Privacy Policy

This Privacy Policy explains how HUBERT.STUDIO LLC ("ROLearn", "we", "us") collects and processes personal data across the ROLearn web platform, the ROLearn mobile app, and the ROLearn Multiplatform SDK (collectively, the "Service").

ROLearn operates in two distinct roles:

• As a controller for data about our own account holders (developers and brand customers) and visitors to our website.
• As a processor for the player-telemetry data that our SDK customers send us about the end-users of their games. For that data, the SDK customer is the controller and our handling is governed by our Data Processing Agreement. This policy describes that processing for transparency, but the customer's own privacy notice governs those end-users.

Account data: When you create an account we collect your email address and a securely hashed password. If you sign in with Google or another social provider (Roblox, Discord, X), we receive your provider account ID, display name, email address, and profile picture. We never store plaintext passwords.

Preferences & workspace data: Tracked games and genres, alert preferences, subscription tier, team/workspace membership, and UI settings, so your experience persists across sessions and devices.

Roblox public data: Publicly available game metrics (concurrent players, visits, likes, favorites, gamepasses) and public creator/group metadata from official Roblox APIs. We do not access private Roblox player accounts.

Usage & activity data: Which features you use, response times, your plan at time of access, and an activity identifier derived from your authentication session. Retained for 30 days, then automatically purged.

Product analytics (consent-based): If you accept analytics cookies, we use PostHog (interaction data and session recordings for identified, signed-in users) and Google Analytics 4 (aggregate traffic and usage patterns) to help us improve the platform. Neither tool captures anything, and the Google Analytics script is not even loaded, until you opt in via the cookie banner. Google's advertising and cross-site signals (Google Signals, ad personalization) are disabled — this is analytics-only. See our Cookie Policy.

SDK player telemetry (as processor): When our SDK customers integrate ROLearn into their games, we receive event telemetry about their players, including a developer-supplied player identifier, session identifier, coarse country (derived from account region or locale, not precise location), device type and operating system, and in-game behavioral events (sessions, purchases, levels, performance, crashes, and brand-zone interactions). Our SDK actively rejects payloads containing direct identifiers such as email, phone, government IDs, or card numbers. The player identifier is usually the player's platform account ID (on Roblox, the numeric UserId). We do not store it as received: it is replaced with a salted pseudonym that is unique to each customer, so the same player cannot be linked across customers. The raw ID is kept for at most 30 days and only for one purpose, letting a customer who has connected Roblox Open Cloud sample their own players' data. We still treat the pseudonym as personal data. We process this data on our customers' instructions under our DPA.

Public social / earned-media data: For brand-intelligence features we collect publicly available data about creators and posts from platforms such as YouTube, X, TikTok, Instagram, Twitch, and Facebook — including handles, follower counts, and post content. See Section 5 ("Data About Third Parties").

Email subscriptions: If you opt in to email updates, we collect your email address and the signup source.

Business contacts and prospects: To find and contact organisations that may want our products (for example brands, game studios and people we meet at industry events), our business-development team records work contact details of people at those organisations: name, job title, company, work email, work phone, LinkedIn profile URL, and notes of our conversations. We obtain this from you directly, from business cards and event attendee lists, from public company and professional sources, and, where enabled, from licensed business-contact data providers such as Apollo.io. We use it only to contact you about our products; we do not sell it. You can object at any time by replying to any of our messages or writing to [email protected]: we then stop contacting you and keep only your email address on a suppression list so that you are not contacted again.

Mobile app data: If you use the ROLearn mobile app, we may collect a device identifier and (with your permission) a push-notification token to deliver alerts. See Section 11. (Mobile-app specifics are maintained in the app's store privacy disclosures and should be read together with this policy.)

We process personal data for the purposes below. Where the EU/UK GDPR applies, the relevant legal basis is shown; where Vietnam's Personal Data Protection Decree (Decree 13/2023/ND-CP) applies, processing is based on your consent and/or the performance of our contract with you.

