Privacy Policy
Last Updated:
This Privacy Policy explains how we collect, use, and protect personal data when you visit rawbbit.one (the "Site"), contact us, book a call, or buy services from us. It covers the Site and our commercial services: done-for-you setup and managed hosting and maintenance of the Rawbbit stack.
It does not cover the open-source Rawbbit software you run yourself. If you self-host Rawbbit, we do not receive your data (see section 9).
1. Who We Are
Rawbbit is operated by Mirlan Dzhumagulov, a sole trader based in Oulu, Finland ("we," "us," or "our"). For the personal data described in this policy, except as described in section 9, we are the data controller. We comply with the General Data Protection Regulation (GDPR) and applicable Finnish data protection law.
2. What Data We Collect
Site analytics
After you acknowledge the notice on the Site (see section 6), we use first-party analytics to measure page visits and improve the Site. The analytics run on our own Rawbbit pipeline. Each analytics event may include:
- Page path and page title
- Referrer, limited to the origin and path (we do not keep the query string)
- Campaign parameters from the URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the first landing page
- Clicks on calls to action, calls to action shown on screen (impressions), and outbound intent (for example, clicking through to Calendly or GitHub), including the button text and destination
- Browser language (locale) and timezone, and the platform ("web")
- A pseudonymous browser identifier and a session identifier (see section 6)
- Technical data added when the event reaches our server: a request ID, the receive time, the browser user agent, and a salted hash of your IP address
We use the IP address at request time only to derive an approximate country, using the locally hosted IP-to-country database from DB-IP ("IP Geolocation by DB-IP"). We do not store your raw IP address. We store only the salted hash and the derived location.
We do not intentionally collect your name, email address, or any content you type into forms through analytics.
Fonts from Google
The Site loads its fonts (Inter and Outfit) from Google Fonts. When a page opens, your browser requests the font files from servers operated by Google, so Google receives your IP address and basic browser information. This happens when the page loads, independently of the analytics notice. We do not receive this data and do not control how Google processes it. Google's own privacy policy applies.
Messages and applications
If you email us at team@rawbbit.one or ask for a quote or demo, we receive what you send us: typically your name, email address, studio or company name, game and platform, your role, and the content of your message.
Bookings through Calendly
The "Book a call" and "Book a demo" buttons lead to a scheduling page run by Calendly. If you book, Calendly collects your name, email address, the time slot, your timezone, and any notes you add, and shares them with us. Calendly's own privacy notice applies to its processing. We only see what Calendly shares with us for the booking.
Customers and business contacts
If you buy services from us, we process business contact data (name, email, role, company), contract and order details, invoicing and payment records, and our communications with you.
Rawbbit Game Event Tracking
This Privacy Policy also covers Rawbbit Game Event Tracking, our plugin for Claude and Codex. The plugin helps developers design game analytics event maps, integrate approved tracking, and review or migrate existing instrumentation. Available functionality depends on the host application, access to project files, and the permissions you grant.
Your AI agent may read project files, propose or make approved code changes, and run development checks. Your AI provider processes the content made available to it under its own terms, privacy policy, and your account settings. Installing the plugin does not by itself give the Rawbbit team access to your repository or full conversation.
When the optional Rawbbit SDK Catalog MCP service is used, it receives technical lookup inputs such as the game engine, version, target platform, browser capabilities, and SDK revision. It also processes technical request metadata to operate and protect the service. This includes your network (IP) address, which is used to limit abusive traffic and may appear in server or proxy access logs. The catalog is hosted in the European Union.
Rawbbit uses catalog inputs and technical logs only to answer requests, diagnose problems, and protect the service. We do not use them for advertising, profiling, or training AI models.
The catalog tools do not request game source code, player events, credentials, or full conversations. However, anything included in a tool argument is transmitted to the service. Do not include secrets, personal data, or confidential project content in catalog requests.
Catalog lookups are separate from game-event collection. Development workflows may also make network requests, such as downloading dependencies or running authorized integration checks. The plugin instructs the agent to use a mocked Collector for event-delivery tests by default and to obtain explicit authorization before sending live events. An SDK integrated into your game sends events according to the game's configuration and consent controls.
You can disable the MCP connection or remove the plugin through your AI application's controls. This does not automatically remove SDK code from your game or delete previously collected events. For privacy questions or requests, contact team@rawbbit.one.
3. Why We Collect It and Our Legal Bases
| Purpose | Data | Legal basis |
|---|---|---|
| Measure Site visits, understand which pages and calls to action work, improve the Site | Site analytics data, browser identifiers | Your consent (GDPR Art. 6(1)(a)), given when you acknowledge the notice, including for storing identifiers on your device |
| Reply to enquiries, quotes, and book calls | Messages, applications, booking details | Steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Provide, support, and invoice our services | Customer and business contact data | Performance of a contract (Art. 6(1)(b)) |
| Keep accounting records and meet tax and legal duties | Invoices and payment records | Legal obligation (Art. 6(1)(c)) |
| Operate and protect the SDK Catalog service, answer requests, and diagnose problems | Catalog lookup inputs and technical request data (including IP address) | Legitimate interest (Art. 6(1)(f)) |
| Protect the Site and our services against abuse and keep them stable | Technical data (hashed IP, user agent, request details) | Legitimate interest (Art. 6(1)(f)) |
| Show the Site with its fonts | IP address and browser data, which Google receives when it serves the fonts | Legitimate interest (Art. 6(1)(f)) |
Giving us your personal data is voluntary, but we cannot reply to an enquiry or provide our services without the data needed for that. We do not sell personal data. We do not use it for advertising, profiling, or automated decisions that have legal effects on you.
