Terms of Service

1. Description of Services

Rawbbit is an open-source game analytics stack. It collects player events over HTTP, stores them as raw Parquet files in S3-compatible object storage, loads them into ClickHouse, and exposes them through Metabase dashboards, direct SQL, and an MCP server for AI agents.

Depending on your order, we provide one or more of the following:

• Self-hosting (free). You use the open-source software yourself. No contract with us is created, and these Terms do not apply to your use of the software.
• Done-for-you setup. We deploy and configure the stack in your infrastructure or in ours: ingestion, storage, ClickHouse, dashboards, and the MCP server.
• Managed hosting and maintenance. We run, monitor, update, and back up the stack for a recurring fee, in infrastructure operated by us in the European Union, or in yours.
• Data modeling and analytics support. Event taxonomy, data models, dashboards, and basic analytical help.
• Pilots. A pilot, if offered, is agreed individually with you in writing (an Order), and these Terms and the DPA apply to it.

The scope, fees, and timeline of each engagement are set out in a quote, order form, or written agreement with you (an "Order"). You send events from your game client or backend over HTTP, directly or with an available SDK (such as the JavaScript or Unity SDK).

2. Orders, Fees, and Payment

Fees are agreed in the Order. Unless the Order says otherwise:

• Prices are in euros (EUR) and exclude VAT and other taxes, which are added where applicable.
• The Services are provided on a prepayment basis. We invoice you, and payment is due before the relevant work or service period begins, by the date stated in the Order or invoice. We do not automatically debit your payment method. Late payments carry statutory default interest under the Finnish Interest Act, and we may suspend the Services until overdue amounts are paid.
• Setup fees are charged once and are not refundable after work has started. Recurring fees are invoiced in advance for each billing period and are not refunded for a period that has already started.
• The Services have no per-event, per-user, or per-seat fees. Your own infrastructure and third-party costs (cloud, AI agent subscriptions, tokens) are not included unless the Order says so.
• A change of scope needs a new or amended Order.

3. Your Responsibilities

You are responsible for:

• Integrating the agreed events into your game, and for the content and structure of the events you send.
• Having a lawful basis for collecting and processing your players' data, giving them any required privacy notices, and obtaining any consent that is needed (including for children, where the law sets special rules). You are the data controller for that data.
• Not sending direct identifiers or sensitive data that you do not need: for example email addresses, names, payment card numbers, health data, or other special categories of personal data. Use pseudonymous player identifiers.
• Keeping API keys, bearer tokens, and database credentials we give you secret, and telling us promptly if you think they have been exposed.
• Reviewing the results. Rawbbit removes infrastructure work, but you decide what to do with the numbers.

4. Your Data and Ownership

You own your data. The events you send and everything derived from them (together, "Your Data") remain yours. We process Your Data only to provide the Services and as described in the DPA in Annex I. We do not sell it, use it for advertising, use it to train AI models, or use it for our own purposes.

Portability and handover. Raw events are kept in an open format (Parquet). You can ask for a copy at any time. We make all of Your Data available for retrieval from storage, including raw Parquet files and an export of the analytics tables loaded into ClickHouse. We also provide the dashboards, data models, and configuration created for you under the Order in their applicable export or source formats. The rights in section 8 continue to apply to these deliverables. We may withhold the dashboards, data models, and configuration (but never Your Data) until you have paid all undisputed fees due under the Order. Handover does not include our credentials or other customers' information.

Retention and end of the Services. We retain Your Data throughout the term of the Order, unless you instruct us to delete it earlier. Whenever an Order ends, we provide the handover described above and make Your Data and deliverables available for you to retrieve. We keep it available for 30 days after the end date. After that we delete Your Data within a further 30 days, and it leaves our backups within 90 days after the end date. Details are in Annex I.

5. AI Agents and MCP Access

We give you access to your data through an MCP server. The MCP server is configured as read-only and is used to query your analytics tables. If you choose the optional container-log access, it is limited to viewing logs.

