Legal
Privacy Policy
Last updated 12 October 2026. Keydros is operated by Brick Software LLC.
1. Who we are and what this covers
This policy explains how Brick Software LLC, a New Mexico limited liability company, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA (“Keydros”, “we”, “us”) handles personal data in the Keydros dashboard and the public case pages at dashboard.keydros.com. The marketing site at keydros.com has its own, shorter privacy policy.
Three groups of people are covered: studio users (staff of the studios that use Keydros), Keydros staff (operators and admins), and server owners and other people named on a case, who usually reach us because a studio asked Keydros to contact them about its work.
Our role. For detection and case data (servers, owners, evidence, outcomes) Keydros decides how and why the data is used and is the controller; the studio whose work is concerned receives the case outcome and acts for its own purposes. For the sales records a studio sends us (Tebex webhooks and CSV imports), Keydros acts on the studio’s behalf as a processor / service provider under the studio’s service agreement.
2. What we collect and from where
| Who | Data | Source |
|---|---|---|
| Studio users and Keydros staff | Discord user ID, username, display name, avatar and email address (if shared by Discord or used for email sign-in); role and studio membership; invite code used; sign-in sessions; actions taken in the dashboard (for example which operator logged a contact) | You, via Discord or email sign-in; the studio’s invite |
| Server owners and other people named on a case | Cfx.re user ID and username; the server’s public listing (name, join code, description, Discord invite link, player counts, resources it runs); server IP address and the hosting provider it resolves to; links, usernames and screenshots that staff attach as evidence of contact; your answers on the case page, including any Tebex transaction ID, account name and transfer screenshot you submit | Public FiveM and Cfx.re listings, the 5metrics service, IP lookup via ipinfo.io, the Cfx.re forum, staff research, and you |
| Customers of a studio (buyers) | Tebex transaction ID, package, amount, date, status, and the buyer’s Cfx.re ID and username. Buyer email addresses from Tebex are not stored. | The studio, via Tebex webhook or CSV import |
| Everyone who opens a case page or staff view | A record that a page was viewed (case, type of view, time), the Cfx.re identity if you signed in, and a keyed one-way hash of your IP address. We keep the hash, not the address, so we can show who looked at personal data without storing the address itself. | Your browser |
| Billing contacts | Plan, subscription status, period dates, credit balance and ledger for the studio. Payment-card data is not collected by the dashboard. | The studio and our billing provider, when one is connected |
Server IP addresses and Cfx.re account names are information that FiveM servers and the Cfx.re forum make public or that is visible to anyone who joins the server. We collect it to identify who is running a studio’s work, not to build general profiles of people.
3. Why we use it and our legal basis
Where GDPR or UK GDPR applies, we rely on the following bases.
| Purpose | Basis |
|---|---|
| Detect unlicensed copies of a studio’s MLOs and maps; contact owners; verify licences, removals and transfers; close cases | Legitimate interests of the studio and Keydros in protecting intellectual property and licence revenue, balanced against the owner’s interests (see section 4); contract with the studio |
| Create and secure accounts; sign you in; keep a record of who viewed personal data | Contract (providing the service you asked for); legitimate interests in security and accountability |
| Match purchases to cases so licensed servers are not pursued | Contract with the studio; legitimate interests, including the owner’s interest in not being contacted about a licence they hold |
| Improve the case page, including testing whether sign-in affects how many owners respond | Legitimate interests in running a clear, effective process; no data is collected for the test beyond what is described here |
| Billing, tax, accounting and legal claims | Contract; legal obligation; legitimate interests in establishing and defending claims |
| Cfx.re sign-in on a case page | Your consent: you choose to sign in, and you can stop at any time |
We do not use this data for advertising, we do not sell it, and we do not use it to make credit, employment or insurance decisions.
4. If you received a Keydros notice
You are probably here because a studio says a copy of its work is running on a server you own or run. We obtained your Cfx.re username and the server details from public sources. The notice and case page show you what we hold: the server, the resources found and when, your Cfx.re profile, the IP address and the hosting provider.
