GROUPSPACE — One console for your roleplay server

Legal

Six documents. Plain language where plain language works, precise language where it has to be precise. If something here is unclear, that is a defect — tell us and we will rewrite it.

Draft. This document is a working draft prepared for GROUPSPACE and has not been reviewed by a lawyer. Do not publish it as binding policy until counsel has read it — particularly the sections covering children’s data, and the Roblox and Discord platform terms it depends on.

Plain english

The short version

This is a summary, not the agreement. Where it disagrees with the documents below, the documents win. It exists because nobody should have to read a privacy policy to find out whether their messages are being logged.

What is collected

Your account details. The user id and username of any game or chat account you link — nothing else from those platforms. What happens inside a workspace you belong to: records staff file about you, positions you hold, shifts you clock, ledger entries, and session and presence data sent by the game integration. If, and only if, your workspace has switched it on, filtered in-game chat.

Who can see it

People in your workspace who hold the relevant permission, and nobody else in it. Chat history sits behind a separate permission that is not in any default position template, and every single read is written to the audit log with who searched for whom. GROUPSPACE staff reach workspace data only for support you asked for, for a security investigation, or where the law requires it — and that access is logged too.

How to get it deleted

Email privacy@groupspace.xyz and we will delete what we hold on you. If you exercise your right to erasure through Roblox, Roblox tells us over a signed webhook and the purge runs without you having to contact us at all. If you unlink a platform account or revoke our access, the data obtained through it is expunged. Chat messages delete themselves within 30 days regardless.

What never happens

Your data is not sold. It is not used to train AI or language models. It is not joined to outside datasets or used to follow anyone between experiences that are not the customer’s own. Those are not marketing promises we could quietly drop — they are Roblox platform rules that bind us, and breaking them costs us the integration.

The documents

Which document covers what

Read the terms if you are deciding whether to use GROUPSPACE. Read the privacy policy if you are in somebody's workspace and want to know what they can see. Read the DPA if you are the person signing.

Terms of service

The agreement for using GROUPSPACE: how accounts are issued, what a workspace owner is responsible for, billing and cancellation, and what happens when an account ends.

Privacy policy

Every category of data GROUPSPACE holds, why it is held, how long it is kept, who it is shared with, and how to have it deleted. Includes a dedicated section on children's data.

Acceptable use policy

What you may not do with GROUPSPACE — including the platform rules we inherit from Roblox, and the rules that stop staff tooling from being turned on the people it is meant to protect.

Data processing addendum

The processor terms that apply when GROUPSPACE handles member data on your behalf. Required before chat history can be enabled on a workspace.

Subprocessors

The categories of service provider GROUPSPACE relies on to run the product, and how changes to that list are announced.

Cookie policy

The two cookies GROUPSPACE sets, what each one does, why the session cookie lives on the parent domain, and why there is no cookie banner today.

Order of precedence. The terms of service is the master agreement. The acceptable use policy is incorporated into it by reference. The data processing addendum overrides the terms on anything to do with processing personal data on a customer’s behalf. The privacy policy describes what GROUPSPACE does as a controller in its own right and is not a contract.

Platform obligations

Rules we did not write

GROUPSPACE is a third-party application on other companies' platforms. Some of what you read in these documents is not our policy choice — it is a condition of being allowed to connect at all, and it is stated here so you can hold us to it.

Data minimisation

For a linked platform identity, GROUPSPACE stores the user id and the username. Not birth dates, not photographs, not email addresses harvested from the platform.

No cross-experience tracking

Users are identified by platform user id. No fingerprinting, no joining platform data to outside datasets, and no reputation graph that follows a player between unrelated customers.

No AI training on user data

Data flowing through GROUPSPACE is not used to train models. This is why there is no chat-trained moderation feature and will not be one.

No sale of platform-derived data

Data obtained through a platform API is not sold, licensed or turned into a data product.

Erasure and revocation

The Roblox RightToErasureRequest webhook is handled continuously, signature-verified, with a 300-second replay window. All data obtained through a platform is expunged when access to it is revoked.

13 and over for sign-in

Roblox OAuth requires an account holder to be 13 or older to authorise a third-party app. That floor applies to signing in to GROUPSPACE on the web.

Under-13 players are still in your game. The 13+ floor applies to signing in to GROUPSPACE, not to playing. A workspace that runs the game integration is handling data about children whether or not those children ever visit a GROUPSPACE page. The children’s data section of the privacy policy explains what that means for the customer and for us.

Contact

Where to send things

Four mailboxes, monitored by people. Use the right one and the reply is faster.

privacy@groupspace.xyz

Data subject requests, questions about the privacy policy, and anything about what is held on a person.

legal@groupspace.xyz

Contract questions, the DPA, notices under the terms of service, and law-enforcement requests.

security@groupspace.xyz

Vulnerability reports and suspected security incidents. See the acceptable use policy before testing anything.

dpo@groupspace.xyz

The data protection contact, for matters that need to go over the head of the product team.

Who you are contracting with. GROUPSPACE LLC, an Ohio limited liability company, formed 18 November 2024 (Ohio Secretary of State filing 202432303380). Address for service of process: c/o ZenBusiness Inc., 100 E Broad St Ste 1350, Columbus, OH 43215, United States.

Last updated 10 August 2026 Early access — expect changes

Questions before you sign anything?

Ask. These documents are drafts and the people who wrote them are reachable — legal@groupspace.xyz gets a real answer, not a form response.