The AI agent is the one you already use (for example Claude, Codex, OpenCode, or OpenClaw). You choose and configure it, you hold the agreement with its provider, and you pay for it. We do not host the agent. When your authorised MCP client runs a query, our MCP server returns the results to that client. The tools and AI providers you connect may then process those results under your agreements with them. You are responsible for selecting, authorising, and configuring those tools and providers, and for ensuring that their processing and any onward transfers are permitted for Your Data.

Access to your code base is optional. If you grant an AI agent access to your code in connection with the Services, you must configure that access as read-only and limit it to the scope you choose. Our team does not access your code base through the Services. Answers given by an AI agent can be wrong or incomplete, so check anything important before you act on it.

Rawbbit Game Event Tracking

These Terms also apply to Rawbbit Game Event Tracking, our plugin for Claude and Codex. The plugin helps developers design game analytics event maps, integrate approved tracking, and review, maintain, or migrate existing instrumentation. Its available functionality depends on the host application, project access, and permissions.

For plugin-based development work, you may authorize your AI agent to inspect and modify relevant project files and run development checks. This is an exception to the read-only project-access requirement above, limited to the development work you authorize.

The plugin instructs the agent to obtain approval for proposed event maps and material implementation changes. Previous approval applies only to the specific scope that remains valid and does not replace host permissions or authorize unrelated SDK upgrades, deployment, or live event traffic. These instructions are not a technical access-control mechanism.

The optional SDK Catalog MCP service provides public SDK information, compatibility evidence, and Collector contract guidance. It is separate from any connection used to query your game analytics. The catalog does not provide customer analytics, ingest game events, or manage accounts and credentials. Do not submit secrets, personal data, or confidential project content in catalog requests.

Review generated event designs and code changes before use. Compatibility assessments are guidance, not proof that an integration works in your game. Validate the integration in your actual development environment and on the intended platforms before deployment.

Claude and Codex are third-party products governed by their providers' terms and policies. Bundled components and separately installed dependencies remain subject to their respective licenses.

The Privacy Policy describes Rawbbit's processing of plugin-related information. For support, contact team@rawbbit.one.

6. Acceptable Use

You agree not to:

• Use the Services for anything unlawful, or to collect data without a lawful basis
• Send data you are not allowed to process, or data that is not related to your games or apps
• Attempt to access data, systems, or credentials of other customers, or probe, scan, or test our infrastructure without our written permission
• Interfere with or overload the Services, including shared servers (for example by sending abusive traffic spikes outside the agreed limits)
• Resell or sublicense the managed Services to third parties without our written permission

We may suspend the Services, or delete or block abusive traffic, if you breach this section or if it is needed to protect other customers or the infrastructure. Where practical we will warn you first.

7. Service Availability and Support

We provide the Services with reasonable care and monitor the infrastructure we manage. We do not promise any particular uptime, response time, or recovery time unless an Order states a service level in writing.

You should know how the pipeline behaves: event delivery is at-least-once, so duplicate events are possible (the loading step removes duplicates per app and event ID), and events that arrive late are picked up on later runs. We take regular backups of the infrastructure and data we manage, but we do not guarantee that every backup can be restored. We may carry out maintenance and will try to announce planned downtime in advance.

8. Open Source Software, Deliverables, and Trademarks

Open source. The Rawbbit software is licensed under the Apache License 2.0. Your rights to use, modify, and distribute the software come from that license, not from these Terms. If these Terms conflict with the license about the software itself, the license applies.

Your deliverables. For dashboards, data models, and configuration we create for you under an Order, you receive a non-exclusive, perpetual right to use, copy, and adapt them for your own business. We keep the right to reuse general know-how, templates, and anything that is open source.

Trademarks. The name "Rawbbit", its logo, and the Site's design are ours. The Apache License does not give you any right to use them. You may use the name in a normal, truthful way to refer to the software or the Services. All other product, company, and service names mentioned on the Site or in these Terms (including Firebase, BigQuery, Amplitude, Metabase, ClickHouse, Claude, Codex, OpenCode, and OpenClaw) are the property of their respective owners. We are not affiliated with, endorsed by, or sponsored by them.

GeoIP data. Optional GeoIP features use IP geolocation data from DB-IP, under its license and attribution terms.

9. Confidentiality

Each of us will keep the other's non-public business and technical information confidential and use it only for the Services, except where the law requires disclosure. We will not publish your name, logo, results, or a case study about you without your written approval.

