This English version is a translation provided for convenience. The French version, the Politique de confidentialité, is the reference text and prevails in case of any difference.
This policy explains which personal data the RH43 services process, why, for how long, and what your rights are. It applies to all RH43 services:
- the rh43.fr website;
- the RH43 account, used to sign in to the RH43 services (with Discord, with Roblox, or with a username and password);
- the J.A.R.V.I.S. administration panel (jarvis.rh43.fr) and the J.A.R.V.I.S. Discord bot, used by the Human Resources team.
RH43 is the Human Resources department of a roleplay community on Roblox, set in the fictional universe of the SCP Foundation (French-speaking branch). It is a volunteer-run community project with no commercial purpose.
1. Data controller
The RH43 services are published by Jacques Uzi, who is the data controller.
Contact for any question or request about your data: jacques.uzi@rh43.fr.
2. Data processed
The rh43.fr website
The website does not ask for any data. It does not set any cookie itself and uses no audience measurement or advertising tool. It only checks whether you are signed in to your RH43 account, to show the “Mon compte” (My account) button and your profile picture (see below). To show it immediately from one page to the next, your name, your initials and the address of your picture are kept in the browser tab (session storage), and erased when the tab is closed or when you sign out. The browser also remembers the last sign-in method used on the device (Discord, Roblox or username, nothing else), to point it out on the sign-in page; you can erase it by clearing the site’s data in your browser. Like any website, it technically receives your IP address in order to answer you; the site does not record it (only technical errors are logged).
RH43 account
An RH43 account is created with Discord or Roblox. It then has neither a username nor a password: you can choose them in “Mon compte” if you wish. Some accounts (for example those of the J.A.R.V.I.S. team) are created directly with a username by an administrator.
- Username, if you have one.
- Password, if you have one, only in irreversibly encrypted form (argon2id hashing): nobody, administrators included, can read it.
- Dates of account creation and last sign-in, and account status (active or disabled, temporary password to change).
- Two-factor authentication, if you turn it on: the key of your authenticator app, encrypted, and your recovery codes, only in hashed form. Deleted when you turn it off.
- Sign-in session: a random session identifier, kept for 7 days at most.
- Sign-in log: username (or Discord or Roblox name), IP address, date and application concerned, for each sign-in, failed sign-in, linking of a Discord or Roblox account, or administrative action on an account.
Signing in with Discord or Roblox
When you sign in or sign up with Discord or Roblox, or link one of these accounts from “Mon compte”, we keep your numeric identifier, your username and the address of your profile picture on that service, as well as the date of the link. The name and the picture are updated at each sign-in.
When you are signed in with Discord or Roblox, your profile picture is shown next to the “Mon compte” button. The image is loaded directly from the Discord or Roblox servers, which then receive your IP address, without any indication of the page you are viewing. Discord’s image servers may also set a technical anti-bot cookie (__cf_bm, 30 minutes) if your browser accepts cookies from other sites; it is Discord’s. When signed in with a username, only your initials are shown.
We receive neither your email address nor your password for Discord or Roblox (Discord: “identify” permission; Roblox: “openid” and “profile”). Other profile information possibly sent by Roblox (such as the display name) is not kept, and no access token to your Discord or Roblox account is stored.
You can unlink a Discord or Roblox account at any time from “Mon compte”, as long as you keep another way to sign in. This data is also processed by Discord and Roblox under their own privacy policies.
J.A.R.V.I.S. panel
Reserved for the Human Resources team.
- Administration account: linked RH43 account, role, assigned Discord servers and permissions per section.
- Sessions: IP address and browser used, dates of sign-in and last activity (so that you can see and close your sessions).
- Activity log: actions performed in the panel (sign-ins, changes to settings or accounts), with their author and, for sign-ins, the IP address.
J.A.R.V.I.S. Discord bot
On the community’s Discord servers where it is installed, the bot processes the data needed for its features:
- Tickets: Discord identifier of the person who opens the ticket and of the person who handles it, answers to the questions asked when it is opened, and a transcript of the messages exchanged in the ticket when it is closed. The transcript is posted in a Discord channel reserved for the team, and a copy is kept on the RH43 server.
- Time clock: Discord identifier and nickname, start and end times of duty, possible corrections.
- Custom names: display names chosen as part of the roleplay.
- Technical traces: context of the messages handled by the bot (kept for 1 year) and history of its feature runs (kept for 30 days).