4. How Long We Keep Your Data
| Data | Retention |
|---|---|
| Site analytics events | As long as needed to analyse and improve the Site, then deleted or anonymised; earlier if you ask us to delete them |
| Pseudonymous browser identifier and other values on your device | Until you clear them in your browser (see section 6) |
| Enquiries and quotes that did not lead to a contract | Up to 24 months after our last contact, unless you ask us to delete them sooner |
| Customer contracts and communications | For the length of the contract and the limitation period afterwards |
| SDK Catalog request logs (lookup inputs and technical request data, which may include IP addresses) | 30 days, then deleted |
| Invoices and accounting records | As required by Finnish accounting and tax law |
Customer event data that we process on a customer's behalf follows the separate retention and deletion schedule in the Data Processing Agreement (see section 9).
5. Who Has Access
Only we have access to the personal data described in this policy, plus the service providers below:
- Hetzner Online GmbH (Germany), which hosts our infrastructure in the European Union
- Calendly, which runs the booking page and is an independent controller for the data you enter there (see section 2)
- Google, which serves the fonts used by the Site (see section 2)
Providers that process data for us are bound by confidentiality and data protection obligations. We disclose data to authorities only when the law requires it. We do not sell or share personal data for marketing purposes.
6. Browser Storage and Cookies
The Site does not set cookies. It uses your browser's local storage and session storage instead. Before you click "Got it" on the analytics notice, the Site does not store any analytics identifiers on your device and does not send analytics events. After you click "Got it", the following items are stored:
| Item | Where | Purpose | Duration |
|---|---|---|---|
rb_analytics_consent_acknowledged | Local storage | Remembers that you acknowledged the notice | Until you clear it |
rb_user_pseudo_id | Local storage | Random pseudonymous browser identifier, used to count returning visitors | Until you clear it |
rb_session_id, rb_session_last_seen | Session storage | Random identifier for one visit; a new one starts after 30 minutes of inactivity | Until the tab is closed or 30 minutes of inactivity |
rb_first_touch_attribution | Local storage and session storage | Remembers your first landing page, referrer, and campaign parameters to show which sources bring visitors | Until you clear it (local), until the tab is closed (session) |
You can email us at team@rawbbit.one and ask us to delete your analytics events. If you can tell us your browser identifier (the value of rb_user_pseudo_id), we can find and delete the events linked to it. We do not use advertising cookies and we do not track you across other websites.
7. Data Security
We use industry-standard practices: encrypted connections (HTTPS) for the Site and data collection endpoints, access control with unique credentials, least-privilege accounts, and hosting in EU infrastructure. No system is completely secure, but we work to protect your data and will tell you about breaches as the law requires.
8. Your Rights (GDPR)
You have the right to:
- Access your personal data and receive a copy
- Correct inaccurate data
- Have your data deleted
- Restrict or object to processing, including processing based on our legitimate interests
- Receive your data in a portable format
- Withdraw consent at any time, by clearing this site's data in your browser or by emailing us, without affecting processing done before withdrawal
To exercise these rights, email team@rawbbit.one. We usually reply within one month.
9. Data We Process on Behalf of Customers
When a game studio uses our managed services, we collect and store event data about that studio's players (for example sessions, levels, purchases, device model, app version, approximate country). For this data the studio is the data controller and we are the data processor. We handle it only on the studio's documented instructions and under the Data Processing Agreement in Annex I of our Terms of Service. We do not use it for our own purposes.
If you are a player of a game that uses Rawbbit and you have a question or request about your data, please contact the game studio first, because it decides how your data is used. You can also write to us and we will forward your request to the studio.
If you self-host the open-source Rawbbit software, the software sends nothing to us. We do not receive your data, your events, or your infrastructure details.
10. International Transfers
We operate customer and Site analytics infrastructure in the European Union. Some of our providers, such as Calendly and Google, may process data in the United States or other countries outside the EEA. Where this happens, the transfer relies on a safeguard permitted by GDPR, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, as described by the provider.
11. Children's Privacy
The Site and our services are for businesses and are not intended for anyone under 18. We do not knowingly collect data from children through the Site.
12. Changes to This Policy
We may update this policy from time to time. The "Last Updated" date above shows the current version. If a change is significant, we will say so on the Site, and we will ask for your consent again where the law requires it.
13. Contact
Mirlan Dzhumagulov (Rawbbit)
Email: team@rawbbit.one
Address: Oulu, Finland