Privacy Policy

Last updated: 15 July 2026

This Privacy Policy explains how RbxYz collects, uses, retains, and shares information when you use the Bot or this website. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (Ireland).

1. Controller and Contact Details

The operator of RbxYz is the data controller for personal data processed specifically to operate and protect the Bot and this website. Third-party platforms may act as separate controllers for information they process under their own terms. You can contact the RbxYz operator and data controller at support@rbxyz.dev or through our Support Server.

2. What Data We Collect

We collect only the minimum data necessary to operate and protect the service:

• Discord IDs: User, server, channel, role, and message IDs may be processed to deliver commands, enforce cooldowns, operate server features, prevent abuse, and diagnose failures.
• Server Configuration: Role Collector settings, configured role IDs, and related server preferences are stored so those features continue to work.
• Roblox Request Data: Roblox usernames and user, asset, place, group, bundle, badge, or other IDs supplied to commands are processed to fulfil the requested lookup or download.
• Download Job Records: Download workflows may store the requesting Discord user ID, server ID where applicable, requested Roblox IDs, job status, progress, and timestamps.
• Operational Data: We keep aggregated command counts, performance and error metrics, and rotating technical logs. Logs may contain Discord user and server IDs, requested Roblox IDs, and limited error context needed to investigate a problem.

We do not ask for real names, payment information, or special category data through the Bot. Support emails are processed only when you choose to contact us by email.

3. Where Data Comes From and Whether It Is Required

Information is obtained from command users, Discord interactions and server configuration, Roblox and other public sources, and the connected services listed below. A command may also retrieve public information about a Roblox user, group, asset, place, badge, bundle, or Discord server that was not supplied by the person the information concerns.

You are not required to provide information directly to RbxYz. However, the Bot cannot complete a requested command or preserve a configured server feature without the identifiers or settings that feature requires.

4. Legal Basis for Processing

• Performance of a Contract (Article 6(1)(b)): Where applicable, to provide the command or service you requested under our Terms.
• Legitimate Interests (Article 6(1)(f)): To maintain a reliable Bot, preserve server settings, measure performance, secure the service, prevent abuse, investigate errors, and protect users and connected services. We balance these interests against the rights and reasonable expectations of affected individuals.
• Legal Obligation (Article 6(1)(c)): To comply with applicable laws.

5. Data Sharing & Third Parties

We do not sell, rent, or trade personal data. We share only the information needed to operate the Bot with the following service categories, each of which operates under its own terms and privacy policy:

• Discord: Processes command interactions, messages, embeds, and files delivered through Discord.
• Roblox: Receives Roblox identifiers and request details needed for public lookups and authorised asset delivery.
• Rolimons: Receives item identifiers used by trading information commands.
• Rotector: Receives Roblox or Discord IDs when you run the relevant safety-check commands.
• Top.gg: Receives your Discord user ID when the Bot checks whether you have an active vote and applies temporary voter benefits.
• Hosting and infrastructure providers: Process stored data and standard network metadata as needed to host, secure, and deliver the service.

6. International Processing

Discord, Roblox, Top.gg, other connected services, and infrastructure providers may process information outside Ireland or the European Economic Area. Their privacy notices describe the locations and safeguards applicable to processing they perform under their own terms. Where GDPR requires safeguards for an international transfer for which RbxYz is responsible, we will use a lawful transfer mechanism, such as an applicable adequacy decision or approved contractual safeguards. You may contact us for further information about the providers and safeguards relevant to your data.

7. Real-Time Processing & Retention

• Command Results and Files: Most third-party responses are processed in memory. Local temporary ZIP files are removed after processing, with a safety cleanup for abandoned files. Files and messages delivered through Discord remain subject to Discord's retention practices; group-download attachments are normally removed from the Bot's DM after approximately five minutes.
• Download Job Records: Finished, cancelled, interrupted, or failed job records are normally deleted within seven days. Active recovery records may be retained briefly so interrupted group downloads can resume safely.
• Server Configurations: Retained while the Bot remains installed so configured features continue to work. Related server settings, role records, cooldowns, and jobs are automatically removed when the Bot leaves a server and may also be deleted on verified request.
• Cooldowns and Vote Status: Ordinary command cooldowns are short-lived in memory. Persisted Role Collector cooldown records older than 30 days are removed. Top.gg vote-status results are cached in memory for up to approximately five minutes.
• Aggregated Metrics: Command totals, outcomes, latency, resource, shard, reach, and upstream error metrics do not contain user IDs and are normally retained for up to 30 days.
• Operational Logs: Technical logs use size-limited rotation, so their exact retention period varies with activity. Access is restricted to authorised operators.
• Backups: Personal data removed from the live service may remain temporarily in restricted, rotating backups until those backups are overwritten or expire. We do not restore deleted data to ordinary use. Limited records may be retained where reasonably necessary to establish, exercise, or defend legal claims, comply with law, or investigate security abuse.
• Abuse and Opt-Out Lists: Discord, server, Roblox, group, or asset IDs placed on a security blacklist or privacy opt-out list may be retained until removal is appropriate or a valid deletion request is accepted.

8. Automated Processing and Safety Results

RbxYz uses automated rules to apply cooldowns, rate limits, voter benefits, blacklists, and command eligibility. Safety commands may display information supplied by services such as Rotector. RbxYz does not use these features to make decisions that produce legal or similarly significant effects. Safety results are informational and may be incomplete or inaccurate; server owners and moderators remain responsible for reviewing context and making their own moderation decisions. To report an inaccurate result or request review of an RbxYz restriction, contact us using the details below.

9. Your Rights Under GDPR

If you reside in the EU/EEA, you have the right to access, rectify, erase, restrict, object to, or port your personal data, subject to applicable legal limits. You may exercise these rights by contacting us via our Support Server or at support@rbxyz.dev. We will respond within one calendar month unless applicable law permits an extension.

You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at dataprotection.ie.

10. Data Security

We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, or alteration. These include access controls, secret redaction, bounded retention, and restricted operational logs. However, no transmission over the internet is completely secure.

11. Children's Privacy

The Bot is available only through Discord. You must meet Discord's minimum age for your country and any other age requirements that apply to you. We do not independently collect dates of birth or knowingly offer the Bot to anyone below the applicable minimum age. A parent or guardian who believes a child has provided personal data contrary to these requirements may contact us to request review and deletion.

12. Website Privacy

This website does not use first-party analytics, advertising trackers, accounts, or non-essential cookies. Our hosting and network providers may process standard request information such as IP addresses, user agents, timestamps, and security events under their own privacy policies.

13. Changes to This Policy

We may update this Privacy Policy when the Bot, connected services, or applicable legal requirements change. The effective date at the top identifies the current version. Where reasonably practicable, material changes will be announced through the Bot, website, or Support Server before they take effect. We may retain dated copies of published versions, which may be requested by email.

14. Contact

For data subject requests or concerns, contact us via our Support Server or email us at support@rbxyz.dev.