01Who we are and what this covers
In short: We're responsible for creators' account data. Player data belongs to the creator, and we process it for them.
SantiAuth (“we”, “us”) runs santiauth.com, a key system, whitelist, script-protection and licensing platform for Roblox script creators. We handle data about two groups of people:
- Creators: we are the controller
- People who register a SantiAuth account and build services, keys, resellers, giveaways and Discord bots.
- Players: the creator is the controller
- People who get or redeem keys through a creator's key page, giveaway, Discord panel or loader. We process their data for the creator, and on our own only to stop fraud and abuse.
Cookies and browser storage are covered separately in the Cookies Policy.
02Data we collect
In short: Account basics for creators. For players, only technical identifiers: HWID, Roblox/Discord IDs and IP.
If you're a creator
- Account
- Email, name, plan and balance. Your password is stored only as a salted scrypt hash.
- Discord or Google sign-in
- Account ID, username, email and avatar. For Discord also your server list (the
guildsscope), so you can choose where the bot posts. We never read messages. - Security
- 2FA secret and backup codes, active sessions and an audit log of sensitive actions, each with IP and browser.
- What you build
- Services, keys, scripts, themes, checkpoints, webhooks, bot panels, giveaways, resellers and team invites.
- Credentials you add
- Ad-link provider tokens, your own Discord app and Turnstile keys, and AI API keys you bring (encrypted).
- Notifications and AI
- Where alerts go (Discord channel, webhook URL, Telegram chat) and your AI assistant conversations.
- Referrals and codes
- Your referral code, who signed up with it, and the redeem codes you activate.
- Messages to us
- Emails you send to legal@santiauth.com or support.
If you're a player
Depending on what the creator turned on, getting or using a key can involve:
- Hardware ID (HWID)
- Reported by your script executor and used to lock a key to one device.
- Roblox ID and username
- Sent by the loader when a key is bound to your Roblox account.
- Discord ID and username
- Only when a key or giveaway needs Discord sign-in. Scope
identifyonly: no email, no server list. - IP address
- For rate limits, bans, VPN/proxy/Tor checks and your country. Giveaways store only a hash of it.
- Usage events
- Checkpoint progress, completed ad-link provider, key checks, executor name, country and referring page.
- Ad-free subscriptions
- Records tied to your HWID, Roblox ID or Discord ID.
03How we use it
In short: To run the service, keep it secure, and give creators their analytics. Never for ads or profiling.
- Providing the service (performance of our contract with you): accounts, key generation and validation, HWID locking, loaders, giveaways, Discord bot, webhooks, analytics dashboards and the AI assistant.
- Security and abuse prevention (legitimate interests): rate limits, bot checks, detecting ad-link bypasses and key sharing, VPN/proxy detection, and bans.
- Service emails (contract): email verification, password reset, team invites, and alerts or scheduled reports you turn on. We don't send marketing email.
- Legal obligations: responding to lawful requests and keeping records the law requires.
We don't sell personal data, use it for advertising, or train AI models on it. To run the Service, data is processed by our providers for hosting and storage, email delivery, sign-in (Discord, Google), bot protection (Cloudflare), IP geolocation, AI features and script obfuscation, each only for that purpose. A creator's player data is visible to that creator and anyone they give access, and we disclose data to authorities only when the law requires it.
04How long we keep it
In short: Logs are deleted automatically after 30–90 days; everything else lives as long as your account or key.
| Data | Kept for |
|---|---|
| Account, services, keys and settings | While your account exists. Keys and their bound identifiers are removed when you or the creator deletes them. |
| Sign-in sessions (IP address, user agent) | Until you sign out, revoke the session, or it expires (7 days of inactivity) |
| Webhook delivery logs | 30 days |
| Raw analytics events, audit logs, bypass-detection logs | 90 days, then deleted automatically |
| Aggregated statistics (hourly/daily totals by country, executor, provider) | For the life of the service. These totals contain no IP addresses or HWIDs. |
| IP reputation lookups (VPN/proxy result) | Cached for about 1 hour |
| Bans and blacklists (IP, HWID, Discord ID) | Until the ban is lifted by the creator or by us |
| Emails you send to us | As long as needed to handle your request and any follow-up |
- Account, services, keys and settings
- Kept for
- While your account exists. Keys and their bound identifiers are removed when you or the creator deletes them.
- Sign-in sessions (IP address, user agent)
- Kept for
- Until you sign out, revoke the session, or it expires (7 days of inactivity)
- Webhook delivery logs
- Kept for
- 30 days
- Raw analytics events, audit logs, bypass-detection logs
- Kept for
- 90 days, then deleted automatically
- Aggregated statistics (hourly/daily totals by country, executor, provider)
- Kept for
- For the life of the service. These totals contain no IP addresses or HWIDs.
- IP reputation lookups (VPN/proxy result)
- Kept for
- Cached for about 1 hour
- Bans and blacklists (IP, HWID, Discord ID)
- Kept for
- Until the ban is lifted by the creator or by us
- Emails you send to us
- Kept for
- As long as needed to handle your request and any follow-up
When you ask us to delete your account, we delete your account, services, keys and content. We may keep what we're legally required to keep, and ban records needed to stop the same abuse from coming back.
05How we protect it
In short: Encrypted traffic, hashed passwords and keys, encrypted scripts, and 2FA for every account.
- All traffic is encrypted with HTTPS/TLS.
- Passwords are hashed with scrypt, and API keys are stored hashed, so we can't read them.
- Stored scripts and AI provider keys you bring are encrypted with AES-256.
- Sign-in cookies are HttpOnly and signed; two-factor authentication and session management are available to every account.
- Passwords, cookies and tokens are stripped from our logs. Sensitive endpoints are rate-limited.
No system is perfectly secure, but if a breach affects your data, we'll tell you without undue delay.
06Your rights
In short: Ask us for a copy, a correction, or deletion. We reply within 30 days.
Depending on where you live (for example under the GDPR, UK GDPR or CCPA), you can ask to access, correct, delete or export your data, restrict or object to processing, and withdraw consent. You can also complain to your local data protection authority.
- Creators: most data can be edited or deleted in the dashboard. For anything else, including account deletion, email legal@santiauth.com from your account's email address.
- Players: contact the creator of the script first, since they control your key and its data. If you can't reach them, email us with the service name and your key, HWID or Discord ID, and we'll help.
We'll answer within 30 days and may ask you to prove the data is yours before acting on it.
07International transfers
Some of our service providers process data outside your country, including in the United States. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by these providers.
08Children
You must be at least 13 years old (or the minimum age for digital consent where you live, if higher) to create a SantiAuth account. Key pages collect only the technical identifiers described above and never ask for a player's age, name or contact details. If you're a parent or guardian and want data about your child removed, email legal@santiauth.com.
09Changes and contact
We'll post any changes here and update the date at the top. If a change materially affects how we use your data, we'll also let creators know by email or in the dashboard before it takes effect. Questions go to legal@santiauth.com. See also our Terms of Service. Third-party policies: Discord, Google, Cloudflare.