- You do not have to sign in or answer. Answering is voluntary; ignoring a notice does not by itself have legal effect, but the studio may take other steps.
- If you answer, we store your answer and anything you submit (for example a transaction ID or screenshot) and check it against the studio’s sales and later scans.
- You can ask for a copy of your data, ask us to correct it, object to our use of it, or ask us to delete it by writing to hello@keydros.com with your case reference. We will balance your request against the studio’s legal claims and tell you the outcome.
- If the studio’s claim is wrong, for example because you bought a licence we have not matched, tell us and a person will review it.
Only the studio concerned, Keydros staff and you can see the personal details on your case. Another studio cannot see them.
5. Automated processing
- Prioritisation. An internal score estimates how likely an owner is to buy a licence, using signals such as player count, server age, how many of the studio’s products were found, and the owner’s past cases. It only decides the order in which a person works through the queue. A person decides whether to contact you; the score is not shown to studios or owners.
- Licence matching. When a matching purchase is found, the system can mark a case as licensed automatically. This only ever closes a case in the owner’s favour; refunds and chargebacks reopen it for a person to review.
- Scans. Scheduled scans confirm whether the resources are still running. A scan on its own does not decide any legal claim.
We do not make decisions producing legal or similarly significant effects about you solely by automated means.
7. International transfers
Brick Software LLC is based in the United States and the data is processed there and on servers operated by our hosting provider. If you are in the EEA, the UK or Switzerland, your data is transferred outside your region. Where the law requires a transfer mechanism we rely on Standard Contractual Clauses (and the UK addendum) or an equivalent safeguard with our providers.
8. How long we keep it
| Data | Kept for |
|---|---|
| Case records, evidence, owner answers and outcomes | While the studio’s account is active and for a limited period after it closes, then deleted or anonymised. Longer only where needed for a live legal claim or a legal obligation. Individuals can ask for earlier deletion (section 10). |
| Server player-count samples | 30 days |
| Sign-in sessions | Up to 30 days, or until you sign out |
| Email sign-in links | 15 minutes |
| Cfx.re sign-in on a case page | The pending request lasts 15 minutes; the signed-in state lasts 2 hours. The forum key is revoked as soon as your username and ID have been read. |
| View logs (hashed IP, case, time) | As long as needed to show who accessed personal data and to defend legal claims, and reviewed periodically. They are kept for accountability, so they are not deleted automatically. |
| Sales records and imports | For as long as the studio’s account is active, then deleted on request or on closure of the account, subject to legal and tax requirements |
| Billing and ledger records | As long as tax, accounting and contract-claim limitation periods require |
9. Security
Access to personal data is limited by role and recorded in the view log. Secrets stored in the database, such as webhook signing secrets, are encrypted; Tebex webhooks must carry a valid signature; browser cookies for sign-in are HTTP-only and marked secure in production; uploaded screenshots are served only to signed-in Keydros staff and every view is logged. No system is perfectly secure. If a breach affects you we will notify you and the authorities as the law requires.
10. Your rights and choices
Depending on where you live you may have the right to access, correct, delete, restrict or object to our use of your personal data, to receive a portable copy, and to withdraw consent. Residents of California and other US states with privacy laws can also know what we collect, delete or correct it, and opt out of sale or sharing (we do neither). We will not discriminate against you for exercising a right.
To use a right, email hello@keydros.com, including your case reference or the account concerned. We reply within 30 days and may need to confirm your identity first. You can also complain to your national data protection authority; we would like the chance to put things right first.
11. Children
The dashboard is for businesses and their staff and is not directed at anyone under 16. We do not knowingly collect their data. If you think we have, tell us and we will delete it.
12. Changes
We will update the date at the top of this page when the policy changes and, for material changes affecting existing accounts or open cases, tell the people concerned using the contact details we hold.
13. Contact
Privacy questions and requests: hello@keydros.com, or Brick Software LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA.