Privacy Policy
Last updated: 17 October 2026
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
[YOUR FULL NAME], trading as LuaSec[ADDRESS FROM IMPRINT SERVICE]
support@luasec.dev
We have not appointed a data protection officer because the law does not require one for an operation of our size. Write to the address above with any privacy question.
2. Who this policy is about
- Visitors of luasec.dev.
- Script owners who buy a plan and use the owner panel.
- Buyers who run a script that a script owner protects with LuaSec.
- Anyone who contacts us, for example with a support request, a ban appeal or a takedown notice.
3. Visitors of this website
This website sets no cookies, uses no analytics or tracking, and loads no fonts, scripts or images from other companies. All files come from our own server.
When you open a page, our hosting provider processes your IP address, the page requested, the time, and your browser's user agent so the page can be delivered and attacks can be blocked. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f) GDPR). These logs are kept by the hosting provider for a short period, at most [7] days.
4. Buyers who run a protected script
When a buyer runs a script protected by LuaSec, the loader contacts our servers to check the license key. For this check we process the following data:
| Data | Why |
|---|---|
| License key (stored only as a hash) | Check that the key is valid |
| Hardware ID reported by the executor, plus device identifiers and user identifiers that the executor sends | Bind the key to the buyer's device and spot keys used on other devices |
| Executor name, user agent, encryption details of the connection and connection round-trip time | Recognise the device and detect tampering or automated abuse |
| IP address | Detect a key shared between several people, block abusive networks |
| Approximate location derived from the IP address: country, region and city | Detect key sharing and show the script owner where their scripts run |
| Network provider, network number (ASN), and whether the address belongs to a hosting service, VPN or proxy | Detect abuse through hosting servers and VPNs |
| Roblox user ID | Detect a key shared between several Roblox accounts |
| Results of integrity checks run by the loader | Detect modified loaders and scripts |
| Time of each run and of the first and last use of a key | Statistics for the script owner, session handling, abuse detection |
In most places we store the IP address only as a keyed hash. We store the full IP address only in the key-sharing records described in section 8.
Who is responsible for this data. We process this data on behalf of the script owner who sold you the license. For the license check and the owner's statistics, the script owner is the controller and we are their processor. Ask the script owner first if you want to use your rights for this data; we will help them answer. We also use the data for our own purpose of protecting LuaSec and all script owners from abuse, for example to stop one device abusing several projects. For that purpose we are the controller and the legal basis is our legitimate interest in a secure service that cannot be abused (Article 6(1)(f) GDPR).
Data stored on your device. The loader may store a device token on your device so that it can recognise the same device on the next run. This is strictly necessary to provide the license check you asked for (Section 25(2) no. 2 of the German TDDDG). The token is valid for 30 days.
Automated checks. Our abuse checks can block a key or device automatically, for example when one key runs from many devices or networks at once. If your key was blocked and you think it was a mistake, you can appeal through the script owner or write to us. A person will review your case.
5. Script owners
Account and panel
- You log in with an access token. We store the account identifier contained in it and, while you are logged in, a hash of your session. Sessions end after 8 hours.
- We log actions you take in the panel, such as publishing, resetting a device or banning a key, together with the time and the IP address you used. This log lets us trace changes and investigate account misuse.
- We store what you enter in the panel: project and script names, script files, license notes and ban reasons. Do not put personal data about your buyers into notes unless you need it.
The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR) and, for the action log, our legitimate interest in a secure service (Article 6(1)(f) GDPR).
Payments
Payments are handled by Stripe and SellAuth. You give your payment details to them directly; we never see your full card number or wallet keys. They send us your email address or customer ID, the order ID and the amount, so we can deliver your plan, handle cancellations and deal with chargebacks. The legal basis is the performance of our contract (Article 6(1)(b) GDPR) and our legal duty to keep accounting records (Article 6(1)(c) GDPR).
6. Who receives data
- Hosting and infrastructure provider (USA), which runs our servers, databases and storage on our behalf as our processor. The provider is certified under the EU-US Data Privacy Framework.
- IPinfo, Inc. (USA), which receives the buyer's IP address to return the approximate location and network provider. [CONFIRM TRANSFER BASIS: DATA PRIVACY FRAMEWORK OR STANDARD CONTRACTUAL CLAUSES]
- Discord, Inc. (USA), where we receive internal alerts about suspected key sharing. These alerts contain the IP addresses, Roblox user IDs, network provider and approximate location of the devices involved, and are visible only to us. [CONFIRM TRANSFER BASIS]
- Stripe (Stripe Payments Europe, Ltd., Ireland) and SellAuth ([SELLAUTH LEGAL ENTITY AND COUNTRY]) for payments. They are independent controllers for the payment; their own privacy policies apply.
- Luraph, which receives script code for obfuscation. Script code should not contain personal data.
- Script owners, who see in the panel the data about buyers of their own scripts listed in section 4.
- Authorities and courts, if the law requires us to hand data over.
Where data goes to a country outside the European Economic Area, we transfer it only on the basis of an adequacy decision, including the EU-US Data Privacy Framework, or the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards.
7. Contact, appeals and takedown notices
If you email us, appeal a ban or send a takedown notice, we process your name, contact details and what you write, to answer you and to document our decision. The legal basis is our legitimate interest in answering requests and our legal duties under the EU Digital Services Act (Article 6(1)(c) and (f) GDPR). We delete this data [12] months after the matter is closed.
8. How long we keep data
| Data | Kept for |
|---|---|
| Execution logs and run events | 30 days |
| Connection fingerprints | 7 days |
| Integrity check results and tamper reports | 30 days |
| Key-sharing records with full IP address | 7 to 30 days |
| Location lookups for an IP address | 24 hours |
| Device behaviour baseline | 30 days |
| Expired buyer sessions | Deleted 7 days after expiry |
| Archived run logs | [90] days |
| Device bindings for a license key | As long as the key exists, deleted with the key or project |
| Bans and their reasons | As long as the ban is needed to prevent abuse, reviewed at least every [12] months |
| Panel sessions | 8 hours |
| Panel action log with IP address | [12] months |
| Script owner account, projects and scripts | Until you delete them or your account |
| Payment records | As long as German commercial and tax law requires, currently up to 10 years |
When a script owner deletes a project, we delete the buyer data for that project, except payment records we must keep by law.
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to withdraw any consent you gave. Write to support@luasec.dev. We may ask you for information that lets us find your data, such as a license key, and confirm that it is yours.
Right to object. Where we process your data based on our legitimate interest (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or where the alleged breach took place. The authority responsible for us is [NAME OF THE DATA PROTECTION AUTHORITY OF YOUR GERMAN STATE].
10. Security
All connections to LuaSec are encrypted. License keys are stored only as hashes. Access to the data is limited to the operator of LuaSec, and every admin action is logged.
11. Age
LuaSec is for people aged 18 and over. We do not knowingly collect data from children through the owner panel.
12. Changes
We update this policy when the Service or the law changes. The date at the top shows the latest version.