Privacy policy

1. Who is responsible for your data

The controller for the personal data described on this page is the business that runs gtavifivem.com and sells the scripts on it, identified in full at the bottom of this page. Write to us at the contact details there for anything in this policy, including access, correction and deletion requests.

Stripe, which processes our payments, is also responsible for some of what it does with payment data - see section 4.

2. Your account

What is stored: your email address, a username made from it, your display name, and your password. The password is stored only as a salted hash by WordPress, so nobody here can read it. Attached to the account are your orders (section 3), your download log - for each script, how many times you downloaded it and when you last did - any purchases from our old Tebex store that are linked to you (section 5), and any scripts our support has granted to you by hand.

How it is created: either you register, or - when you buy without being logged in and no account with that email address exists - we create one from the email address and name you enter on the Stripe checkout page and email you a link to set your password.

Why: to give you access to what you bought and to the updates for it (GDPR Article 6(1)(b), performing our contract with you). The download log is kept for support and to spot shared accounts and leaks, which is our legitimate interest (Article 6(1)(f)).

How long: until you ask us to close the account. You can change your name, email address and password yourself under Edit profile in your account.

3. Orders

What is stored for each order: the scripts and their prices, the currency and total, any tax and discount Stripe applied, the email address and name you gave at checkout, the account the order belongs to, Stripe's reference numbers for the checkout and the payment, the order status (paid, refunded, disputed and so on) with dates, and the exact consent statement you accepted before paying, with the time you accepted it.

Why: to perform the contract (Article 6(1)(b)), to keep the sales records that tax and accounting law requires (Article 6(1)(c)), and to deal with payment disputes and show that you asked for immediate delivery (Article 6(1)(f)).

How long: for as long as tax and accounting law requires us to keep sales records, which is several years. Closing your account does not delete these records, but they are no longer tied to a login.

Order emails: when a payment is confirmed, this site emails you an order confirmation and, for a new account, the link to set your password. They go out through our hosting provider's mail server. We also receive a short notice of each order ourselves, and a copy of order emails can be kept in our own mailbox for our records.

Checkout abuse limit: the checkout counts attempts per visitor for one hour, keyed by a salted hash of your IP address, so that nobody can flood it. The IP address itself is not stored.

4. Stripe, our payment provider

When you press Checkout, your browser goes to Stripe's checkout page at checkout.stripe.com. What you type there - your email address, name, card or wallet details and, where asked, your billing address and tax ID - goes to Stripe, not to this site. We send Stripe the scripts and prices in your basket, your order number and, if you are logged in, your email address so that you do not have to type it again.

Stripe sends back whether the payment succeeded, the amounts, the email address and name you entered, and its reference numbers for the checkout and the payment. If a payment is later refunded or disputed, Stripe tells us that too. We never receive your full card number.

Stripe processes this data for us as our payment provider, and also as an independent controller for its own purposes, such as preventing fraud and meeting financial regulation. Stripe's checkout page sets its own cookies on Stripe's domain. For customers in the EEA the Stripe company is Stripe Payments Europe, Limited in Ireland, and Stripe may transfer data to Stripe, Inc. in the United States under the safeguards described in Stripe's privacy policy.

5. Purchases from our old Tebex store

Before this shop had its own checkout, our scripts were sold through Tebex, and Tebex Limited was the seller for those purchases. So that they stay valid here, we import the payment records of our Tebex store: through Tebex's API with our store's secret key, from the payments export in the Tebex creator panel, and from the notifications Tebex sends us when a payment is completed, refunded or disputed.

What is stored for each Tebex payment: the Tebex transaction ID and payment ID, the email address and username used on Tebex, the player ID Tebex holds for that username, the packages bought, the amount, currency, date and status, and - once it is linked - which account here it belongs to and how it was linked: by matching email address, by you claiming the transaction ID, or by our support.

Why: to unlock the scripts you already paid for. A record is matched to your account automatically when you register or log in with the same email address, or when you enter its transaction ID in your account. When you claim a transaction ID we have not imported yet, we look it up at Tebex. The legal basis is our and your legitimate interest in honouring those purchases (Article 6(1)(f)).

We did not collect this data from you directly, so this section is also our notice under Article 14 GDPR. How long: for as long as we honour Tebex purchases through this site. You can ask us to delete your record at any time; after that it can no longer unlock anything.

6. Release notes and offers by email

There are three ways your email address can end up on our release-notes list:

The footer form. What is stored: your email address, the date you submitted it, and a salted hash of your IP address (see below). What we send: release notes and sale announcements about our own scripts - nothing else, and nothing on behalf of anyone else. Legal basis: your consent, given by submitting the form (Article 6(1)(a)).

Buying on this site. When an order is paid, we add the email address from the order with your display name, the names of the scripts, the amount and the date. The basket says so next to the checkout button, before you pay, and has a "Don't email me about updates and new scripts" box: if you tick it, your address is not added, and if it was already on the list it is marked as unsubscribed.