• Provide, operate, authenticate, and secure the Service — performance of a contract.
• Deliver alerts and notifications you configure — performance of a contract.
• Process subscription payments — performance of a contract / legal obligation.
• Product analytics, session replay, and traffic measurement (PostHog, Google Analytics 4) — consent.
• Train and improve ML models using aggregated public Roblox data, not your personal information — legitimate interest.
• Collect public social/creator data for brand intelligence — legitimate interest (see Section 5).
• Send opt-in email updates — consent.
• Contact prospective business customers and keep a record of those conversations (see "Business contacts and prospects" in Section 2): legitimate interest in promoting our products to organisations, balanced by limiting it to work contact details, honouring every objection, and deleting stale records.
• Prevent abuse and enforce rate limits — legitimate interest.

We rely on the service providers below, each under their own privacy terms. Our current, authoritative list — including data categories and locations — is maintained on our Sub-processors page.

• Roblox Corporation — Source of publicly available game metrics and metadata for all users. For Studio customers who connect Roblox Open Cloud, requests are also made to Roblox with the customer’s own API key, on the customer’s instruction.
• Google LLC (Sign-in with Google) — Optional account sign-in / linking.
• Google LLC (Google Fonts) — Delivery of the web fonts used across the interface.
• Google LLC (AdSense) — Advertising on public pages. Consent-gated via Google Consent Mode v2: ad storage and ad personalization stay denied until the visitor accepts the cookie banner.
• Google LLC (YouTube Data API) — Discovery of public creator videos and channel metrics.
• Lemon Squeezy, LLC — Subscription billing and payment processing.
• Amazon Web Services, Inc. (SES) — Transactional and opt-in email delivery (Amazon Simple Email Service).
• PostHog Inc. — Product analytics and session replay (consent-gated).
• Functional Software, Inc. (Sentry) — Error monitoring and performance tracing.
• Anthropic PBC (Claude) — AI-generated insights, Dev Lens analysis, RLBot assistant.
• Amazon Web Services, Inc. (EC2) — Application, API, and background-worker compute hosting, including the in-memory cache and job queue.
• Amazon Web Services, Inc. (RDS) — Primary production database hosting (managed PostgreSQL).
• Amazon Web Services, Inc. (S3) — Customer-configured destination for SDK data exports.
• Cloudflare, Inc. — CDN, DDoS protection, and object storage (R2) for database backups and ML model files.
• Apify Technologies s.r.o. — Collection of public social earned-media (TikTok, Instagram, Facebook).
• Discord Inc. — Internal operations notifications (sales-lead alerts).
• X Corp. (Twitter / X API) — Discovery of public posts and creator metrics.
• Amazon.com, Inc. (Twitch API) — Discovery of public streams and creator metrics.
• Meta Platforms, Inc. (Instagram Graph API) — Discovery of public posts and creator metrics.

How we source this data. Our brand- and market-intelligence features analyze publicly available information about social-media creators, channels and their public posts — handles, display names, follower and view counts, public post text and engagement metrics. We obtain it in two ways: (1) directly from the platforms' official or licensed APIs (for example YouTube, X, Twitch and Instagram); and (2) for platforms that offer no public search API (for example TikTok, Instagram and Facebook discovery), through reputable third-party data-collection vendors (such as Apify). We collect only public, professional/creator-facing activity; we do not access private accounts, private messages, or content behind a login.

Legal basis and balancing. Where the GDPR/UK GDPR applies, we rely on our legitimate interest (Article 6(1)(f)) as controller in providing earned-media and market intelligence to our business customers. We have weighed that interest against the rights of the individuals concerned: we limit processing to public professional activity, minimize what we retain, and do not use it to make automated decisions with legal or similarly significant effects about those individuals.

If your public data appears in our systems. Creators and other named individuals are data subjects with rights. You may object to this processing and request access to, or deletion of, the data we hold about you — including where your name or handle appears in a ranking or report. Contact [email protected] and we will action verified requests, subject to our legitimate-interest assessment, within 30 days. You also retain control at the source: content you set to private, or remove, on the underlying platform stops being available to us on our next refresh.

Data is stored in PostgreSQL with encrypted connections. Passwords are hashed with bcrypt. Authentication uses short-lived, cryptographically signed JSON Web Tokens. SDK data exports are encrypted before delivery to the customer's storage. All traffic between your device and our servers is encrypted via HTTPS (TLS 1.2/1.3).

