Privacy Policy
Luaudit is a small tool run from the UK. This page explains what we collect, why we collect it, and what you can ask us to do with it. We've kept it as short and plain as we can.
Who we are
Luaudit is run by [LEGAL NAME / TRADING NAME], based at [ADDRESS], United Kingdom. Under UK data protection law (the UK GDPR and the Data Protection Act 2018), we're the controller of the personal data described on this page.
If you have a question about any of it, email [CONTACT EMAIL]. A real person will reply.
The short version
- We never receive your game code.
- We collect only what we need to run your account and bill you.
- We don't sell your data, and we don't use it to train AI models.
- You can ask to see, correct or delete your data at any time.
Your game code
Luaudit works through MCP. When you connect it, our server gives your AI two things: the checklist of security checks, and the format for the report. That's all it sends, and all it needs.
Your AI reads your scripts inside your own AI session. Your code is never sent to us, and we have no way to see it.
Because your scripts are handled by your AI provider (for example Anthropic or OpenAI), that part is covered by their privacy terms, not ours. It's worth checking how your provider treats the content you share with it, including whether it can be used for training, and changing your settings if you'd prefer it wasn't.
What we collect
- Your account email. Used to sign you in and to contact you about your account.
- Subscription and billing status. Your plan, whether it's active, and when it renews. Payments are handled by Stripe. We never see or store your full card details.
- Waitlist emails. If you join the waitlist for hosted audits, we keep your email so we can tell you when it's ready.
- Basic usage data. What we need to run the service: which account's MCP key made a request, and when. Our hosting provider may also keep standard server logs, such as IP addresses and error messages.
That's the full list.
Why we use it
The law asks us to name a reason (a "lawful basis") for each use. Ours are:
- To provide the service you signed up for (contract). Running your account, checking your MCP key, and taking payment.
- To meet our legal obligations. For example, keeping billing records for tax.
- To keep Luaudit secure and working (legitimate interests). Preventing abuse, fixing bugs, and understanding overall usage.
- Because you asked us to (consent). The waitlist. You can withdraw at any time by unsubscribing or emailing us.
How long we keep it
We keep your data while your account is active. When you close your account, we delete it, except for anything we're legally required to keep. Billing records, for example, have to be kept for as long as UK tax rules require, which is typically six years.
Waitlist emails are kept until you unsubscribe or ask us to remove them.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct anything that's wrong or out of date.
- Delete your data.
- Object to how we use it, including any use based on legitimate interests.
- Withdraw consent wherever we rely on it, such as the waitlist.
To use any of these, email [CONTACT EMAIL]. It's free, and we'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd be grateful for the chance to put it right first.
Younger developers
Plenty of great Roblox developers are young, but Luaudit isn't for anyone under 13. If you're under 18, please ask a parent or guardian before signing up. If we find out we're holding data from a child under 13, we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If the change affects you in a meaningful way, we'll email you before it takes effect.
Contact
Email [CONTACT EMAIL], or write to [LEGAL NAME / TRADING NAME], [ADDRESS].
See also our Terms of Service.