1. Data Protection Roles
Under the General Data Protection Regulation ("GDPR") and the UK Data Protection Act 2018:
- Data Controller: Luafox operates as the Data Controller for your personal registration details, profile data, subscription records, and billing metadata.
- Data Processor: When you submit prompts, Luau code, and game tree assets to be analyzed or refactored by AI inference models, Luafox acts as a Data Processor facilitating the streaming and transmission of that data to inference endpoints.
2. Lawful Bases for Processing (Article 6 GDPR)
We only process personal data where an explicit lawful basis under Article 6 of the GDPR exists:
| Lawful Basis | Applicable Purpose | Examples of Data Used |
|---|---|---|
| Performance of a Contract (Art. 6(1)(b)) | Delivering the Luafox service, managing credits, processing model generations, and providing technical support. | Email address, Clerk user ID, credit pack balances, active chat contexts. |
| Legitimate Interests (Art. 6(1)(f)) | Protecting platform security, preventing abuse and fraud, optimizing token caching, and software performance observability. | PostHog performance traces, IP rate limiting counters, error logs. |
| Legal Obligation (Art. 6(1)(c)) | Compliance with statutory corporate, taxation, VAT, and accounting obligations. | Stripe/PayPal/Atlos transaction invoices, financial settlement records. |
| Consent (Art. 6(1)(a)) | Optional non-essential cookies or voluntary participation in beta feedback programs. | Optional telemetry preferences. |
3. Your Data Subject Rights
As a data subject under GDPR and UK GDPR, you possess the following actionable rights:
- Right of Access (Article 15): You have the right to request confirmation as to whether your personal data is being processed, and to receive a copy of your personal data along with detailed information on how it is handled.
- Right to Rectification (Article 16): You have the right to request the prompt correction of inaccurate personal data or the completion of incomplete profile records.
- Right to Erasure ("Right to be Forgotten", Article 17): You may request the permanent deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or if you withdraw your consent, subject to statutory retention requirements for financial audits.
- Right to Restriction of Processing (Article 18): You have the right to obtain restriction of processing where the accuracy of the data is contested, the processing is unlawful, or you have objected to processing.
- Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV), and to transmit that data to another controller.
- Right to Object (Article 21): You have the right to object at any time to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
4. International Data Transfers (Articles 44–49)
Our primary production databases are hosted within the European Union (Supabase AWS EU-West-1, Ireland) and our product analytics are processed on PostHog's EU Cloud.
Where personal data is transferred outside the European Economic Area (EEA) or UK (for example, to US-based authentication or AI model providers such as Clerk, Stripe, or cloud inference gateways), we ensure adequate safeguards are in place in accordance with Chapter V of the GDPR. These include Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office, supplemented by technical safeguards such as encryption in transit and at rest.
5. How to Exercise Your Rights (DSR Process)
We make it simple to exercise your GDPR rights. You can submit a Data Subject Request (DSR) at any time:
- Email: Send a request to privacy@luafox.uk with the subject line
GDPR Data Request. Please include the email address associated with your Clerk account. - Verification: To protect your privacy and prevent unauthorized disclosure, we will verify your identity via your registered email address before processing your request.
- Response Timeline: We respond to and fulfill all legitimate requests within thirty (30) calendar days of receipt. In complex cases, we may extend this period by two further months, notifying you of the reasons for the delay.
- No Cost: Exercising your rights is completely free of charge.
6. Right to Lodge a Complaint
If you believe our processing of your personal data infringes data protection laws, we encourage you to contact us first so we can resolve the issue immediately. You also have the right to lodge a complaint with a supervisory authority:
United Kingdom:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk · Helpline: 0303 123 1113
European Union:
You may lodge a complaint with the Data Protection Authority in your EU Member State of habitual residence, place of work, or place of the alleged infringement.