Synodic Support privacy policy

Synodic Studio ("Synodic", "we", "us") runs Synodic Support at support.synodicstudio.com (the "Portal") and is the data controller for the personal data described in this policy. That means we decide why and how your data is processed and we are responsible for it.

Synodic Studio is a trade name, not yet a registered company, so there is no company registration number to give. Until there is one, the controller is the studio's two founders, Nicklaz Lentz and Kian Nikolaj, acting as joint controllers. We have agreed in writing how we share responsibility under Article 26 GDPR. Nicklaz Lentz is the point of contact for questions and requests about personal data, but you may exercise your rights against either of us.

The studio is based in Aarhus, Denmark. You can reach us about anything in this policy at contact@synodicstudio.com. We have not appointed a data protection officer, because the scale and nature of our processing does not require one under Article 37 GDPR.

This policy covers the Portal: player support for Synodic Studio's games on Roblox, including player reports, appeals, bug reports, general support tickets and staff applications. It also gives the information that Article 14 GDPR requires for players who are reported to us by someone else.

Our anticheat, SynodicAC, has its own privacy policy at www.synodicstudio.com/privacy/anticheat, which explains the detections and moderation records an appeal may be about. Our website www.synodicstudio.com is covered by the studio privacy policy at www.synodicstudio.com/privacy. Roblox and Discord are independent companies, and their own privacy policies apply to everything you do on their platforms.

To use the Portal you log in with Roblox and then link your Discord account. Both steps happen on the platforms' own login pages, so we never see your Roblox or Discord password.

From Roblox

When you log in with Roblox (permissions "openid" and "profile"), we store your Roblox user ID, username, display name and the address of your avatar image.

From Discord

When you link Discord (permission "identify"), we store your Discord user ID, Discord username, the address of your avatar image and the IDs of the roles you hold in the Synodic Discord server, which our bot reads from the server itself. We use the role IDs to recognise staff and give them staff access.

Discord access tokens

Discord gives us temporary access tokens so that we can read the details above. We use them only while you link your account and do not store them.

We do not collect your email address, and the Portal has no file uploads.

The Portal sets two cookies, and both are needed for logging in.

synodic_session

Keeps you logged in. It holds a random token; we store only a hash of that token, not the token itself. It lasts 30 days or until you log out.

synodic_oauth

Protects the login process against forged requests while you are sent to Roblox or Discord and back. It lasts 10 minutes.

Both cookies are strictly necessary to provide the service you ask for, so under the rules on cookies (in Denmark, the Cookie Order implementing the ePrivacy Directive) they do not require consent. That is why there is no cookie banner. The Portal runs no analytics, tracking or advertising.

Profile pictures of players and staff are loaded directly from Roblox's and Discord's image servers. When your browser fetches them, Roblox or Discord can see your IP address, as with any request to their servers. Our fonts are hosted on our own server, so no font provider is contacted.

Every ticket is linked to your account. Depending on the type of ticket, it contains the following.

Player report

The game, the reported player's Roblox username, your description of what happened (up to 3,000 characters) and a link to evidence, for example a YouTube or Medal video. The evidence link is required.

Appeal

The game, the type of punishment, when it happened and why you think it should be reviewed.

Bug report

The game, a summary, the steps to reproduce the bug and, if you want, a link to evidence.

Support ticket

A subject and your message.

Replies

Messages from you and from staff in the ticket, up to 3,000 characters each.

Please do not include sensitive information, such as details about health, religion or sexuality, or other people's private information, in a ticket. We do not need it to help you.

If you apply for a position on the team, such as developer, tester, moderator or staff, we process your age, timezone, the hours per week you can offer and your motivation. Depending on the position, we also process your portfolio or GitHub link, experience, skills, the devices you use and your answers to scenario questions.

We ask for your age because some roles involve contact with other players, many of whom are minors, and because we need to judge whether a role is suitable for you. That protects both you and the players.

In the Portal, an application can be read only by the people who hire for that position. We may send you our decision, with a comment from the reviewer, as a direct message on Discord from our bot. You can apply again for a position 14 days after your previous application.

This section is for players who have been reported by someone else. We have no contact details for reported players, so this policy is how we give you the information Article 14 GDPR requires.

What we receive about you

Your Roblox username, the game, the reporting player's description of what happened and a link to evidence, such as a video.

Where it comes from

From the player who made the report. Evidence links point to material that the reporter has published elsewhere, for example on YouTube or Medal.

Why and on what basis

To investigate the report and keep our games safe and fair. Legal basis: our legitimate interest in protecting players and enforcing our game rules (Article 6(1)(f) GDPR).

Who sees it

Synodic staff, and the reporter, who can see their own report. Your username appears in the ticket title, which is also posted to our private staff channel on Discord.

How long we keep it

As long as the report is open, and then 12 months after it is closed, as described under "How long we keep your data".

You have the same rights as everyone else under this policy, including access, rectification, erasure, restriction and objection. Write to contact@synodicstudio.com with your Roblox username. We may need to confirm that the Roblox account is yours. To protect the person who reported you, we may limit what we show you, for example by not revealing who made the report, where giving you the information would adversely affect their rights (Article 15(4) GDPR).

• Your tickets can be seen by you and by Synodic staff. All staff can see open tickets; only the owners can also see closed ones. Other players never see your tickets.
• Staff applications can be read in the Portal only by the people who hire for that position.
• Short notifications about new tickets, replies and applications are posted to a private staff channel on Discord, as described in the next section.

