Privacy Policy

1. The short version

ArrStudio sells licensed Roblox kits. To run that service we need an account, a way to take payment, and a way to check that a license key is used on the places it was bought for. This policy explains the personal data involved.

• We collect the minimum needed: your account details, your orders and licenses, and the technical data needed to keep the service secure.
• We do not sell your personal data, and we do not share it for advertising. There are no ad or tracking cookies on this site.
• Payments are handled by Midtrans. We never see or store your card number or e-wallet credentials.
• You can export your data and delete your account yourself in Dashboard → Account, or ask us to do it (section 9).

2. Who we are and what this policy covers

ArrStudio (“ArrStudio”, “we”, “us”) is the controller of the personal data described here. This policy covers the website, the customer dashboard, the admin tools we use to run the service, the license-check API called by our Roblox kits, and our purchase and support channels.

It does not cover third-party services that we link to or that you use alongside ours (Roblox, Discord, WhatsApp, your bank). Those have their own policies, and you should read them.

3. The data we collect

We collect data in three ways: what you give us, what is created when you use the service, and what comes from services you connect.

• Account

  What it includes

  Email address, display name, optional Roblox username, a unique account ID, sign-up method, and a password (stored only as a salted hash by Firebase Authentication — we cannot read it).

  Source

  You

• Discord login

  What it includes

  If you sign in with Discord: Discord user ID, username, avatar URL and, when verified, your email address.

  Source

  Discord, with your permission

• Orders & payments

  What it includes

  What you bought, price, discount code used, payment method type (e.g. QRIS, bank transfer), status and timestamps. For installment plans: total, amounts paid, dates and notes recorded by our team after checking a transfer proof.

  Source

  You / Midtrans / our team

• Transfer proofs

  What it includes

  If you send a proof of transfer through Discord or WhatsApp: the image or message you send, which may show your name and account details.

  Source

  You

• QRIS payments

  What it includes

  If you pay by QRIS, the payer name and amount appear in our merchant account (GoPay Merchant) and on your bank statement. We use them only to match your payment.

  Source

  You / your bank or e-wallet

• Licenses

  What it includes

  License keys, the kit, the Roblox place IDs the key is bound to, number of place slots, issue date and status.

  Source

  Generated by us / you

• License checks

  What it includes

  Each time a game server starts, our kit calls the license API. We receive the key, kit ID, kit version, the Roblox place ID and server job ID, and your server's IP address. We keep only the latest check time, version and a running count — not a full history.

  Source

  Your Roblox game servers

• Technical & security

  What it includes

  IP address, browser and device type, pages requested, timestamps and error logs; rate-limit counters (stored under a hashed key); content-security-policy violation reports.

  Source

  Automatically

• Admin activity

  What it includes

  For our own staff accounts: a log of administrative actions (who did what and when).

  Source

  Automatically

• Communications

  What it includes

  Messages you send us on Discord or WhatsApp, and your Discord / WhatsApp identifiers.

  Source

  You

We do not intentionally collect sensitive personal data (such as health, biometric or political data), and we do not ask for government ID.

Roblox thumbnails and place names shown in your dashboard are fetched from Roblox’s public APIs using the place IDs you registered. We do not receive any other data about your Roblox account.

4. Why we use your data (and our legal basis)

• Create and secure your account, sign you in

  Data used

  Account, technical

  Legal basis

  Contract; legitimate interest (security)

• Take payment, issue licenses, deliver kit files

  Data used

  Account, orders, licenses

  Legal basis

  Contract

• Verify that a key is used only on its registered places, and block revoked or unpaid licenses

  Data used

  Licenses, license checks

  Legal basis

  Contract; legitimate interest (preventing piracy and fraud)

• Manage installment plans and unlock a license once fully paid

  Data used

  Orders, installment records

  Legal basis

  Contract

• Provide support and answer your messages

  Data used

  Communications, account, licenses

  Legal basis

  Contract; legitimate interest

• Prevent abuse, fraud and attacks (rate limits, 2FA for staff, audit log)

  Data used

  Technical, admin activity

  Legal basis

  Legitimate interest; legal obligation where applicable

• Remember your language choice

  Data used

  Language cookie

  Legal basis

  Your consent (you can decline it in the cookie banner)

• Keep financial and tax records

  Data used

  Orders, payments

  Legal basis

  Legal obligation

• Send service messages (e.g. about your license or a payment)

  Data used

  Account, orders

  Legal basis

  Contract; legitimate interest

Where we rely on legitimate interest, we balance it against your rights. You can object to processing based on legitimate interest — see section 9.

