Privacy policy

Who is responsible

ASSET LAB LLC operates PROP and is the data controller for the information described here. To contact us about privacy, or to make any of the requests below, use the contact page.

What we collect, why, and on what basis

Under the UK and EU GDPR every use of your information needs a lawful basis. Ours are set out here in full.

• Roblox account details — user id, username, display name, avatar picture. Received when you sign in with Roblox. Used to identify you and to deliver what you buy. Basis: performance of a contract.
• Email address — supplied by PayPal when you pay. Used to contact you about your order. We never ask you to type one in. Basis: performance of a contract.
• Order records— what you bought, when, the amount, and PayPal's transaction reference. Used to give you access to your purchases and to keep lawful accounting records. Basis: performance of a contract, and legal obligation for the accounting copy.
• Discord id — only if you have linked Roblox and Discord through Parcel. Used so support can find your purchases when you ask for help there. Basis: legitimate interests — helping you when you ask.
• Server logs and security data — IP address and request details, held briefly by our host and by Cloudflare. Used to keep the site up and to block abuse. Basis: legitimate interests — security and availability.

Giving us this information is necessary to buy from the shop. Without a Roblox account we cannot deliver a model, and without PayPal's confirmation we cannot take payment.

What we never receive

Card numbers, bank details and PayPal passwords never reach this site. Payment happens inside PayPal's own checkout; we are told only whether it succeeded, for how much, and which email to reach you at.

Your Roblox password never reaches us either. Signing in happens on Roblox's own site and we receive only the account details listed above.

We do not collect your name, postal address, date of birth, or any special category data as GDPR defines it.

Who else sees it

Only the services needed to run the shop, and only what each one needs. Each acts as a processor or an independent controller for its own part:

• PayPal — takes payment and returns your email address.
• Roblox — verifies who you are and receives the licence grant.
• Parcel — records which Roblox account owns which model.
• Cloudflare — serves the site and filters abusive traffic.
• Discord — only if you ask for help there, or opt into order messages.
• Oracle Cloud — hosts the servers this shop runs on.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we have never done either. It is not given to advertisers or data brokers.

Where it goes

ASSET LAB LLC is a United States company and this site is hosted in the United States. If you are in the UK, the EEA, or Switzerland, your information is transferred outside your country when you use the shop.

Those transfers rely on the UK and EU Standard Contractual Clauses, or on another approved safeguard, in the agreements we hold with the providers listed above. You can ask us for details of the safeguard that applies.

How long we keep it

• Order and payment records — seven years, which is what tax and accounting rules require of a US company.
• Your account and library — while your account exists.
• Discord messages — kept by Discord under its own retention, not ours.
• Server and security logs — typically 30 days.

When you ask us to delete your account we remove what we are not legally required to keep, and keep the accounting record until the period above has run.

Your rights in the UK and EEA

If the UK or EU GDPR applies to you, you have the right to access your information, to have it corrected, to have it erased, to restrict how we use it, to object to uses based on legitimate interests, and to receive it in a portable form. Where we rely on consent you may withdraw it at any time, without affecting what was done before.

We answer within one month. There is no charge unless a request is manifestly unfounded or excessive.

You can also complain to your data protection authority — in the UK the Information Commissioner's Office, and in the EEA your national supervisory authority. We would rather you came to us first.

Your rights in California and other US states

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to have it deleted, to have it corrected, and not to be discriminated against for exercising those rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not use or disclose sensitive personal information beyond what is needed to provide the shop, so the right to limit its use does not arise.

In the last twelve months we collected the categories described above — identifiers and commercial information — for the purposes described above, and disclosed them only to the service providers listed. Similar rights exist under the laws of Colorado, Connecticut, Virginia, Utah, Texas and other states, and we handle those requests the same way.

How to exercise a right

Contact us through the contact page from the account concerned, or tell us the Roblox account and order number so we can be confident the request is yours. An authorised agent may act for you where the law allows it, with proof of authority.

Deleting your account also ends access to any licences and downloads attached to it. That cannot be undone.

Cookies

This site uses two cookies and both are strictly necessary, so no consent banner is required and none is shown:

• Session cookie — keeps you signed in. Cleared when you sign out.
• Cart cookie — keeps your basket attached to you for 30 days.

There is no advertising cookie, no tracking pixel, and no third-party analytics on this site.

Asking for help in Discord

Help is given in public channels, not private tickets. Anything you post there — including an order number, a Roblox username, or a screenshot — can be seen by other members of the server, and is held by Discord under its own privacy policy rather than ours.

Never post payment details or passwords. We will never ask for them.

Automated decisions

We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you.

Children

Roblox has a young audience, so this matters here more than on most shops. PROP is not directed at children under 13 and we do not knowingly collect personal information from them. A purchase requires a PayPal account, which PayPal does not issue to under-18s.

If you are under 13, please do not buy from this shop. If you are a parent or guardian and believe a child has given us information, tell us and we will delete it and cancel the account.

Security

The site is served over HTTPS, payment card data never touches our servers, download links are signed and time-limited, and administrative access is restricted. No system is perfectly secure, but we do not hold the kind of data that makes a breach catastrophic, and that is on purpose.

Changes

If this policy changes, the date at the top changes with it. Material changes will be announced in our Discord before they take effect.