10. Disclaimers and Limitation of Liability

The Site and the Services are provided "as is" and "as available". To the extent the law allows, we disclaim all other warranties, including fitness for a particular purpose, uninterrupted or error-free operation, and the accuracy of any analytics or AI-generated results.

To the extent the law allows:

• We are not liable for indirect or consequential loss, loss of profit, revenue, goodwill, or business opportunity, or for loss of data that results from your own configuration, credentials, or instructions, or from third-party service failures.
• Our total liability to you for all claims arising out of or connected with the Services is limited to the fees you paid us for the Services in the 12 months before the event that gave rise to the claim.

Nothing in these Terms limits liability that cannot be limited by law, including liability for intent or gross negligence.

11. Term and Termination

Each Order sets its own term. Unless the Order says otherwise, managed services continue month to month and either of us may end them with 30 days' written notice (email is enough). Free pilots end as agreed in the Order.

Either of us may end an Order immediately by written notice if the other party materially breaches these Terms and does not fix the breach within 14 days of notice, or if the other party becomes insolvent. We may suspend or end the Services immediately if you breach section 6 or if the law requires it.

When an Order ends: fees for the period up to the end date remain payable, and section 4 and Annex I apply to your data. Sections that by their nature should survive (including 8, 9, 10, 14) continue to apply.

12. Data Processing Agreement (DPA)

When we process personal data on your behalf (for example your players' event data), our Data Processing Agreement (Annex I) is part of these Terms and applies automatically.

13. Changes to Terms

We may update these Terms. If the change affects paying customers in a material way, we will notify you at least 30 days before it takes effect. The "Last Updated" date shows the current version. If you keep using the Site or the Services after a change takes effect, you accept the new Terms. An Order we both signed or confirmed in writing is not changed by an update to these Terms unless you agree.

14. Governing Law and Disputes

These Terms are governed by the laws of Finland (and applicable European Union law), without regard to conflict-of-laws rules. Disputes will be handled by the courts of Finland.

15. General

• Order of precedence. If documents conflict: the Order first, then the DPA, then these Terms.
• Entire agreement. These Terms, the Annexes, and the Order are the whole agreement about the Services.
• Severability. If a provision is found unenforceable, the rest stays in effect.
• Notices. Email to team@rawbbit.one, or to the email address you gave us.

16. Contact

Mirlan Dzhumagulov (Rawbbit)

Email: team@rawbbit.one

Address: Oulu, Finland

Annex I: Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service and applies to Orders under which we process personal data on your behalf.

1. Scope and Roles

You (the "Customer") are the data controller (or a processor acting for your own client) of the personal data in the events your game or app sends. We act as the data processor. This DPA applies for as long as we process that data under an Order. Our processing of Site visitor, lead, and customer-contact data is covered by our Privacy Policy, where we are the controller.

2. Subject Matter, Nature, and Purpose of Processing

We process the data only to provide the Services under the Order: receiving events through the collector API, buffering them, storing them as raw Parquet files, loading them into ClickHouse, providing dashboards and read-only MCP and SQL access, monitoring and maintaining the infrastructure, and making backups. The duration is the term of the Order plus the return and deletion period in section 11. We retain the Customer's event data throughout the term of the Order unless the Customer instructs us to delete it earlier.

3. Types of Personal Data

The Customer decides what events to send. The standard event envelope can contain:

• User identifiers: user_id and user_pseudo_id (we recommend pseudonymous IDs), session_id
• Device and app data: platform, app version, OS version, device model, locale, timezone
• Event data: event name, timestamp, event parameters and user properties (as defined by the Customer), traffic source
• Location: country or other geo fields derived from the IP address, where GeoIP is enabled (it is disabled by default)
• Technical data added at ingestion: request ID, receive time, user agent, and a salted hash of the IP address
• Consent signals the Customer chooses to send (consent_json)

By default, the raw IP address is not stored. It is stored only if the Customer asks for it in the Order. Event parameters and user properties are free-form, so the Customer is responsible for their content (see section 5).

4. Categories of Data Subjects

Players and end users of the Customer's games and apps.