We do not use your data for advertising, profiling for marketing, or to make decisions that have legal or similarly significant effects on you based solely on automated processing. The only automated decision is license enforcement: a key is refused when it is revoked, not fully paid, used on an unregistered place, or when its place slots are full. If you think a refusal is wrong, contact us and a person will review it.

5. Cookies and local storage

We use only a small number of cookies. Essential ones cannot be switched off because the service would not work without them. You can choose “Necessary only” in the cookie banner, and reopen the choice any time from “Cookie settings” in the footer.

• __session

  Purpose

  Keeps you signed in (HTTP-only, secure)

  Type

  Essential

  Lifetime

  Up to 5 days

• arr_user

  Purpose

  Non-sensitive hint (display name and role) so the menu can render without an extra request

  Type

  Essential

  Lifetime

  Up to 5 days

• discord_oauth_state

  Purpose

  Protects the Discord sign-in against forgery

  Type

  Essential

  Lifetime

  A few minutes

• __mfa

  Purpose

  Proves a staff member completed two-factor verification

  Type

  Essential (staff only)

  Lifetime

  12 hours

• arr_consent

  Purpose

  Remembers your cookie choice

  Type

  Essential

  Lifetime

  1 year

• NEXT_LOCALE

  Purpose

  Remembers your chosen language

  Type

  Preference — only if you accept

  Lifetime

  1 year

• theme (local storage)

  Purpose

  Light / dark display preference

  Type

  Functional

  Lifetime

  Until you clear your browser data

• Firebase auth state (IndexedDB)

  Purpose

  Keeps the live connection to your own license data in the dashboard

  Type

  Essential

  Lifetime

  While signed in

When you open the payment pop-up, Midtrans loads its own scripts and may set its own cookies for fraud prevention and payment processing. Those are governed by Midtrans’ policy.

You can also delete or block cookies in your browser settings. Blocking essential cookies will prevent sign-in.

6. Who we share data with

We share data only with service providers that help us run ArrStudio, under terms that require them to protect it, and when the law requires. We do not sell personal data and do not share it for cross-context behavioral advertising.

• Google (Firebase Authentication, Cloud Firestore)

  What they do for us

  Sign-in and our database

  Data involved

  Account, orders, licenses, logs

• Vercel

  What they do for us

  Website hosting, file storage for kit files and videos, request logs

  Data involved

  All web requests, uploaded files

• Midtrans

  What they do for us

  Payment processing (QRIS, virtual accounts, e-wallets, cards)

  Data involved

  Name, email, order and amount; payment details are entered with Midtrans, not us

• GoPay Merchant (QRIS)

  What they do for us

  Receives QRIS payments made to our merchant account

  Data involved

  Payer name and amount shown with the transfer

• Discord

  What they do for us

  “Sign in with Discord” and our support community

  Data involved

  Discord ID, username, avatar, verified email

• Roblox

  What they do for us

  Public place name and icon; license checks come from your game servers

  Data involved

  Place IDs

• WhatsApp (Meta)

  What they do for us

  Custom orders and support, if you message us there

  Data involved

  Your number and messages

We may also disclose data if required by law, a court or a competent authority, to enforce our terms, to protect our rights, users or the public, or in a merger, acquisition or sale of assets (you would be told beforehand and the recipient must honour this policy).

Your license key and registered place IDs are visible only to you, to our administrators and, to the extent needed, to the services listed above. Other customers cannot see them.

7. International transfers

Our providers operate globally, so your data may be processed in countries other than your own — including Indonesia, the United States, Singapore and other places where Google, Vercel, Midtrans or Discord operate.

Where the law requires, we rely on appropriate safeguards for these transfers, such as the providers’ standard contractual clauses, adequacy decisions, or your consent. Contact us for details.

8. How long we keep data

• Account profile

  How long

  While your account exists. Deleted immediately when you delete your account in Dashboard → Account (or within 30 days if you ask us).

• Licenses and bound place IDs

  How long

  While the license is active. After you delete your account the license is revoked and kept without your email or ID for up to 3 years, to handle disputes.

• Orders, payments and installment records

  How long

  As long as tax and accounting law requires (in Indonesia, generally up to 10 years). After account deletion they are kept without your identity.

• License-check data (last check, version, count)

  How long

  Stored on the license record for as long as that record exists.

• Sessions and sign-in cookies

  How long

  Up to 5 days; 12 hours for staff two-factor status.

• Rate-limit counters

  How long

  Automatically deleted within minutes to hours.

• Admin audit log

  How long

  At least 24 months, for security and accounting.

• Server and security logs

  How long

  Per our hosting provider’s retention (typically days to a few weeks).

• Support messages

  How long

  Up to 3 years after the conversation ends, or until you ask us to delete them.

