Privacy Policy

1. Who is responsible for your data

LULULABS is operated by Micah Brook, a sole trader in New South Wales, Australia, trading as LULULABS, and we are responsible for the personal information described here. We handle it under the Australian Privacy Act 1988 and the Australian Privacy Principles. If you are in the UK or the European Economic Area, we act as the data controller for it.

Questions, requests and complaints: team@lululabs.io.

2. What we collect

When you make an account: your email address, a display name, and a password (stored by our authentication provider as a hash — we never see it). We also record the age group you select, because it decides what is allowed on your account.

If you sign in with Roblox: your Roblox user ID and username. If you link Discord: your Discord user ID and the server roles we assign you. Both are optional.

When you build something: the prompt you write, any images or scripts you attach, the code and scene plans the model returns, and how it went afterwards — whether you kept it, edited it, rejected it, what rating you gave it, and any errors Studio reported.

From the Studio plugin, if you leave project context switched on: a compact snapshot of the structure of your open place — the names and types of the instances and scripts in it — so the model knows what it is working with. The full source of a script is only sent when you attach it, @-mention it, or it is one Lulu itself just wrote. You can turn this off in the plugin.

If you share something to Community Assets: the name, description and tags you give it, its picture and the files it is made of, and a link to your account so you can take it down. We also record which accounts liked, added or reported each shared thing, so each counts once. Sharing is your choice, one thing at a time; nothing you make is shared unless you press Share.

When you contact support or apply to the creator program: your reply email, name and message, plus the channel, sample links, platforms you post on, Roblox Studio experience, how often you can post, audience information and video idea you choose to provide. Creator applications go to our private support inbox for the operator to review. Paid creator videos are submitted and paid through Content Rewards under its own terms; we never ask for your bank or payment details. Submitting the form does not send an automatic email or pass the application to an AI model. If you contact us by email, our support system may use the listed AI providers to classify the inquiry and prepare a reply; partnership decisions and replies require the operator.

Technical and billing data: your credit ledger, your plan, a salted one-way hash of your IP address (used to match Studio connect requests to the right network and to rate-limit them — we do not keep the address itself), and the subscription and payment records Stripe gives us. Stripe holds your card details; we do not.

Product analytics: to understand how pricing visits lead to new accounts and successful builds, we store a random first-party browser identifier for up to 30 days. We record short campaign labels, a category and a recognised public referrer host (never its full URL), and which pricing presentation you saw. A pricing visit may be associated with your account when you create it afterwards in the same browser, or when you first sign in to that new account. Account creation and verification are measured separately. Browser analytics respect Do Not Track and Global Privacy Control, which also remove the local analytics identifier. These records do not contain email addresses, prompts, passwords or browser fingerprints; owner reports show aggregate counts.

Error reports and feature counts (when switched on): when something breaks, we send Sentry what failed and where in our code, without your IP address, email, account name or request bodies (at most an anonymous code for your account). We count which pages and features are used with PostHog under a random id that is forgotten when the tab closes, with no cookies and no IP address. For an account aged 13 to 17 feature counts stay off unless you switch on “Count which features I use” in Settings; an adult can switch them off there. We never count for accounts without a 13+ age answer, nor when your browser sends Do Not Track or Global Privacy Control.

Promo videos (Get players): a promo video you make is saved with its footage, voice lines, sound mix, captions and exports in private storage that only your account can read, so you can open it again. When you choose to make the video on Shotstack or Creatomate, that video's files are sent to them for that render only, through links that stop working after a few hours. When you ask for captions from your video's sound, its speech goes to Deepgram or ElevenLabs to be written down.

We do not run advertising, we do not sell personal information, and we do not use third-party tracking or advertising cookies. Browser storage includes your sign-in session, small preferences like your theme, and the optional first-party analytics identifier described above.

3. What we strip out before it leaves

Everything you send is scanned before it goes anywhere near an AI provider. If it looks like a credential — a Roblox cookie, an Open Cloud key, an API key for one of the AI providers, a Discord bot token — it is replaced with a placeholder, so the secret never reaches the model and is never stored.

The stored copy of your prompt also has common personal identifiers redacted. A prompt that triggered the secret scanner is permanently marked as ineligible for training, whatever your consent setting says.

This is a safety net, not a guarantee. Do not paste passwords, API keys or other people's personal details into a prompt.

