Privacy Notice

01Who we are and who represents us in the EU and UK

TeamALA Ltd Liability Co. runs the TeamALA platform. It is the data controller for user accounts and sign-in records, platform security and hosting logs, early-access requests, abuse and rights reports, and the 90-day screening access log.

When an onboarded community uses TeamALA to vet applicants, manage roles, collect form responses, or work together on documents, spreadsheets and files, the community is the data controller and TeamALA is its data processor under the Community Agreement.

02If you were screened (a notice for people who are not users)

Communities use screening.teamala.org to check people who want to join their Roblox group or Discord server. Many of those people never made a TeamALA account, so this section is written for you (GDPR Article 14).

What is checked, in memory only

When a screening officer enters a Roblox username or ID and/or a Discord user ID, our server asks public interfaces and partner registries live, builds a temporary case file in memory, streams it once to the officer's browser, and discards it straight away. It can include:

• From Roblox: public profile and account age, previous usernames, groups and roles, up to 500 badges with award dates, whether the inventory is private, avatar and outfits (3D models come through our non-caching proxy), and experience bans in that community's own games.
• Your network on Roblox: up to 125 connections (friends) and whether each is banned or flagged. If an account has fewer than 10 connections, up to 200 second-degree connections are checked. Connection names stay hidden unless a connection has a finding and the officer clicks to reveal it.
• From Discord: public profile, account age, public badges, server tag, and your membership, nickname, roles, timeouts and bans in that community's Discord server.
• From partners: linked Roblox accounts from the account-linking services RoVer or Bloxlink (until our community bot replaces them), and child-safety and abuse records from our safety-data partner Okappiki (okappiki.com). Okappiki owns its records and handles appeals about them; we check them live and never keep a copy.

What we keep

Only an access log of the screening officer, the community, the time, and the target's platform and ID. It is deleted automatically after 90 days. Officers may copy "case notes" to their own clipboard for their moderation records outside TeamALA.

Why this is allowed

The lawful basis is legitimate interests (GDPR Article 6(1)(f)): communities have a real interest in protecting members and minors from abuse, exploitation, doxxing and ban evasion, and TeamALA has an interest in deterring officer misuse and answering "Was I screened?" requests.

How to ask or object

You can ask whether you were screened in the last 90 days, report misuse, or object to being screened at any time on the Report and Rights page, by emailing privacy@teamala.org, or through our EU and UK representatives at gdpr@euverify.com or their secure request portal.

03The data we hold, why, and for how long

By design TeamALA never collects: user passwords (once the older staff password sign-in is retired), birth dates, members' email addresses, real names, physical locations, payment data, Roblox tokens, or partner API keys that a partner forbids us to hold.

Backups. Our database keeps a 7-day point-in-time recovery window, so deleted rows drop out of encrypted backups within about 7 days.

04Cookies and local storage

We use no third-party tracking scripts, analytics cookies or advertising pixels. Fonts and shared interface parts are served from our own cdn.teamala.org. Everything below is first-party and strictly necessary for signing in, for security, or for a display choice you made.

Images from Roblox and Discord. Pages load avatars and badges straight from Roblox and Discord image servers, so those platforms can see the viewer's IP address. Screening's 3D avatar files go through TeamALA's own non-caching proxy instead. Custom short-link domains only redirect and set no cookies.

05Vendors, partners and international transfers

1. Service providers (sub-processors), each bound by a data processing agreement: Vercel (hosting, edge network, serverless functions, request logs); Upstash (the Redis store for sessions, short links and rate limits); Supabase (the platform PostgreSQL database); Cloudflare (DNS only, no traffic proxying, plus future R2 file storage and child-abuse image hash scanning); and link-reputation and safety scanners such as Google Safe Browsing and CSAM and malware hash scanning (PhotoDNA or Cloudflare's tool) for uploaded files.
2. Independent platforms and partners. Roblox, Discord, our safety-data partner Okappiki, and the account-linking services RoVer and Bloxlink are independent controllers whose interfaces we query when you sign in or an officer screens an account.
3. International transfers. TeamALA is established in the United States. When personal data of people in the EU, EEA or UK is sent outside their region, we rely on the EU-U.S. Data Privacy Framework (where our vendors are certified) and the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum.

06Children's privacy

1. Under 13 (COPPA). You must be 13 or older. At first sign-in we show a neutral year-and-month question with no pre-filled answer and store only the fact that you are 13 or over. If you answer under 13, no account is created and nothing is stored. If a screening lookup shows that the person being checked is under 13, the check stops immediately. A parent or guardian who believes we hold information about a child under 13 can email privacy@teamala.org for immediate deletion.
2. Strong privacy by default for under-18s. Modelled on the UK Age Appropriate Design Code (the Children's Code) and U.S. state minor-privacy laws such as Colorado's and Connecticut's, everyone under 18 gets: no public profiles, no behavioural profiling or recommendations, no direct messages between users, no location collection, no nudges to share more, and the most private settings by default.
3. California minors. Registered users under 18 in California can delete, or ask us to remove, content they posted on TeamALA (California Business and Professions Code §§ 22580 to 22582), from their account or the Report and Rights page.

07Your rights and how to use them

Wherever you live, we give the following rights to users and to people who were screened:

• Access, and "Was I screened?". Ask what we hold about you, or whether your account appears in the 90-day screening access log.
• Object. Object to communities screening your account through TeamALA.
• Delete and correct. Delete your account at teamala.org/account, or ask us to through the report page.
• Take your data with you. Export your user data at teamala.org/account; export files expire after 24 hours.
• No sale or sharing. We do not sell personal data or share it for cross-context behavioural advertising under the CCPA, CPRA or other state privacy laws.

To use a right, submit a request on the Report and Rights page, email privacy@teamala.org, or contact our representatives (Euverify Limited and Euverify Ltd) at gdpr@euverify.com or through their secure request portal. We answer within one month (30 days). If you live in the EU, EEA or UK you can also complain to your local data protection authority, such as the Irish Data Protection Commission or the UK Information Commissioner's Office.