Privacy policy
What GROUPSPACE holds about you, why, for how long, who else sees it, and how to make it go away. Written to be read by the people it describes, including the ones who never signed up.
Last updated 10 August 2026
Summary
GROUPSPACE is management software for online communities — mostly Roblox groups. It stores the structure of a community, the records its staff file, its internal economy, and data sent from games it is connected to.
Most of what GROUPSPACE holds about a person is held on behalf of a community, not for ourselves. A small amount — your account, your billing, our logs — is ours. The distinction matters and the next section sets it out.
- For a linked platform account we store the user id and the username. That is the whole of it.
- We do not sell personal data and we do not use it to train AI or language models.
- We do not track anyone across experiences or join platform data to outside datasets.
- In-game chat is only stored where a workspace has deliberately switched it on, is capped at 30 days, and is readable only by people holding a specific permission — with every read logged.
- Roblox’s erasure webhook is handled continuously, and revoking our access to a platform account expunges what we obtained through it.
Controller or processor
Data protection law distinguishes the party that decides why data is collected (the controller) from the party that handles it on instruction (the processor). GROUPSPACE is both, in different places, and which one it is changes who you should contact.
What we collect
Account data
- Display name and email address.
- Authentication data: password hash where a password is used, and the identifiers returned by a platform sign-in.
- Workspace memberships, positions and permissions.
- Preferences — notification settings, interface settings.
Linked platform identities
When you connect a Roblox, Discord or other platform account, we store the platform user id and the username or display name, plus the tokens needed to keep the connection working. Nothing else. See the minimisation section below.
Workspace and organisation data
- The org chart: organisations, units, positions, and who holds them.
- Applications you submit and their outcome.
- Time and attendance: shifts, clock-ins, clock-outs, and the corrections applied to them.
- Operations you are rostered onto or take part in.
- Quota progress.
Records filed by staff
Arrests, warnings, citations, commendations, internal notes, community background flags, incident reports and disciplinary entries — whatever the community’s own rules produce. Each entry carries the subject, the author, a timestamp, and whatever the author typed. Records are the point of the product and they are also the part most capable of being unfair, which is why the acceptable use policy has a section about them.
Ledger and economy data
Double-entry ledger entries in the workspace’s own currency: payroll accruals, fines, transfers, tax calculations, and payout runs. Where a payout is settled in a platform currency, we hold the calculated instruction and the fact that it was marked settled. We do not hold, move or touch real money or Robux.
Game session and presence data
Where a community has installed the game integration, its game servers send us events about the players in them: joins and leaves, session duration, which server and experience, presence, door checks, and the events the community has configured. This is first-party data from the customer’s own games, sent by their own installation of our SDK.
Chat messages, where enabled
Only if the workspace has opted in. Filtered message text as the platform produced it, the sender, the channel type, and when it was sent. Covered in full below.
Billing data
Plan, subscription status, invoices, and the payment processor’s customer reference. Card numbers go to the processor and never reach our systems.
Technical and support data
- Server logs: IP address, user agent, request path, timing, and a correlation id.
- Audit log entries: who did what in a workspace, when, and from where.
- Error reports, which may incidentally include a user or workspace id where an error was specific to one.
- Anything you send us in a support conversation.
Platform data minimisation
Roblox’s rules for third-party applications require data minimisation, and we build to them rather than to what the API would technically let us take.
Why we hold it
Where GROUPSPACE is the controller, these are the purposes and the legal bases we rely on under the UK GDPR and EU GDPR. Where GROUPSPACE is a processor, the basis is the workspace owner’s, not ours.
We do not run behavioural advertising and we do not profile people for marketing. If we ever send a marketing email it will be to an account holder, about GROUPSPACE, with an unsubscribe link, on consent or soft opt-in.
Chat history
Chat history is the most sensitive thing in the product. It is treated as such.
Children's data
This section is not boilerplate. Roblox’s audience skews young, and a large share of the people whose data passes through GROUPSPACE are children.
Two different populations
The second row is the one that matters. A player can have a substantial GROUPSPACE record without ever having heard of GROUPSPACE.
We do not shelter under Roblox
Roblox operates its own children’s privacy programme on its own platform. That posture does not extend to our servers. When a game sends us data about a child, GROUPSPACE and the community that runs the game carry their own obligations for it — including under COPPA in the United States, the UK Age Appropriate Design Code, and the equivalent rules elsewhere. We say this plainly because the alternative — assuming the platform covers it — is how this goes wrong.
What follows from that
- We never ask a child for anything. There is no data collection surface pointed at players. Everything we hold about a player arrives from the community’s own game server.
- Minimisation is stricter than the law’s floor. User id and username. No age, no birth date, no avatar, no contact details.
- No profiling and no advertising. Nothing in GROUPSPACE targets a player, scores them, or feeds an ad system. There is no ad system.
- No AI training. Children’s chat is not training data, for us or for anyone.
- Chat is gated hardest. Opt-in, top plan, signed DPA, 30-day cap, dedicated permission, audited reads. The controls in the section above exist principally because this data is largely about children.
