Privacy Policy

1. Introduction

This Privacy Policy explains how Valor Studio Ltd (“Valor,” “we,” “our,” or “us”) collects, uses, and protects personal data when you use our platform, including when you authenticate through Roblox OAuth 2.0 and use our AI-powered tools to create games and assets.

Our platform enables users to:

• Authenticate using Roblox accounts
• Generate game content and assets using AI
• Export and publish experiences to Roblox Studio

We are committed to protecting user privacy and complying with:

• UK GDPR and EU GDPR
• The UK Data Protection Act 2018
• The ICO Age Appropriate Design Code (the Children’s Code)
• Roblox platform and OAuth requirements

A short, plain-language version of this policy, written for young creators, is at /privacy-notice.

2. Scope of This Policy

This Privacy Policy applies to:

• Users of Valor’s website, platform, and tools
• Users authenticating via Roblox OAuth
• Parents or guardians of children using our services

This policy does not apply to Roblox’s own data practices, which are governed by Roblox’s separate policies.

3. Data Controller

Valor Studio Ltd

1 Lake House Farm, Colehouse Lane, Clevedon, BS21 6TQ, United Kingdom

Email: privacy@valorstudio.co

4. Personal Data We Collect

4.1 Data Obtained via Roblox OAuth

When you log in via Roblox, we receive limited account data based on granted permissions, including:

• Roblox User ID
• Username and display name
• Profile metadata (as permitted by OAuth scopes)

We never collect:

• Roblox passwords
• Private messages
• Payment or billing information from Roblox

We strictly request minimum necessary scopes in line with Roblox requirements.

4.2 Data You Provide Directly

• Email address (if provided)
• Account preferences
• Communications (support, feedback, bug reports)

4.3 AI-Generated and User Content

We collect and process:

• Prompts submitted to AI systems
• Generated game assets, scripts, and environments
• Project files and configurations
• Metadata about created experiences
• Stats about your published games from Roblox, like visits and players

This is necessary to operate and improve the platform.

4.4 Automatically Collected Data

• Device and browser information
• IP address and approximate location
• Usage logs and interaction data
• Performance and diagnostic data

5. How We Use Personal Data

We process personal data to:

Core Functionality

• Authenticate users via Roblox OAuth
• Enable AI-powered game and asset generation
• Sync and export content to Roblox Studio

Platform Improvement

• Improve AI models and generation quality
• Debug, test, and enhance features

Safety and Compliance

• Detect abuse, fraud, or misuse
• Enforce our terms and Roblox policies
• Comply with legal obligations

Communications

• Respond to support requests
• Send essential service updates

We do not sell personal data.

6. Legal Bases for Processing (UK/EU)

We rely on:

• Contractual necessity — to provide the service
• Legitimate interests — improving product, ensuring security
• Consent — where required (e.g., optional data, children)
• Legal obligation — compliance with applicable laws

7. Children’s Privacy

LAB is built for young creators aged 13 to 17 in the United Kingdom. Sign-in is through Roblox, which only connects apps like LAB for accounts aged 13 and over, and we do not knowingly collect personal data from children under 13.

A short, plain-language notice written for young creators is at /privacy-notice.

7.1 Compliance Framework

We align with:

• UK GDPR and the Data Protection Act 2018
• The ICO Age Appropriate Design Code (the Children’s Code)
• Roblox’s age requirements for OAuth apps

7.2 Data Minimisation for Children

For all users under 18:

• We limit data collection to what is strictly necessary
• We do not show advertising, use ad trackers, or profile users for marketing
• We do not record sessions or automatically capture every click
• Roblox account details are used for sign-in and to show a creator’s name, never for analytics

7.3 Parental Rights

Parents or guardians may, on a child’s behalf:

• Request access to a child’s data
• Request deletion of a child’s data
• Withdraw consent

Contact: privacy@valorstudio.co

8. AI and Content Processing

Our platform uses AI systems to generate game assets and code.

Important Notes

• User prompts may be processed by AI systems
• Generated outputs are stored to support user projects
• We may use anonymized or aggregated data to improve systems
• We do not use private Roblox data (e.g., chats) for training

Users should avoid submitting sensitive personal data in prompts.

9. Data Sharing

We share data only where necessary:

With Service Providers

• Cloud hosting and storage providers
• AI providers that run the builder: Anthropic (Claude) and Google (Gemini)
• Product analytics: PostHog, hosted in the EU, receives usage events (pages visited, Play presses, sign-in, build and publish steps) keyed only by the LAB account ID, never names, Roblox account details or prompt text

With Roblox

• As required for OAuth authentication and integration

Legal Requirements

• Regulators, courts, or law enforcement where required

We do not sell or rent personal data.

10. International Data Transfers

Data may be processed in:

• United Kingdom
• European Economic Area
• United States

We implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs)
• Equivalent protections under UK GDPR

11. Data Retention

We retain data only as necessary:

• Active accounts: retained while account is active
• Projects, with their builder chat, prompts, AI-written code and published releases: retained until account deletion. Archiving a project hides it but does not delete it
• Build and publish records, including the prompts they started from, and building-block usage: retained until account deletion
• Runtime reports from published games (errors, player counts and the Roblox user IDs of players, not their names): retained for 30 days, then deleted
• Daily stats about published games from Roblox (visits, players in the game, favourites; totals only, about no single player): retained until account deletion
• Usage events (product analytics): 12 months
• The lab_sid session cookie, which only groups the usage events of one visit: 30 minutes after the last request
• Logs: retained for security and debugging (limited duration)

We may retain data longer where legally required.

12. Security

We implement appropriate technical and organisational measures, including:

• HTTPS encryption (required for Roblox OAuth)
• Access controls and authentication safeguards
• Monitoring and incident detection systems

No system is completely secure, but we take reasonable steps to protect data.

13. User Rights

Under UK/EU law, users may:

• Access their personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing
• Request data portability

Requests can be made via: privacy@valorstudio.co

14. Third-Party Services

Our platform integrates with:

• Roblox
• Google
• Anthropic
• PostHog

We are not responsible for third-party privacy practices.

15. Changes to This Policy

We may update this Privacy Policy periodically.

We will notify users of material changes via:

• Website notice
• Platform notification
• Email (if available)

16. Contact

Valor Studio Ltd

Email: privacy@valorstudio.co

Address: 1 Lake House Farm, Colehouse Lane, Clevedon, BS21 6TQ, United Kingdom