4. Why we use it

• To run the service — answering your prompts, delivering code to Studio, keeping your project map and history.
• To bill you — tracking credits, taking payment, issuing invoices and handling refunds.
• To support you — answering your emails, diagnosing problems you report, and reviewing and replying to creator collaboration inquiries.
• To keep it working and safe — finding bugs, spotting abuse, enforcing the limits in our Terms, and keeping our costs under control.
• To improve the product — looking at aggregated, de-identified patterns such as how often builds fail, or which levels are used.
• To improve our models — only with your explicit consent, only on the Free plan, and only if you are 18 or over. See section 6.

For users in the UK or EEA: we rely on performing our contract with you for the first four, our legitimate interests in running a sustainable and safe service for the fifth, and your consent for the sixth. You can withdraw that consent at any time.

5. Who else sees it, and where they are

Your prompt and your project context are sent to an AI provider to be answered. That is how the product works, and it means your content leaves our systems. Which provider depends on the level you pick and which model is available at the time.

DeepSeek, whose infrastructure is in the People's Republic of China, writes the short plan Lulu shows before it builds a whole new game, from your prompt, and answers questions in our Discord server. Every build itself is answered by providers in the United States.

These are everyone we share your data with, what they do, and where they process it:

Things you share to Community Assets are shown to everyone, including visitors who are not signed in, once we have looked at them and said yes. Other creators can add them to their games for free and change them there, and a shared picture can be downloaded. Your name, username and avatar are never shown with them: they are labelled "Lulu Community". Who liked, added or reported something is never shown to anyone.

We ask AI providers not to train their own models on what we send, and we choose settings intended to prevent it, but their handling of it is ultimately governed by their own terms. We will also disclose information if the law requires it, or to protect someone's safety.

Because these providers are overseas, using LULULABS involves your information being sent outside Australia. By using it you agree to that transfer. For UK and EEA users, these transfers rely on the providers' standard contractual clauses or an adequacy decision.

6. Using your content to improve our models

We would like to make Lulu better at Roblox code by learning from real builds. We only do that when all of these are true:

• You are on the Free plan.
• You told us you are 18 or over.
• You switched training consent on — it is off unless you turn it on.
• The content did not trip the secret scanner.

On Starter, Pro and Studio we never use your content for training. Those plans run in privacy mode. Content from users aged 13 to 17 is never used for training, and the consent setting is not offered on their accounts at all.

You can withdraw consent at any time in Settings. That stops any future use immediately. It cannot pull your content back out of a model that has already been trained, which is why the consent is recorded with a version and a timestamp against each build.

Anything obtained through a Roblox API — user IDs, usernames from Roblox sign-in, Open Cloud responses — is never used to train models, in line with Roblox's Third-Party App Policy.

7. Children and young people

Roblox development is something a lot of teenagers do, so we expect young users and we design for them.

• Under 13: not allowed. We do not knowingly collect anything from a child under 13. If we learn we have, we delete it and close the account.
• 13 to 17: allowed, with training switched off permanently. No content from these accounts is ever used to train models, and the consent option does not appear.
• No advertising or profiling. We do not advertise to anyone, and we do not build profiles for marketing.
• We collect as little as we can. We do not ask for a date of birth, a phone number, a real name or a location.
• Sharing is looked at first, and never names you. Something you share to Community Assets only appears after we have checked it, never with your name, and you can take it down at any time. Creator shares receiving three reports are hidden until we review them.

If you are a parent or guardian and want to see, correct or delete your child's information, email team@lululabs.io and we will help.

8. How long we keep it

Code and delivery receipts stored locally in Roblox Studio remain under your control. Our server cleanup does not delete your Studio files.

When you close your account we delete or de-identify your personal information, except records we are legally required to keep. Backups roll off on their own cycle, so a deleted record can survive in a backup for a short period before it is overwritten.

9. Your rights

Whatever country you are in, you can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete your account and the data attached to it.
• Export your data in a portable format.
• Stop using it for training — that one you can do yourself, in Settings, immediately.
• Object to, or restrict, how we use it.

Email team@lululabs.io and we will respond within 30 days. We do not charge for this, and we will not make your experience worse for asking.

If you are unhappy with how we have handled your information, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. In the UK, the Information Commissioner's Office at ico.org.uk; in the EEA, your local supervisory authority.

10. How we protect it

Everything travels over encrypted connections. Our database enforces row-level security so one account cannot read another's data, and the tables that hold operational records are reachable only by our server, never from a browser. Secrets are scanned out of prompts before they leave. Access to production systems is limited to the operator.

No service is perfectly secure. If a data breach happens that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

11. Changes to this policy

If we change this policy in a way that matters — a new kind of data, a new provider, a new purpose — we will tell you by email or in the app before it takes effect, and update the date at the top. Minor clarifications will just appear here.