Buying on our old Tebex store. The Tebex payments we import add the email address with the Tebex username, the package names, the amount and the date. Where Tebex tells us your answer to the marketing box at its checkout, we store that answer, and if you declined, we do not send you release notes. An address behind a Tebex chargeback is kept only as a do-not-email marker.

Free downloads on our old Tebex store. A free download is not a sale, so the existing-customer rule below does not cover it. We add such an address only when Tebex tells us you ticked its marketing box, and the legal basis is then that consent (Article 6(1)(a)). You can withdraw it at any time in the same ways as unsubscribing.

For buyers, we use the address to tell you about updates, fixes and offers for our own scripts - the ones you already have and the ones we release next. Legal basis: our legitimate interest in keeping existing customers informed about similar products (Article 6(1)(f)), which is the existing-customer rule of Article 13(2) of the ePrivacy Directive. You are told about it and can say no when your address is collected - with the box in our basket, or with the marketing box at the Tebex checkout. You can object at any time - the unsubscribe link in any email does it in one click, or email lastresortfivem@gmail.com - and we stop immediately.

Where it is stored: in this website's own database, on our hosting provider's server. It is not sent to Mailchimp, Brevo or any other mailing service; the emails are sent by this site through our hosting provider's mail server. The list is visible only to a logged-in administrator of this site.

Your IP address is read when you submit the footer form. A hash of it keys a one-minute anti-spam limit, and the same salted hash is kept next to your address as a record of where the sign-up came from. The IP address itself is never stored.

The hidden field: the form contains a decoy "Website" field that real people never see. If it is filled in, the submission is discarded and nothing about it is stored.

Every email we send carries an unsubscribe link at the bottom and the one-click unsubscribe header that Gmail, Apple Mail and Outlook turn into their own Unsubscribe button. Either one works instantly, without logging in. We do not send a "please confirm" message first.

How long: until you unsubscribe or ask us to remove you. An unsubscribed address stays on the list marked as unsubscribed, so that a later order cannot quietly put it back on - ask and we delete it entirely.

7. Update emails for scripts you own

What we send: when a script you own gets a new version, one email with the version number, what changed and a link to your account. Nothing else goes out this way - no offers and no news.

What is used: the email address and display name of your account, the scripts you own - from your orders, your linked Tebex purchases and scripts our support granted to you - and your choices for these emails, which are stored with your account: on or off for all your scripts, and per script.

Why: keeping the scripts we sold you up to date is part of our contract with you, and so is telling you when an update is out (Article 6(1)(b) GDPR). That is why these emails start switched on for the scripts you own - unless you ticked "Don't email me release notes" in the basket, in which case they start switched off. For free scripts they are off until you switch them on.

Switching them off: with the Update emails switch next to each script in your account, with the switch for all your scripts at the top of the same list, or with the links at the bottom of every update email - one stops that script, the other stops all update emails - and the one-click unsubscribe header does the same for that script. None of it needs a password, and it never affects your downloads: new versions still appear in your account.

How long: your choices are kept with your account and deleted with it. For each release we keep only how many update emails went out, not a list of who got one.

8. The contact form

What is stored: what you type into the form on the support page - your name if you give it, your email address, the topic, an order number or Tebex transaction ID if you add one, the subject and the message - with the time you sent it, the account you were logged in with if you were, and a keyed hash of your IP address. The IP address itself is not stored.

What happens with it: the message is saved in this site's database, where only a logged-in administrator can read it, and emailed to our mailbox so that we can answer. You get a short confirmation with a reference number by email; it does not repeat your message. We reply by email, and that conversation is kept in our mailbox like any other email.

Why: to answer you and, where the message is about an order, to deal with it (Article 6(1)(b) GDPR), and our legitimate interest in answering people who write to us (Article 6(1)(f)).

Abuse protection: a hidden decoy field that real people never see, a signed time stamp in the form, and a limit of a few messages per hour per network and per day per email address. The limits are keyed by salted hashes and expire on their own.

How long: messages in the site's database are deleted automatically two years after they arrive. Ask and we delete yours sooner; an erasure request removes them as well.

9. Cookies and browser storage

This site sets cookies only in these cases:

• When you log in: the WordPress login cookies (wordpress_logged_in_… and wordpress_sec_…) keep you signed in to your account. They are removed when you log out and end with your browser session, or after 14 days if you tick "Remember me". The login page also sets wordpress_test_cookie to check that your browser accepts cookies.
• When you open your profile page: WordPress may set wp-settings-… cookies to remember display preferences on that page.
• When you answer the cookie notice: gvf_consent records which categories you allowed and which version of the category list you were asked about. Path /, SameSite Lax, Secure over HTTPS, and it expires after 182 days.

If you never log in and never answer the cookie notice, this site sets no cookies at all.