When retention ends, we delete or anonymise the data. Backups are overwritten on the provider’s normal cycle.

9. Your rights

Depending on where you live, you have some or all of these rights over your personal data:

• Access — get a copy of the data we hold about you.
• Correction — fix data that is wrong or incomplete (you can edit your name and Roblox username in your account).
• Deletion — delete your account yourself in Dashboard → Account, or ask us. We keep only what the law requires or what we need to defend legal claims (section 8).
• Restriction and objection — ask us to pause processing, or object to processing based on legitimate interest.
• Portability — download your data as a JSON file from Dashboard → Account, or ask us.
• Withdraw consent — for example, change your cookie choice at any time. Withdrawal does not affect earlier processing.
• Complain — to your data-protection authority.

Export and account deletion work instantly from your dashboard. For any other request, contact us (section 15). We may ask you to prove you own the account first, and we reply within 30 days (or sooner where the law requires). We do not charge a fee unless a request is clearly excessive.

Regional notes:

• Indonesia — under Law No. 27 of 2022 on Personal Data Protection you may access, correct, delete, restrict, withdraw consent, object to automated processing and claim redress for violations.
• European Economic Area and United Kingdom — the GDPR / UK GDPR rights above apply, and you may complain to your local supervisory authority.
• California — you have the right to know, delete and correct personal information and to opt out of its sale or sharing. We do not sell or share personal information, and we do not discriminate for exercising these rights.
• Philippines (Data Privacy Act 2012), Malaysia (PDPA 2010), Thailand (PDPA 2019) and Vietnam (Decree 13/2023/ND-CP) — you have the access, correction, deletion, objection and consent-withdrawal rights those laws provide, and we honour them.

10. How we protect your data

• Encryption in transit (HTTPS with HSTS) on every page and API call.
• Passwords are handled by Firebase Authentication and stored as salted hashes; we never see them.
• Sessions use HTTP-only, secure, same-site cookies and are checked against Firebase on each request.
• Strict access control: the database can be written only by our server, and each customer can read only their own licenses.
• Staff accounts require two-factor authentication (authenticator app with backup codes); the two-factor secrets are encrypted at rest.
• Rate limiting, anti-replay protection and hashed counters guard sign-in, license checks, discount codes and payments.
• Payment confirmations are verified with a cryptographic signature and re-checked directly with Midtrans before any license is issued.
• An audit log records administrative actions on money, licenses, roles and pricing.
• Kit modules are encrypted and unlock only for valid, paid, registered licenses.

No system is perfectly secure. If you find a vulnerability, please tell us privately through the contact options below before disclosing it publicly. Keep your password, your license keys and your Roblox place files private.

If a breach affects your personal data and the law requires it, we notify you and the competent authority within the legally required time (for example, 72 hours to the authority under the GDPR, and 3×24 hours under Indonesian law).

11. Payments and installments

Online payments run through Midtrans. You enter card, bank or e-wallet details on Midtrans’ pages; we receive only the result (paid, pending, failed), the payment method type and the amount.

You can also pay by QRIS to our merchant account (GoPay Merchant). The payer name and amount are visible to us in that account; we match the payment to your order using the transfer proof you send us, and use that information for nothing else.

Installment plans are arranged with us directly. Our team records each confirmed transfer (amount, date, an optional note) against your license. Until the plan is fully paid, your license stays locked: the key is hidden, the kit file cannot be downloaded and the license check fails. Proofs of transfer you send us on Discord or WhatsApp are used only to confirm the payment.

Discount codes you enter are checked on our server and counted against the code’s usage limit; they are not linked to any profile beyond the order they were used on.

12. Children

Our service is not directed at children under 13 (or the higher minimum age of digital consent in your country, such as 16 in parts of the EU). We do not knowingly collect their data. If you are a parent or guardian and believe a child gave us personal data, contact us and we will delete it.

Many Roblox creators are teenagers. If you are under the age of majority where you live, please make purchases with a parent or guardian’s permission.

13. Links and third-party services

Our site links to Discord, WhatsApp, Roblox and sample sites we built. When you follow a link, the other service’s policy applies. We are not responsible for their content or practices.

Kits you install in your own Roblox game run on your servers. Any data about your players that your game collects is yours to manage; our kits send us only the license-check data described in section 3.

14. Changes to this policy

We may update this policy as the service changes or the law requires. The “last updated” date at the top shows the current version. For material changes we will give clear notice — for example a message in your dashboard or on Discord — and, where consent is required, ask for it again.

15. Contact us

For privacy questions or to use your rights, reach ArrStudio through any of these channels. Please include the email on your account and what you would like us to do.

• Discord (support ticket)
• WhatsApp