Privacy policy

1. Who is responsible for your data

The controller for the personal data described on this page is the business behind gtavifivem.com. Reach us through the routes at the bottom of this page for anything in this policy, including access, correction and deletion requests.

Tebex Limited is a separate controller for everything connected with your purchase. We do not control what Tebex collects and we cannot answer for it - see section 5.

2. Your email address - the two ways we get it, and what we send

There are exactly two ways your email address ends up in this site's database: you type it into the footer form, or Tebex hands it over after an order. Here is exactly what happens in each case.

The footer form. What is stored: your email address, the date you submitted it, and a salted hash of your IP address (see below). No name, no company, no country, and we do not add one behind your back. What we send: release notes and sale announcements about our own scripts - nothing else, and nothing on behalf of anyone else. Legal basis: your consent, given by submitting the form (GDPR Article 6(1)(a)).

Orders through Tebex. When you buy a script or download a free one, Tebex passes us the email address you used at checkout, your Tebex username and the list of products in that order, together with the amount and the date. We keep that to tell you about updates, fixes and offers for our own scripts - the ones you already have and the ones we release next. If you ticked or unticked the marketing box at the Tebex checkout, we keep that answer too and respect it. Legal basis: our legitimate interest in keeping existing customers informed about products they bought from us (GDPR Article 6(1)(f)), which is the existing-customer rule of Article 13(2) of the ePrivacy Directive. You can object at any time - the unsubscribe link in any email does it in one click, or write to us at the contact address at the bottom of this page - and we stop immediately.

Where it is stored: in this website's own database, on our hosting provider's server. It is not sent to Mailchimp, Sendgrid, Brevo or any other mailing service, because this site is not connected to one - the emails are sent by this site through our hosting provider's mail server. The list is visible only to a logged-in administrator of this site.

Your IP address is read when you submit the footer form. A hash of it keys a one-minute anti-spam limit so the form cannot be hammered, and the same salted hash is kept next to your address as a record of where the sign-up came from. The IP address itself is never stored, and Tebex orders carry no IP address at all.

The hidden field: the form contains a decoy "Website" field that real people never see. If it is filled in, the submission is discarded and nothing about it is stored.

Every email we send carries an unsubscribe link at the bottom and the one-click unsubscribe header that Gmail, Apple Mail and Outlook turn into their own Unsubscribe button. Either one works instantly, without logging in and without a confirmation step. We do not send a "please confirm" or double opt-in message, so the first email you get from us is a real one.

How long: until you unsubscribe or ask us to remove you. There is no automatic expiry. An unsubscribed address stays in the list marked as unsubscribed, so a later order cannot quietly put it back on - ask and we delete it entirely. An address behind a chargeback with Tebex is kept only as a do-not-email marker.

3. Cookies and browser storage

This site sets one cookie, and only after you answer the cookie notice.

• lrr_consent - records which categories you allowed, and a stamp of which category list you were asked about. Set only when you press Accept all, Reject all or Save my choice. Path /, SameSite Lax, Secure over HTTPS, and it expires after 182 days. If you never answer the notice, this site sets no cookie at all.

The same choice is mirrored into your browser's local storage under the same name, so it survives if the cookie is cleared. Alongside it, the following are kept in local storage - not cookies, never sent to our server, and containing no name, email, session ID or advertising ID:

• lrr_basket_ident, lrr_basket_sub_ident - the opaque identifiers of your Tebex basket, so it survives a page reload.
• lrr_basket_count - the number on the basket button.
• lrr_basket_pending - what you were about to buy, kept only across a sign-in redirect and cleared the moment you return.
• lrr_announce_seen - which announcement bar you dismissed, so it stays dismissed.

All of it disappears when you clear site data for this site in your browser.

Changing your mind. The Cookie settings link at the bottom of every page reopens the notice with your current choices. Withdrawing a category reloads the page immediately, because nothing can un-run a script that has already started - the page reboots with the narrower set instead of pretending.

What is strictly necessary and why. The consent record itself, and the basket. Those do not need consent under the ePrivacy rules, because without them the shop cannot do the thing you asked it to do.

4. Other companies your browser talks to

We would rather list these plainly than claim a purity this site does not have.

Tebex payment script (js.tebex.io). When: on every page, before you choose anything - the basket button sits in the header of every page, so the checkout script has to be there too. What they receive: your IP address, your browser user agent and the address of the page you are on. Nothing about a basket at this stage. This one is not consent-gated, and we are not going to bury that.

Tebex basket (headless.tebex.io). When: the moment you add something to the basket, and on later page loads if you still have one. What they receive: the basket contents, our public store identifier, the address of the page you were on, your IP and user agent. Your basket lives on Tebex's servers, not ours - our server never sees it.

For those two requests, which this site itself causes your browser to make, we are jointly responsible with Tebex for the fact that the data is sent. What Tebex then does with it is governed by Tebex's own notice and is theirs alone.

Tebex checkout. When: only when you press Checkout. What they receive: everything you type into it - your name, email address, billing country and address, tax ID where relevant, and your card or wallet details. None of it passes through this website's code or server.

