Terms of Service

Last updated: 17 October 2026

1. Who we are

LuaSec is operated by [YOUR FULL NAME], [ADDRESS FROM IMPRINT SERVICE] ("LuaSec", "we", "us"). You can reach us at support@luasec.dev. Full details are in the imprint.

These terms apply to every use of the LuaSec website, the owner panel at ops.luasec.dev, the loader and the API (together, the "Service"). By creating a project, buying a plan or using the Service you accept these terms. Terms you set for your own buyers do not bind us.

2. Who can use LuaSec

• You must be at least 18 years old.
• LuaSec is offered only to businesses and sole traders who use it for their commercial activity, which here means selling or licensing their own scripts. It is not offered to consumers within the meaning of Section 13 of the German Civil Code (BGB). At checkout you confirm that you are buying as a business.
• If you use LuaSec on behalf of a company or a team, you confirm that you are allowed to accept these terms for them.

3. What the Service does

LuaSec stores your scripts, obfuscates them with Luraph, issues license keys, binds each key to a buyer's device, serves your scripts through a loader to buyers with a valid key, and shows you execution statistics in the owner panel. The features of each plan are listed on the pricing section at the time you buy.

Scripts run inside third-party executors and inside Roblox. Neither is under our control. An executor update, a Roblox update or a change to how an executor reports device data can stop a script from loading or change how device binding behaves. We fix what is on our side as quickly as we reasonably can. We do not promise that any particular executor, platform or game will keep working with LuaSec.

Obfuscation makes a script much harder to read and copy. It does not make copying impossible, and we do not promise that a script cannot be reverse engineered.

4. Your account

• You log in to the owner panel with an access token. Keep it secret. Anyone who has it can act as you.
• Tell us at once at support@luasec.dev if you think your token has been exposed. We will revoke it and issue a new one.
• You are responsible for everything done with your token until you have told us it was exposed.
• Your plan is for you. You may not resell, rent or share access to LuaSec itself unless we have agreed to it in writing.

5. Plans, payment and renewal

• Payments are handled by Stripe (card payments) and SellAuth (card and cryptocurrency payments). Their own terms apply to the payment itself.
• Prices are shown at checkout before you pay. Taxes are shown at checkout where they apply.
• Monthly plans renew every month and yearly plans renew every year until you cancel. You can cancel at any time through the billing link in your payment receipt or by email to support@luasec.dev. Cancellation takes effect at the end of the period you have paid for, and your plan stays active until then.
• If a payment fails or is charged back, we may pause your projects until the amount is paid.
• We may change prices for future billing periods. We will email you at least 30 days before a price change applies to you, and you can cancel before it does.

6. No refunds

Your plan is active the moment you pay. All sales are final and we do not give refunds, including for partly used billing periods. This does not limit any right you have by law that cannot be excluded by contract, such as warranty rights if the Service is defective. If something on our side stops working, contact us and we will fix it.

7. What you may not do

You may not use LuaSec to host, protect or distribute:

• malware, or any script that steals or collects passwords, cookies, session tokens, account credentials, payment data or personal data from the people who run it;
• scripts that damage, lock or take over a buyer's device, files or accounts, or that turn buyers' devices into part of an attack;
• scripts, code or assets you do not own or have no right to sell, including scripts copied from other developers;
• content that is illegal in Germany or in the European Union, including content that sexualises minors, which we report to the authorities.

You may also not:

• attack, overload, probe or try to bypass the security of the Service, the loader or other customers' projects;
• use the Service to get around a ban we have placed on you or on another account;
• use LuaSec in a way that breaks sanctions or export control law.

