution capabilities. Developers warrant that any remote code dispatched through our platform is legitimate, non-destructive, and strictly complies with all applicable computer fraud, privacy, and cybercrime laws. We reserve the right to audit, freeze, and terminate accounts engaging in malicious remote execution.

5. Data Processing Addendum (Art. 28 GDPR / AV-Vertrag)

Where Developers collect in-game telemetry and player identifiers through LuaProtect runners: Controller & Processor Relationship: The Developer acts as the independent Data Controller for player telemetry (Roblox User IDs, HWIDs, IPs) collected via their scripts; LuaProtect acts as the Technical Data Processor providing hosting, obfuscation, and validation infrastructure. Legal Basis & Compliance: Developers warrant that they have established a lawful basis under GDPR / applicable data protection regulations before collecting end-user data and that they comply with all mandatory disclosure requirements.

6. Billing, Subscriptions & Cancellation

Paid plans (currently Pro; Enterprise pricing is negotiated separately) are billed through Whop.com, our reseller and merchant of record. Whop - not LuaProtect - is the seller on your receipt, handles payment processing and sales tax/VAT, and is who your payment method statement will show as the charge.

• Recurring billing: Subscriptions renew automatically (monthly or yearly, as selected at checkout) at the then-current price until canceled. We will give reasonable advance notice of any price change before it applies to your next renewal.
• Cancellation: Cancel any time from your account settings or Whop's customer portal (linked from your purchase receipt). Cancellation takes effect at the end of the current billing period - you keep paid-plan access you've already paid for, and are not billed again afterward.
• Right of withdrawal (EU/EEA consumers): Under the EU Consumer Rights Directive, you normally have a 14-day right to withdraw from a digital-service purchase. Because access to paid-plan features begins immediately on purchase, you expressly consent - at Whop's checkout - to immediate performance and acknowledge that your withdrawal right ends once the service has started. This does not affect any right to a refund for a service that is faulty or not as described.
• Refunds: Outside the withdrawal right above, refunds are discretionary and handled by Whop in line with their own refund policy. Contact us first if something's wrong - most billing issues (a mis-timed renewal, a duplicate charge) are resolved directly without needing a formal refund request.
• Failed payments: If a renewal payment fails, Whop retries automatically over the following days; plan access continues during that window. If every retry fails, the subscription is canceled and the account reverts to the Free plan.

7. Limitation of Liability & Warranties (§§ 307 ff. BGB)

In accordance with European and German standard contract law:

• Statutory Liability: LuaProtect is liable without limitation for damages resulting from intentional misconduct ( Vorsatz ), gross negligence ( grobe Fahrlässigkeit ), or injury to life, body, or health.
• Cardinal Duties ( Kardinalpflichten ): For slight negligence, liability is limited strictly to foreseeable, typical contract damages arising from the breach of essential contractual obligations.
• Service Availability: To the maximum extent permitted by law, LuaProtect is provided on a commercially reasonable effort basis without guarantee of uninterrupted uptime.

8. Account Suspension & Termination

We reserve the right to suspend or terminate any account, revoke API credentials, and ban associated script hashes immediately upon finding evidence of security threats, malware distribution, terms violations, or abuse of platform infrastructure.