YouTube (youtube-nocookie.com). When: only when you click a play button. The player does not exist on the page until you do; before that it is a still image. What they receive: your IP, user agent and which video you played.

YouTube thumbnails (i.ytimg.com). When: only if you allowed "Embedded content", and only where a product has no image of our own to use as the poster. What they receive: your IP and user agent. Reject it and a blank placeholder stays in place and Google is never contacted.

Discord. When: only if you allowed "Embedded content", to read the live member count shown on the home and support pages. What they receive: your IP and user agent. It is an unauthenticated read - no account data and nothing about you is sent. The Discord links in the header and footer are ordinary links and contact Discord only if you click them.

Our hosting provider. When: every request, as for any website. What they receive: standard web server logs - IP address, timestamp, URL requested and user agent - kept on our behalf for security and troubleshooting. We do not turn those into profiles and we do not use them for marketing. The provider is named in the identity card at the bottom of this page.

There is no Google Analytics, no Google Tag Manager, no Meta pixel, no Hotjar, no Matomo, no Plausible, no Clarity and no advertising or remarketing tag anywhere on this site. There is no fingerprinting, no session recording and no A/B testing.

If we ever add analytics, it will appear as its own switch in the cookie notice and it will not run until you turn it on. Today there is no such switch, because there is no such tag.

Fonts are self-hosted files served from this domain, so no request goes to Google Fonts.

5. What Tebex holds, and why we cannot see it

Tebex Limited is the merchant of record for every purchase here. That means Tebex - not us - collects and holds your name, billing address and country, the email address you buy with, your tax status, your payment details, your invoice and your order history.

Our server receives one slice of it: the email address, the Tebex username and the product list of each order, as described in section 2. We do not store card details, billing addresses, receipts, invoices, licence keys or download logs, because none of that reaches us. That is also why we cannot resend your receipt or your download link - Tebex has to do it.

The one thing that connects to us is the basket, which is created on Tebex's servers the moment you add an item, so Tebex knows what is in it before any payment happens.

Tebex's own notices govern all of that: Tebex privacy policy, Tebex cookie policy, Tebex terms.

6. What this site does not have

Stated explicitly, because "we do not do that" is more useful than silence:

• No customer accounts. There is no registration, no login, no password and no profile for buyers.
• No comments anywhere, so no commenter names, emails or Gravatar requests.
• No contact form, no live chat widget and no ticket system that stores anything. Support runs through Discord and email.
• No automated decision-making and no profiling. The only grouping we do is whether an address came from the footer form, a free download or a purchase, so that a buyer is not sent an invitation to try the free script.
• No raw IP address in this site's own database. The only IP handling anywhere is the salted hash from the footer form in section 2 and the server logs in section 4.
• We never sell, rent or share your data for advertising. The subscriber list can be exported only by a logged-in administrator of this site, as a backup file for us, and it is never handed to a third party.

7. Where data goes

The newsletter list stays in this site's own database at our hosting provider, and the emails we send go out through that provider's mail server - your address, the subject and the message pass through it the way any email does. We transfer the list nowhere else. We do not send your data to Tebex, to Google or to Discord: your browser contacts each of them directly, under the conditions set out in section 4, and each of them decides its own transfers under its own notice. In the other direction, Tebex sends us the order details described in section 2 from its own systems. Tebex Limited is established in the United Kingdom; Google and Discord are in the United States.

8. Your rights

If the GDPR applies to you, you have the right to ask us for a copy of the data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time without that affecting anything done before you withdrew it.

In practice, for this site, that comes down to two things and both are easy: your email address with the order details next to it on the newsletter list, and your cookie choice. For the first, the unsubscribe link in any email stops the emails at once, and for a copy, a correction or a full deletion write to us at the contact address at the bottom of this page. For the second, use Cookie settings at the bottom of any page. We answer within 30 days and normally within a couple of days.

We ask for nothing to verify a request beyond you writing from the address concerned. If you are unhappy with how we handled it you can complain to the data protection authority in the EU or EEA country where you live or work.

For data Tebex holds about your purchase, send the request to Tebex - we cannot action it, because we do not have the data.

9. Age

This site is not aimed at children. Tebex requires buyers to be at least 16. Do not submit the newsletter form if you are under 16. If you believe a child has given us an address, tell us and we will remove it.

10. Security

The whole site is served over HTTPS. The newsletter form is protected against cross-site submission and against automated abuse, every unsubscribe link is signed so nobody can unsubscribe you by guessing, and the endpoint that receives order notifications from Tebex checks a signature on every message before it stores anything. We hold no payment data and no passwords. What we do hold is a list of email addresses with order metadata next to them - product names, amounts and dates, never card numbers - and that is the worst case for a breach of this site, which is exactly why we keep it to that.

11. Changes

If what this site does with data changes, this page changes with it and the date at the top moves. If a new category of cookie appears, the cookie notice will ask you again automatically - an old answer never silently covers something you were not asked about.