- Deletion is fast and unconditional. An erasure request through the platform purges everything for that user id across every workspace, with no review step and no exceptions we grant on request from a customer.
Parents and guardians
If you are a parent or guardian and you believe we hold data about your child, write to privacy@groupspace.xyz. Tell us the Roblox username or user id — that is all we can search on, because it is all we store. We will identify what is held, tell you which community is the controller, and delete our copy on request. We will not ask you to prove your identity with documents we would then have to store; we will verify through the platform account instead.
Where the request concerns data a community controls, we act on it as a processor and tell the community. We will not leave a child’s data in place because a customer objects.
For community owners
If you run a workspace connected to a game with young players, you are a controller of children’s data. Enabling chat history multiplies that responsibility. Get advice before you switch it on, and read the children’s data annex of the DPA.
How long we keep it
Where an account is suspended for non-payment rather than terminated, data is retained for 90 days so it can be recovered if you come back.
International transfers
GROUPSPACE is operated from the United States (Ohio) and primary infrastructure — the application and the database — is hosted with Railway in the United States, US East. Payment processing is handled by Stripe in the United States.
Where data leaves the UK or the European Economic Area, the transfer relies on an adequacy decision where one exists, and otherwise on the standard contractual clauses (with the UK addendum where relevant) plus a transfer risk assessment. Details of the mechanism for a specific provider are available from privacy@groupspace.xyz.
We are not claiming certification under any transfer framework. We are describing the mechanism we use.
How it is protected
These are practices, not accreditations. GROUPSPACE holds no security certification and does not claim one.
- Encryption in transit on every connection, and encryption at rest for chat history, held separately from the main tables.
- A permission model enforced at query time rather than by filtering results afterwards — filtering afterwards leaks the existence of records through result counts.
- An append-only audit log covering privileged actions, with chat reads logged individually.
- Signed, replay-protected webhooks in both directions, with idempotency on ingest.
- Least-privilege staff access, granted for a reason and logged when used.
- Development against the CASA (OWASP-based) requirements that Roblox applies to third-party applications, and against the platform’s security expectations generally. Aligning our practices with a standard is not the same as being assessed against it, and we do not say otherwise.
- Error tracking and structured logging with correlation ids, so an incident can be reconstructed.
No system is perfectly secure. If we suffer a breach affecting personal data we will notify the relevant supervisory authority and affected controllers without undue delay, and affected individuals where the law requires it.
Found a vulnerability? security@groupspace.xyz. Read the security research section of the acceptable use policy before you start testing.
Your rights
Depending on where you live you have some or all of these rights. We honour them for everyone rather than checking your jurisdiction first.
Write to privacy@groupspace.xyz. We respond within one month and will say so if a request is complex enough to need longer. We verify identity proportionately — usually by confirming control of the account or platform identity, not by asking for documents we would then have to keep.
Where a request concerns data a community controls, we will forward it and tell you who they are. Where the community will not act and the data is a child’s, we will act anyway.
Erasure and revocation
The Roblox erasure webhook
When a Roblox user exercises their right to erasure, Roblox notifies us over a signed RightToErasureRequest webhook. The handler runs continuously, verifies the HMAC signature before parsing anything, enforces a 300-second replay window, and honours only requests that arrive from the platform.
For that user id, across every workspace holding data for them, we purge records, game sessions, operation participation and chat messages. This is deletion, not anonymisation, and it is not reversible. The erasure itself is written to the audit log so it can be shown to have happened without keeping the data that would prove it.
Revoking access
Unlinking a platform account, or revoking our authorisation from the platform’s own settings, expunges the data we obtained through that connection. You do not need to ask us and you do not need a reason.
Platforms without an erasure signal
Roblox provides this webhook; other platforms we support do not. For those, erasure runs through a manual request to privacy@groupspace.xyz — same purge, same audit entry, different trigger.
Data you have copied elsewhere
If a community has exported GROUPSPACE data into its own database, a Discord bot, or a spreadsheet, the erasure obligation follows the data. Our purge removes our copy. It cannot remove theirs.
Changes
We will update this policy as the product changes. Material changes — new categories of data, a new purpose, a new class of recipient — get at least 30 days’ notice by email to account holders and a notice in the application. Everything else takes effect on publication and the date at the top changes.
Previous versions stay available so you can see what moved.
Contact
The controller for the data described in this policy is GROUPSPACE LLC, an Ohio limited liability company, c/o ZenBusiness Inc., 100 E Broad St Ste 1350, Columbus, OH 43215, United States.
- privacy@groupspace.xyz — data subject requests and anything about this policy.
- dpo@groupspace.xyz — our data protection contact, for anything that needs to go over the product team’s head. A statutory data protection officer is not generally required of a company this size, but the chat-history feature is systematic monitoring of data about children, which is the case where one can be: [decision needed before chat history leaves beta]
- security@groupspace.xyz — vulnerability reports and suspected incidents.
- legal@groupspace.xyz — contracts, the DPA, and formal notices.