Privacy
policy.

RSX is a development brand operated from Silesia, Poland by a group of individuals working under the wider Whitehill Group banner, some of whom are based in the United Kingdom. Neither RSX nor Whitehill Group is an incorporated company.

Because there is no company to name, the controller of the personal data described in this policy is a natural person: paige@rsx.group, contactable at privacy@rsx.group. The other individuals who operate RSX process data under their direction.

Our main establishment is in Poland, so the EU GDPR applies to our processing. Where you are in the United Kingdom the UK GDPR also applies. Where the two differ, we apply whichever gives you more protection.

We have not appointed a Data Protection Officer, as we are not required to. Data protection matters are handled directly by privacy@rsx.group.

This policy covers personal data we process through the ID Portal, the API, Webhooks, the AI Portal, our websites, our documentation, our support channels, and the systems we operate on Roblox.

It does not cover:

• —applications built by other developers on the RSX Platform — they are separate controllers with their own notices, and section 6 explains the split;
• —Roblox itself, Discord, or any other third-party platform you use alongside ours — their own policies apply;
• —sites we link to.

Terms used here have the meanings given in the Terms of Service.

Account data — ID Portal. Collected when you register and while you hold an account: email address, username and display name, a hashed and salted password or an external authentication identifier, account status and roles, security settings including two-factor enrolment, and your preferences.

Linked account data. If you link a Roblox or Discord account, we store the platform’s user ID, the username and avatar reference at the time of linking, and the scopes you granted. We do not receive or store your password on those platforms.

Authentication and session data. Session and refresh token identifiers, issue and expiry times, sign-in and sign-out events, the IP address and user agent used, approximate location derived from IP at country level, and failed authentication attempts.

Developer and API data. Registered application details, hashed API keys and key metadata, and for each request: timestamp, endpoint, method, response status, latency, approximate payload size, rate-limit counters, IP address, and user agent. We do not retain full request or response bodies except where sampled for a specific investigation.

Webhook data. The endpoint URLs you register, signing secret metadata, and for each delivery: event type and ID, timestamp, response status, latency, and retry history. We log delivery outcomes rather than the full payload content, except where needed to diagnose a reported failure.

AI Portal data. The prompts and files you submit, the outputs generated, the model and settings used, token counts, timestamps, and the account or key that made the request. Abuse-detection signals derived from that traffic.

Technical and security data. Server and edge logs, request metadata processed by our infrastructure provider, bot and abuse detection signals, and records of enforcement action taken on an account.

Support and correspondence. Anything you send to our contact addresses, together with the address you sent it from and our replies.

We do not collect payment card details, government identity documents, biometrics, precise location, or special category data as defined by Article 9 GDPR. Do not send them to us — including through the AI Portal.

We process personal data only for the purposes below, on the lawful bases stated.

Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights. You can ask for that assessment, and you can object under section 11.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles.

If we ever want to use your data for a new purpose that is not compatible with the above, we will tell you first and, where required, ask for consent.

Inference runs on infrastructure we control. AI Portal requests are executed on RSX-operated systems and on our infrastructure provider’s managed inference platform. Prompt and output content is not sent to external model vendors such as commercial chatbot APIs.

We do not train on your content. Prompts, files, and outputs are not used to train, fine-tune, or evaluate any model, ours or anybody else’s.

Content is processed to produce your output, and separately to generate abuse-detection signals such as rate and content-policy flags. Staff access to prompt content is restricted to named personnel, permitted only to investigate a specific reported fault or abuse case, and logged.

Retention is set out in section 10. You can delete an AI Portal conversation from the portal at any time, which removes it from your history and schedules it for deletion from our systems.

Do not submit credentials, payment details, health or other special category data, or somebody else’s personal data that you have no lawful basis to process.

Output is generated automatically and can be wrong. Section 10 of the Terms of Service and section 7 of the Developer Terms set out your responsibilities before relying on it.

When you connect a third-party application to your RSX account, we send that developer the data covered by the scopes you approved. From that point they are an independent controller for what they hold, and their own privacy notice governs it.

The Developer Terms require developers to publish a privacy notice, request minimum scopes, secure what they receive, delete it when you disconnect, and notify us of incidents within 48 hours. We enforce those obligations, but we cannot control what a developer does with data once delivered.

To see or remove your connections, open the ID Portal and revoke the application. Revoking stops further delivery immediately and obliges the developer to delete what they hold. To confirm deletion, contact the developer directly; tell us at privacy@rsx.group if they do not comply.

Webhook deliveries go only to endpoints registered by the developer. We log the outcome of each delivery as described in clause 3.5.

Players who interact with an RSX system inside a Roblox experience do not hold RSX accounts. Where we process a Roblox user ID in that context, we do so on behalf of the experience operator and keep it only as long as the feature requires.

We use strictly necessary cookies and local storage only: your session token, cross-site request forgery protection, load balancing and bot-protection identifiers set by our infrastructure provider, and your interface preferences. These do not require consent because the Services cannot work without them.

We do not use advertising cookies, third-party trackers, social plug-ins, or cross-site analytics.

Where we measure traffic, we use aggregate, cookieless analytics that does not build a profile of you or track you across sites.

Blocking strictly necessary cookies in your browser will prevent sign-in from working.

We share personal data only with the categories of recipient below. We do not sell it.

Processors act only on our documented instructions under a contract meeting Article 28 GDPR, with confidentiality, security, sub-processor, and deletion obligations. We review them before engagement.