So that staff notice new requests quickly, the Portal posts a message to a private staff channel in our Discord server for every new ticket, reply and application. The message contains the ticket number and title (for a player report, this includes the reported player's username), up to 1,000 characters of the text, and the author's display name and username.

These messages are deleted when the ticket or application they belong to is deleted. Decisions on staff applications may be sent to the applicant as a direct message from our Discord bot, as described above.

GDPR requires a legal basis for each purpose. Ours are these.

Running your account and logging you in

Legal basis: providing the service you ask for under our terms of use (Article 6(1)(b) GDPR).

Handling your support tickets and bug reports

Reading and answering your tickets and tracking bugs you report. Legal basis: Article 6(1)(b).

Player reports and moderation

Investigating reports, including the data about the reported player, and taking action under our game rules. Legal basis: our legitimate interest in keeping our games safe and fair (Article 6(1)(f)).

Appeals

Reviewing punishments and correcting mistakes. Legal basis: our legitimate interest in fair and accurate moderation (Article 6(1)(f)).

Staff applications

Assessing your application at your request. Legal basis: taking steps at your request before any agreement (Article 6(1)(b)). For your age: our legitimate interest in protecting minors and assessing whether a role is suitable for you (Article 6(1)(f)).

Staff access through Discord roles

Reading your roles in our Discord server to decide who gets staff access. Legal basis: our legitimate interest in giving access only to the right people (Article 6(1)(f)).

Security and preventing abuse

Server logs, ticket limits and cooldowns that keep the Portal working and protect it against spam and attacks. Legal basis: our legitimate interest in a secure, reliable service (Article 6(1)(f)).

Where we rely on legitimate interest, we have weighed it against your interests and rights. Staff notifications on Discord serve the same purpose, and rely on the same legal basis, as the ticket or application they concern.

• Hetzner Online GmbH (Germany), which rents us the server in the EU that runs the Portal. Your account, tickets and applications and the server logs are stored there.
• Discord Inc. (USA), which receives the staff notifications and the direct messages described above, and provides the account details and avatar images when you link Discord.
• Roblox Corporation (USA), which provides your account details and avatar image when you log in.

Roblox and Discord are independent controllers for data on their own platforms, and their own privacy policies apply. We do not sell personal data and do not share it with advertisers. We may disclose data where the law requires it, for example in response to a valid request from a public authority.

The Portal runs on a server in the EU. When we receive data from Roblox or Discord or send data to them, the data goes to the USA. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the safeguards the provider offers, such as the European Commission's standard contractual clauses.

Open tickets

Kept for as long as the ticket is open.

Closed tickets

Deleted, together with all their messages, 12 months after the ticket is closed. This includes player reports and the data about the reported player in them.

Staff applications

Deleted 6 months after the decision on the application.

Staff notifications on Discord

Deleted when the ticket or application they belong to is deleted.

Your account

Kept while you use the Portal. If you do not log in for 24 months, your account is deleted together with everything linked to it.

Sessions

A session lasts 30 days or until you log out. Expired sessions are removed.

Server logs

Your IP address, the time, the address requested and your browser's user agent, kept for no more than 30 days.

You can delete your account yourself from your dashboard at any time. That deletes your account and all your tickets and applications. If you use Roblox's "Right to Erasure" process, Roblox notifies us and the matching account is deleted automatically.

Under GDPR you have these rights over your personal data. You can exercise them by writing to contact@synodicstudio.com.

Access

Ask whether we hold data about you and receive a copy of it.

Rectification

Have inaccurate data corrected.

Erasure

Have your data deleted. You can also delete your account yourself from the dashboard.

Restriction

Ask us to stop using your data, while keeping it, in certain situations.

Portability

Receive the data you gave us in a structured, machine-readable format, where we process it on the basis of contract.

Objection

Object to processing based on legitimate interest. We will stop unless we have compelling grounds that override your interests.

We answer within one month. For complex or numerous requests we may extend this by two further months, and we will tell you if we do. We may need to confirm your identity before acting on a request.

The Portal applies a few fixed technical rules automatically:

• you can have at most 3 open tickets in each category;
• you must wait 60 seconds between new tickets;
• you must wait 14 days before applying again for a position;
• staff access follows the roles you hold in our Discord server.

These are not decisions with legal or similarly significant effects on you within the meaning of Article 22 GDPR. Decisions on reports, appeals and staff applications are made by people. Automated actions by our anticheat are described in the SynodicAC privacy policy at www.synodicstudio.com/privacy/anticheat.

Many Roblox players are young, so we have tried to write this policy clearly. You must be at least 13 to use the Portal, or older if the law in your country requires it, and you must follow Roblox's and Discord's rules. We do not knowingly collect data from children under 13.

If you are a parent or guardian and think your child has used the Portal, write to contact@synodicstudio.com and we will delete your child's data.

The Portal is served over HTTPS only and runs on a server in the EU. We store only a hash of your session token and do not store Discord access tokens. Staff access is limited by Discord roles to what each role needs, staff applications are visible only to the people who hire for the position, and secrets such as keys are restricted.

If a personal data breach occurs, we will notify Datatilsynet within 72 hours where the law requires it, and tell the people affected where the breach is likely to put them at high risk.

If you believe we have handled your data unlawfully, you can complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk, or to the authority in the EU country where you live. We would appreciate the chance to sort it out with you first, but you do not have to contact us before going to an authority.

We will update this policy when the Portal or the law changes. The date at the top shows when it was last revised. We will announce important changes on the site and in our Discord server.

Questions and requests about your data: contact@synodicstudio.com. Please put "Privacy" and "Synodic Support" in the subject line.