8. Your scripts and your buyers

• You keep all rights in your scripts. You give us the right to store, copy, obfuscate, transform and deliver them, as far as we need to provide the Service to you and your buyers. This right ends when you delete the script or your account, except for copies we must keep by law.
• You sell to your buyers, not us. You set your own prices, terms and refund rules for them, and you handle their questions and complaints. LuaSec is not a party to your sale.
• You are responsible for making sure your scripts and the way you sell them comply with the law and with the rules of any platform they are used on. You know that using executors and scripts may break the Roblox Terms of Use and can lead to Roblox account bans. LuaSec is not responsible for action Roblox takes against you or your buyers.
• You must tell your buyers, in your own privacy notice, that LuaSec processes data about them on your behalf to check their license. The privacy policy lists that data.

9. Processing your buyers' data for you

When your buyers run your scripts, we process personal data about them on your behalf. For that processing you are the controller and we are your processor under Article 28 of the GDPR. This section is our data processing agreement with you.

• Subject and duration: license checks, device binding, abuse prevention and execution statistics for your projects, for as long as your account exists.
• Data and people concerned: your buyers. The data is listed in section 4 of the privacy policy.
• Instructions: we process the data only to provide the Service as described here and as you configure it in the panel, unless the law requires otherwise. If we think an instruction breaks data protection law, we tell you.
• Confidentiality and security: everyone at LuaSec with access to the data is bound to confidentiality. We keep technical and organisational measures in place under Article 32 GDPR, including encrypted connections, hashed license keys and hashed or truncated identifiers where the Service allows it, access limited to the operator, and logged admin actions.
• Sub-processors: you allow us to use the sub-processors listed in section 6 of the privacy policy. We will tell you by email at least 30 days before we add or replace one, and you may object. If we cannot resolve your objection, you may end your plan.
• Help: we help you answer requests from your buyers who use their GDPR rights, and we help you with security, breach notification and impact assessments as far as the data we hold allows.
• Breaches: we tell you without undue delay after we become aware of a personal data breach that affects your buyers' data.
• End of the contract: when you delete a project or your account, we delete your buyers' data for it, except where the law requires us to keep it.
• Proof: we give you the information you need to check that we keep these rules, and we allow reasonable audits, announced at least 30 days in advance and at your own cost.

We also use some of this data for our own purposes, for example to stop the same device or key abusing several projects. For that use we are a controller ourselves, as the privacy policy explains.

10. Suspension and termination

• We may suspend a project or your account if you break section 7, if we receive a valid legal notice about your content, if your payment is charged back, or if we must do so by law. Where we can, we tell you first and give you a chance to fix the problem. You can contest a decision by writing to support@luasec.dev.
• We may end your account for serious or repeated breaches. You are not entitled to a refund in that case.
• You can stop using LuaSec and delete your projects at any time.
• We may stop offering the Service. If we do, we will tell you at least 30 days in advance and refund the unused part of any prepaid period.

11. Availability

We aim to keep the Service available at all times, but we do not promise a particular uptime. Maintenance, faults with our providers or attacks can cause interruptions.

12. Liability

• We are liable without limitation for damage caused by intent or gross negligence, for injury to life, body or health, under the German Product Liability Act, and where we have given a guarantee.
• For slight negligence we are liable only if we breach an obligation that is essential for the contract and that you rely on (a cardinal obligation). In that case our liability is limited to the damage that is typical and foreseeable for this kind of contract.
• In all other cases of slight negligence we are not liable.
• These limits also apply to our employees and agents.

13. If someone makes a claim because of your scripts

If a third party makes a claim against us because your script or the way you use LuaSec breaks the law or their rights, you will cover our reasonable costs of defending it, including legal fees, unless you are not responsible for the breach.

14. Changes to these terms

We may change these terms for good reason, for example a change in the law or in the Service. We will email you the new terms at least 30 days before they take effect. If you do not object before then, the new terms apply. If you object, either of us may end the contract when the change takes effect. We will remind you of this in the email.

15. Law and courts

• German law applies. The UN Convention on Contracts for the International Sale of Goods does not apply.
• If you are a merchant, a legal entity under public law or have no place of jurisdiction in Germany, the courts at [CITY OF YOUR REGISTERED ADDRESS] have exclusive jurisdiction.
• If a part of these terms is invalid, the rest stays in force.