The following are kept in your browser's local storage. They are not cookies, so they are not sent along with every request, and they contain no name, email address or advertising ID:

• gvf_cart_v1 - the IDs of the scripts in your basket, so it survives a page reload. When you open the basket, those IDs are sent to this site to look up the current prices.
• gvf_cart_cleared_for - the reference of the last checkout that emptied your basket, so reloading its confirmation page does not empty a basket you filled since.
• gvf_announce_seen - which announcement bar you dismissed, so it stays dismissed.
• gvf_consent - a copy of your cookie choice, so it survives if the cookie is cleared.

All of it disappears when you clear site data for this site in your browser.

Changing your mind. The Cookie settings link at the bottom of every page reopens the notice with your current choices. Withdrawing a category reloads the page immediately, because nothing can un-run a script that has already started.

What is strictly necessary and why. The login cookies, the basket, the consent record and the dismissed announcement. They do not need consent under the ePrivacy rules, because without them the shop cannot do what you asked it to do.

10. Other companies your browser talks to

We would rather list these plainly than claim a purity this site does not have.

Stripe (checkout.stripe.com). When: only after you press Checkout in your basket. What they receive: everything you type into the checkout page, plus your IP address and browser details. See section 4.

YouTube (youtube-nocookie.com). When: only when you click a play button. The player does not exist on the page until you do; before that it is a still image. What they receive: your IP address, browser details and which video you played.

YouTube thumbnails (i.ytimg.com). When: only if you allowed "Embedded content", and only where a video has no image of our own to use as the poster. What they receive: your IP address and browser details. Reject it and a blank placeholder stays in place.

Discord. When: only if you allowed "Embedded content", to read the live member count shown on some pages. What they receive: your IP address and browser details. It is an unauthenticated read - nothing about you is sent. Links to Discord are ordinary links and contact Discord only if you click them.

Our hosting provider. When: every request, as for any website. What they receive: standard web server logs - IP address, time, the address requested and browser details - kept on our behalf for security and troubleshooting. We do not turn those into profiles or use them for marketing.

There is no Google Analytics, no Google Tag Manager, no Meta pixel, no Hotjar, no Matomo, no Plausible, no Clarity and no advertising or remarketing tag anywhere on this site. There is no fingerprinting, no session recording and no A/B testing.

Fonts are self-hosted files served from this domain, so no request goes to Google Fonts.

11. What this site does not do

• No comments anywhere, so no commenter names, emails or Gravatar requests.
• No live chat widget and no ticket system. The contact form in section 8 only emails us your message.
• No automated decision-making and no profiling. The only grouping we do is whether a newsletter address came from the footer form, a free download or a purchase.
• No raw IP addresses in the shop's records. The only IP handling is the hashes described in sections 3, 6 and 8 and the server logs in section 10.
• No card data, ever.
• We never sell, rent or share your data for advertising.

12. Where data goes

Your account with your update-email choices, orders, download log, imported Tebex records, contact form messages and the newsletter list stay in this site's own database at our hosting provider, and our emails go out through our email provider's mail server. Contact form messages are also delivered to our mailbox, and emails you send us or reply to are kept there. We send order data to Stripe as described in section 4, and a transaction ID you enter to claim a Tebex purchase to Tebex when we need to look it up. We send your data nowhere else. Your browser contacts Stripe, YouTube and Discord directly, under the conditions in section 10. Stripe is established in Ireland and the United States, Tebex Limited in the United Kingdom, and Google (YouTube) and Discord in the United States.

13. Your rights

If the GDPR applies to you, you have the right to ask for a copy of the data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time without affecting anything done before.

In practice: you can edit your name, email address and password yourself in your account; the unsubscribe link in any email stops release notes at once, and the switches next to your scripts turn update emails on and off; Cookie settings at the bottom of any page changes your cookie choice; and for a copy of your data, a correction, closing your account or a full deletion, email lastresortfivem@gmail.com. Order records that tax and accounting law makes us keep are kept for that period even after your account is closed. We answer within 30 days and normally within a couple of days.

We may ask you to write from the email address on your account so that we know the request is yours. If you are unhappy with how we handled it, you can complain to the data protection authority in the EU or EEA country where you live or work.

14. Age

This site is not aimed at children. Buyers must be 18 or buy with the permission of a parent or guardian. Do not submit the newsletter form if you are under 16. If you believe a child has given us their details, tell us and we will remove them.

15. Security

The whole site is served over HTTPS. Passwords are stored only as salted hashes. Script files are stored under random names in a private folder protected against direct access, and are handed out only to a logged-in account that owns them - or, for free scripts, to any logged-in account - through links that expire within a day. Payment notifications from Stripe and Tebex are accepted only with a valid signature. Our forms are protected against cross-site submission, and every unsubscribe link is signed so that nobody can unsubscribe you by guessing. We hold no card data. The worst case for a breach of this site is account, order and newsletter data as described above, which is why we keep it to that.

16. Changes

If what this site does with data changes, this page changes with it and the date at the top moves. If a new category of cookie appears, the cookie notice asks you again automatically - an old answer never silently covers something you were not asked about.