5. Customer's Obligations

The Customer is responsible for having a lawful basis for the processing, for providing privacy notices and obtaining consent where needed (including special rules for children), for the content of events and parameters, and for not sending special categories of personal data or direct identifiers (such as email addresses) unless this is agreed in writing in advance. The Customer's instructions to us are the Order, the Terms, and the Customer's written configuration requests. We will tell the Customer if we believe an instruction breaks data protection law.

6. Our Obligations

We will: process the data only on the Customer's documented instructions; make sure people authorised to process it are bound by confidentiality; apply the security measures in section 8; assist the Customer with data subject requests, impact assessments, and breach handling as described below; and not sell the data, use it for advertising, or use it to train AI models.

7. Subprocessors

The Customer gives general authorisation for the following subprocessors:

• Hetzner Online GmbH (Germany): infrastructure (virtual machines, storage, backups), EU data centres

We will give the Customer at least 30 days' notice of a new or replaced subprocessor by email. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, either of us may end the affected Order. Each subprocessor is bound by data protection terms no less protective than this DPA. We remain responsible for them.

If the Customer hosts the stack in its own infrastructure, its own cloud and hosting providers are the Customer's own processors, not ours.

Shared servers. Where several customers' projects run on the same servers, each customer's project is isolated from the others, and the credentials we issue to one customer give access only to that customer's own data.

8. Security Measures

We apply appropriate technical and organisational measures, including:

• HTTPS for public endpoints (collector, MCP, dashboards)
• Unique API keys per application for event collection, and bearer-token authentication for the MCP server
• MCP server configured as read-only
• Least-privilege database accounts
• Regular backups of the infrastructure we manage

9. Data Subject Rights

We will promptly send the Customer any request we receive from a data subject about the Customer's data, and will not answer it ourselves unless told to. At the Customer's written request we will help search, export, correct, or delete data about a specific user (for example by user_id). Raw Parquet files cannot be edited in place, so a deletion may mean rewriting the affected files and reloading ClickHouse. We will do this within a reasonable time, normally within 30 days.

10. Breach Notification

If we become aware of a personal data breach affecting the Customer's data, we will notify the Customer without undue delay and in any case within 48 hours. We will not wait for the investigation to finish: the first notice will include the information we then have (the nature of the breach, the data affected, and the steps taken or proposed), and we will send further details as they become available.

11. Return and Deletion

Whenever the Order ends, we make all of the Customer's data available for retrieval from storage, including raw Parquet files and an export of ClickHouse tables, and provide the related dashboards, data models, and configuration as described in section 4 of the Terms. We keep the handover available for 30 days after the end date so that the Customer can retrieve it. After that period we delete the data from our production systems within 30 days, and remove it from our backups within 90 days after the end date. We may keep data for longer only where the law requires. The Customer can ask in writing for deletion at an earlier date, or for a different handover arrangement. We will confirm the deletion by email on request.

12. International Transfers

We process and store the Customer's data in the European Union and do not transfer it outside the EEA. Data the Customer later sends to its own AI provider or other tools is outside this DPA, and the Customer is responsible for those transfers.

13. Audits and Information

On written request, we will give the Customer the information needed to show compliance with this DPA. The Customer may carry out an audit (at most once a year, with 30 days' written notice, during business hours, at its own cost, and without disrupting other customers or exposing their data), or may ask an independent auditor bound by confidentiality to do so.

14. Liability and Precedence

Liability under this DPA is subject to section 10 of the Terms. If this DPA conflicts with the Terms about personal data, this DPA prevails.

15. Contact for Data Protection

Mirlan Dzhumagulov

Email: team@rawbbit.one

Address: Oulu, Finland

Annex II: Security reporting

If you find a security vulnerability in the Rawbbit open-source software or in a service we operate, please report it to team@rawbbit.one with the steps to reproduce it and the affected component or version. We aim to acknowledge reports within 3 business days, review them, and keep you updated until they are resolved. We follow responsible disclosure: please give us reasonable time to fix an issue before you publish it, and do not access, change, or delete other people's data, or disrupt the services, while testing. We do not run a bug bounty and do not pay rewards at this time.