We respond to lawful requests from authorities, but we check that each request is valid, specific, and proportionate, disclose only what is required, and tell you unless legally prohibited from doing so.

If the operation of RSX passes to a different operator, or to an entity later formed to run it, data may transfer with it. We will notify you before that happens and before any change of purpose, and this policy continues to apply until you are told otherwise.

We will publish material changes to our processors on this page at least 30 days before they take effect, so you can object.

Our infrastructure is configured to process and store data in the European Economic Area and the United Kingdom wherever the service allows it.

Some of the individuals who operate RSX are based in the United Kingdom and access data from there. That transfer relies on the European Commission’s adequacy decision for the United Kingdom and, in the other direction, on the UK’s adequacy regulations for the EEA.

Where a processor operates a global network and data may be handled outside the EEA or UK, the transfer is covered by the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where relevant, plus encryption in transit and at rest and a transfer risk assessment.

You can request a copy of the transfer safeguards for a specific processor from privacy@rsx.group.

We keep personal data only as long as we need it for the purpose it was collected for.

Deletion means removal from live systems immediately and from encrypted backups within 90 days, as backups rotate. Data in a backup is not used for any purpose while it waits to be overwritten.

We keep a minimal record of terminated accounts — an identifier, the date, and the ground — because we cannot enforce clause 8.3 of the Terms of Service without it. This is a legitimate interest and you may object under section 11.

Under the EU and UK GDPR you have the right to:

• —Access — get a copy of the personal data we hold about you, and information about how we use it.
• —Rectification — have inaccurate data corrected and incomplete data completed.
• —Erasure — have data deleted where we no longer have grounds to keep it.
• —Restriction — have processing paused while a dispute about accuracy or grounds is resolved.
• —Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another controller where technically feasible.
• —Object — object to processing based on legitimate interests, including profiling, on grounds relating to your situation.
• —Withdraw consent — at any time, where we rely on consent. This does not affect processing already carried out.
• —Complain — to a supervisory authority, as set out in clause 16.3.

Exercise any of these by writing to privacy@rsx.group from the email address on your account, or through the ID Portal where the tool exists. Say which right you are exercising and which data it concerns.

We respond within one month. We may extend by up to two further months for complex requests, and will tell you within the first month if we do.

Requests are free. We may charge a reasonable administrative fee, or refuse, only where a request is manifestly unfounded or excessive — and we will explain why.

We may ask for information to confirm your identity, but only what is necessary and only where we genuinely cannot otherwise verify you. We will not create a new identity record from it, and we delete what you send once verification is complete.

Some rights are limited. We may keep data needed for a legal obligation, for the establishment or defence of a legal claim, or for the enforcement records in clause 10.3. Where we refuse a request, we will tell you the reason and how to challenge it.

Technical measures: TLS for all traffic; encryption at rest for stored data; passwords stored using a modern memory-hard hashing algorithm with per-user salts; API keys stored only as hashes; signed and expiring session tokens; signed webhook payloads; network-level DDoS and bot protection.

Organisational measures: access on a least-privilege basis, granted per role and reviewed periodically; multi-factor authentication required for administrative access; audit logging of administrative actions; separation of production from development data; supplier review before engaging a processor.

No system is completely secure. You play a part too — use a unique password, enable two-factor authentication, and keep API keys off client devices.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify our supervisory authority within 72 hours of becoming aware, and we will notify you without undue delay where the risk is high. Our notice will say what happened, what data was affected, what we have done, and what you should do.

Report a suspected vulnerability or breach to security@rsx.group. Section 12 of the Developer Terms sets out our disclosure terms.

RSX accounts are for people aged 16 or over. The platform is a developer tool and is not directed at children.

We do not knowingly collect personal data from anyone under 16 in connection with an RSX account. If we learn that an account holder is under 16, we will terminate the account and delete the data, other than the minimal record needed to prevent re-registration.

If you believe someone under 16 holds an account, tell us at privacy@rsx.group and we will investigate promptly.

Players in a Roblox experience may be under 16. We do not collect account data from them. Where an RSX system inside an experience processes a Roblox user ID, we do so on behalf of the experience operator, for the shortest period the feature requires, and we do not use it to build a profile.

We use automated systems to detect abuse: rate-limit breaches, credential stuffing, leaked keys, spam patterns, and AI Portal content-policy violations. These systems can automatically throttle traffic, revoke a key, or restrict an account.

Automated action is limited to what is needed to stop immediate harm. A permanent termination is reviewed by a person before it is final, except where clause 8.3 of the Terms of Service applies and the evidence is unambiguous.

Where a decision that significantly affects you is made by automated means, you have the right to be told, to obtain human review, to express your view, and to contest it. Use appeals@rsx.group.

We do not use automated decision-making for profiling unrelated to security and enforcement, and we do not use it for marketing.

We update this policy when our practices, our processors, or the law change.

For changes that materially affect how we use your data, we will give at least 30 days’ notice by email or in the ID Portal before they take effect. Where a change requires consent, we will ask for it rather than assume it.

Corrections and clarifications take effect when published. The version and effective date at the top of this page always reflect the current text.

Previous versions are available on request from privacy@rsx.group.

RSX is an unincorporated group operating from Silesia, Poland, under the Whitehill Group banner. Controller: paige@rsx.group.

Privacy and data rights requests: privacy@rsx.group. Security: security@rsx.group. Everything else: legal@rsx.group.