Authentication storage: On the web, your session is held in HttpOnly cookies (rolearn_access, rolearn_refresh) that JavaScript cannot read, plus a readable CSRF cookie (rolearn_csrf) used only for cross-site-request-forgery protection. On mobile, tokens are stored in the device's secure keystore. See our Cookie Policy for the full list.

• Usage/activity data: 30 days, then purged.
• Per-player first-seen date (used to tell new players from returning ones): deleted 13 months after the player's last activity.
• SDK player telemetry: retained for a default of 30 days (configurable per customer), then deleted; synthetic test events are pruned within 7 days.
• Public game metrics: hourly resolution for ~3 days, then aggregated into daily summaries; per-platform snapshots retained ~90 days.
• Account data: kept for the life of your account until deletion.
• Email subscriptions: until you unsubscribe.
• Business contacts: deleted after 3 years without any contact or activity; if you object, only your email address is kept, on a suppression list.

Request deletion of your account and associated data any time at [email protected]. We process verified deletion requests within 30 days, except where we must retain data to comply with law, resolve disputes, or enforce our agreements.

Depending on your location (including under the EU/UK GDPR, California CCPA/CPRA, and Vietnam's PDPD), you may have the rights to access, correct, delete, port, and restrict processing of your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time.

California residents: We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising.

To exercise any right, contact [email protected]. We may need to verify your identity before actioning a request, and we will respond within 30 days. You also have the right to lodge a complaint with your local data-protection supervisory authority.

Our accounts are for developers and businesses. ROLearn accounts are intended for people aged 13 or older who build or market games. Creating an account requires you to confirm you are 13 or older; we do not knowingly create accounts for children under 13, and if we learn an account belongs to a child under 13 we close it and delete the associated data.

Community features. Where ROLearn offers community features (such as chat, direct messages, follows and reviews), they are available only to account holders and are subject to our community rules, reporting tools, and moderation. We do not knowingly permit children under 13 to use these features; see "Report a concern" below.

SDK player telemetry may relate to minors. Because games built on Roblox and similar platforms have audiences that include children, the player telemetry our SDK customers send us may concern minors. For this data we act only as a processor, on the customer's documented instructions. We apply data minimization (our SDK rejects direct identifiers such as email, phone and payment data, and does not request precise location); we do not sell it; and we do not use it for advertising, targeting or profiling beyond the analytics the customer commissions. Our customers can designate an experience as directed to children, and when they do we disable advertising features for that experience. Under our DPA, our SDK customers are the controllers and warrant that they have obtained any consents required under COPPA, the GDPR (including Article 8), and applicable platform rules before sending us player data.

Aggregate audience data. For a Studio customer that connects Roblox Open Cloud, we may show that customer aggregate, non-identifying audience breakdowns for its own experiences (including age ranges) that Roblox derives and returns. These are counts, not profiles of individual players.

Report a concern. If you believe a child under 13 has provided us personal information directly, contact [email protected] and we will delete it.

ROLearn is operated from the Socialist Republic of Vietnam and our servers and several sub-processors are located in the United States. Where we transfer personal data internationally — including out of the EEA/UK — we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK transfers) as the transfer mechanism, together with any data-transfer assessment required under Vietnam's PDPD. By using the Service you understand your data may be processed in these jurisdictions.

If you use the ROLearn mobile app and opt in to push notifications, we store a push-notification token to deliver alerts (e.g. breakout signals, trending alerts, price changes). You can disable notifications at any time in your device settings or in-app. Mobile features such as profiles, direct messages, and content reporting are governed by Section 5 ("User-Generated Content") of our Terms of Service; reports we receive (including the reporter's and reported user's identifiers and context) are retained for safety and enforcement even after content or accounts are removed.

We may update this Privacy Policy from time to time. Material changes will be posted here with a new revision date and, where appropriate, notified by email or in-app. Continued use after changes take effect constitutes acceptance of the updated policy.

Questions about this policy or your data? Contact our privacy team at [email protected] or general support at [email protected].