3. Why this data is processed
| Purpose | Legal basis |
|---|---|
| Create and run your account, sign you in to the RH43 services | Performance of the service you use |
| Secure the services (limit sign-in attempts, detect abuse, keep a record of sensitive actions) | Legitimate interest: protecting accounts and services |
| Organize community life: recruitment, training, tickets, tracking of duty hours | Legitimate interest: managing the roleplay community’s staff |
Your data is never sold, nor used for advertising or profiling.
4. Who has access to the data
- Jacques Uzi, as publisher and technical administrator.
- Authorized members of the Human Resources team, only for the data their role requires (for example the tickets and time clock of the servers assigned to them).
- Technical providers, only to run the services:
- Cloudflare, Inc. carries the traffic between your browser and our servers (protection and HTTPS encryption) and routes emails sent to rh43.fr. Cloudflare may process data in the United States; this transfer is covered by the EU–US Data Privacy Framework, which Cloudflare has joined;
- Discord and Roblox, when you choose to sign in with them, and Discord for running the bot on its servers.
The RH43 services are hosted on a server located in France.
5. Retention periods
| Data | Period |
|---|---|
| RH43 account | As long as the account exists; deleted on request |
| Linked Discord or Roblox account | As long as it is linked; deleted as soon as unlinked |
| Database backups | 14 days |
| Sign-in session | 7 days at most |
| Technical sign-in logs | Deleted by automatic rotation |
| J.A.R.V.I.S. panel sessions | 7 days at most |
| Bot technical traces | 30 days (runs) and 1 year (message context) |
| Tickets | Archived 4 days after closing, then deleted |
| Ticket transcripts | No time limit (team history) |
| Time clock (duty hours) | No time limit (staff history) |
| J.A.R.V.I.S. panel activity log | No time limit (traceability of actions) |
| Custom names | As long as they are used |
Data kept without a time limit can be deleted on request, under the conditions set out in section 9, unless keeping it remains necessary (for example for the security of the services or the follow-up of a report).
6. Cookies
The RH43 services only use cookies that are strictly necessary for signing in, which do not require your consent:
| Cookie | Site | Purpose | Duration |
|---|---|---|---|
_session | rh43.fr | Keep you signed in to RH43 | 7 days |
_interaction, _interaction_resume | rh43.fr | Follow a sign-in in progress | 1 hour |
rh43_ext | rh43.fr | Secure the return from Discord or Roblox | 10 minutes |
rh43_site | rh43.fr | Secure a sign-in started from the site | 10 minutes |
jarvis_session | jarvis.rh43.fr | Keep you signed in to the panel | 7 days |
jarvis_oidc | jarvis.rh43.fr | Secure the return after signing in | 10 minutes |
The _session, _interaction and _interaction_resume cookies come with a signature cookie of the same name followed by .sig, with the same duration, which prevents tampering.
No audience measurement, advertising or social network cookie is used.
7. Security
Traffic is encrypted (HTTPS). Passwords are stored in hashed form (argon2id). Sign-in attempts are limited: after several failures, the IP address they come from is temporarily blocked for that username. Two-factor authentication can be turned on in “Mon compte”. Each service runs under a separate system user, with restricted access to the data.
When you choose a password, it is checked against passwords exposed in known data breaches, using the Have I Been Pwned service: only the first 5 characters of its fingerprint (SHA-1 hash) are sent, never the password itself, and the comparison is done on our servers. A password found there is refused.
8. Minimum age
The RH43 services are reserved for people aged at least 13. Between 13 and 15, using an RH43 account requires the consent of a parent or holder of parental authority, in accordance with French law.
9. Your rights
Under the General Data Protection Regulation (GDPR) and the French “Informatique et Libertés” law, you have the following rights over your data:
- access: know which data concerns you and get a copy of it;
- rectification: have inaccurate data corrected;
- erasure: have your data deleted, including your account (you can also unlink your Discord and Roblox accounts yourself in “Mon compte”);
- objection to and restriction of processing;
- portability of your data;
- set instructions for what happens to your data after your death.
To exercise them, write to jacques.uzi@rh43.fr, stating your RH43 username or Discord name. You will receive an answer within one month. Proof of identity may be requested in case of reasonable doubt.
If, after contacting us, you believe your rights are not respected, you can file a complaint with the CNIL, the French data protection authority (www.cnil.fr).
10. Changes
This policy may change. The date of the last update is shown at the top of the page. In case of a significant change, users will be informed on the website or on the community’s Discord servers.