Privacy Policy
Last updated: July 10, 2026
1. Who We Are
RoThero ("we," "us," "our") provides an AI-powered Luau code generator for Roblox Studio, available as a web app and a Roblox Studio plugin (the "Service"). RoThero is operated from Italy, and we comply with the EU General Data Protection Regulation (GDPR).
If you have questions about this policy or your data, contact us at: support@rothero.com
2. What Data We Collect
We collect only what we need to run the Service:
- Roblox account identifier, when you sign in via Roblox OAuth, we receive your Roblox user ID (and basic profile info Roblox shares, like username). We never see or store your Roblox password.
- Usage and prompt data, the prompts you send to generate Luau code, and metadata about that usage (timestamps, credit consumption, plan tier). We process this to provide the Service and to enforce usage limits.
- Billing data, when you subscribe or buy credits, payment is handled entirely by Stripe. We never receive or store your raw card number, CVC, or full payment details. We do store the subscription status, plan, and billing dates needed to manage your account (e.g., subscription start date, whether a refund was issued).
- Email address, if your Roblox account shares one at sign-in, the email you enter at Stripe checkout when you subscribe, or an email address you provide when claiming the email verification bonus. We use it for transactional emails about your account (welcome, subscription and refund confirmations), and, only if you explicitly opt in, occasional product updates (see Section 4b).
- Discord account ID, if you choose to link your Discord account, we store your Discord user ID to verify server membership and assign the Discord role matching your plan. Linking is optional; you can unlink at any time from the dashboard.
- Studio place context, when you pair the Studio plugin, it sends a snapshot of your open place (instance names, positions/sizes, and script source code) so generations can build on what already exists. The latest snapshot is stored with your account and included in AI requests you trigger.
- Images you attach, if you attach an image to a chat prompt, it is sent to our AI provider (OpenRouter) solely to generate your response. Attached images are not stored on our servers or in your conversation history after the response is generated.
- Account/technical data, basic data needed to keep your account secure and the app working (e.g., login timestamps, IP address for fraud/abuse prevention and rate limiting).
- Analytics, we use Vercel Web Analytics, a cookieless analytics tool, to count page visits (page viewed, referrer, browser and device type, country). It sets no cookies and does not identify you or track you across other websites.
- Product analytics (first-party), we record basic usage events (e.g. sign-in, generation performed, plugin paired) tied to your Roblox user ID, in our own database, to understand product usage. This data is never shared or sold.
- Cookies, we use session cookies strictly necessary to keep you logged in. We do not use tracking, advertising, or analytics cookies.
We do not collect data for advertising, and we do not use ad-tracking technologies.
3. How We Use Your Data
We use your data only to:
- Provide and operate the Service (generate code, track credits, manage your plan)
- Process payments and refunds via Stripe
- Review prompts and generated content you submit, including builds you report as problematic, so authorized personnel can debug, support, and improve the Service. We do not use this content to train AI models.
- Maintain security and prevent abuse
- Understand product usage (first-party analytics, see Section 2)
- Comply with legal obligations (e.g., tax/accounting records)
We do not sell or rent your data to anyone. We send marketing emails only if you explicitly opt in (see Section 4b); otherwise we send only transactional account emails.
4. Who We Share Data With (Processors)
We use a small number of trusted service providers ("processors") to run RoThero. Each only receives the data it needs to do its job:
| Processor | Purpose | Data Shared |
|---|---|---|
| Supabase | Database hosting | Roblox user ID, usage data, plan/billing status |
| OpenRouter | AI model routing for code generation | Your prompts and any images you attach (sent only to generate a response; not used by us to train models) |
| Stripe | Payment processing | Billing details Stripe collects directly from you; we only receive subscription/payment status |
| Vercel | App hosting/infrastructure | Standard web request data needed to serve the app, plus cookieless visit analytics (see Section 2) |
| Resend | Transactional email delivery | Your email address and display name, for account emails only |
| Upstash | Rate limiting (abuse prevention) | IP address and Roblox user ID, held briefly as rate-limit counters |
| Discord | Internal operational notifications to our team (new sign-ups, new support tickets); role assignment for linked accounts (we send your Discord user ID and plan tier to Discord's API to assign or remove the server role matching your plan) | Roblox username and user ID; for support tickets, the category, your reply email, and an excerpt of your message; for linked accounts, your Discord user ID and plan tier |
All processors are contractually required to handle your data securely and only for the purposes we specify. We do not share your data with any third party not listed above, and we never sell or rent it.
4b. Marketing Emails & Reviews
Marketing emails: If you opt in to marketing communications (via the "Earn free generations" feature in your dashboard), we may send you occasional product updates and news. Legal basis: your explicit consent (GDPR Art. 6(1)(a)). You can unsubscribe at any time via the link in any email or by contacting support@rothero.com. We store a timestamped record of your consent.
User reviews: If you submit a review and consent to public display, we store your review text, Roblox username, and Roblox avatar image, and may display them on our website. Legal basis: your explicit consent. You may request removal at any time by contacting support@rothero.com.
Support messages: If you contact us through the support form, we process your message, your reply email address, and your Roblox user ID in order to respond to your request. Legal basis: your explicit consent (GDPR Art. 6(1)(a)), given when you submit the form. Support correspondence is delivered to our support inbox and also stored in our database so we can track and resolve requests; it is retained only as long as needed to resolve your request.
5. Legal Basis for Processing (GDPR)
We process your data under the following legal bases:
- Contract, processing your prompts, usage, and billing is necessary to provide the Service you signed up for.
- Legitimate interest, for security, fraud prevention, and improving reliability.
- Legal obligation, for tax and accounting records related to payments.
6. Data Retention
- Account and usage data is retained for as long as your account is active.
- Inactive accounts, accounts with no sign-in activity for more than 24 months may be deleted along with all associated conversations, messages, and usage data. We will attempt to notify you by email before doing so.
- Billing records are retained as required by Italian/EU tax law (typically up to 10 years), even after account closure.
- If you delete your account, we immediately delete your prompt, conversation, and usage data. Billing records are retained only as required by law.
7. Your Rights (GDPR)
As a user, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data ("right to be forgotten"), subject to legal retention requirements for billing records
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time, where processing is based on consent
You can exercise the right to delete and right to export your data directly from the dashboard, go to Support → Download my data (export) or Support → Delete my account (erasure). For all other requests, contact us at support@rothero.com. We'll respond within 30 days, as required by GDPR.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local EU data protection authority.
8. Age Requirements
RoThero is intended for users 13 years of age or older (14 or older if you are located in Italy, in accordance with Italian data protection law). If you are under 16, you must have a parent or legal guardian's consent. We do not knowingly collect data from users under 13. If we discover we have collected data from a user under 13, we will delete it promptly.
9. International Data Transfers
Some of our processors (e.g., Supabase, Stripe, Vercel, OpenRouter, Resend, Upstash) may process data outside the EU/EEA. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) to ensure your data remains protected to GDPR standards.
10. Data Security
We use industry-standard measures (encrypted connections, access controls) to protect your data. No system is 100% secure, but we take reasonable steps to prevent unauthorized access, loss, or misuse of your data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll notify you via the web app or email. Continued use of the Service after changes take effect means you accept the updated policy.
12. Contact Us
For any privacy questions or to exercise your rights:
Email: support@rothero.com
Based in: Italy