Privacy Policy

1. Who we are

OTHERPLANET ("we", "us") is an independent creator of FiveM scripts and the controller of your personal data for this website and related services (including our Missions Hub at missions.otherplanet.dev). Our registered details are:

• OTHERPLANET
• VAT ID: PL7272888925
• Address: Hoża 86, suite 410, 00-682 Warsaw, Poland
• Email: [email protected]

For questions about this policy or your data, contact us at the email above.

2. Checkout & payment data

Our checkout process is owned and operated by Tebex Limited, who act as the Merchant of Record for all purchases. When you buy a product, Tebex collects and processes your payment information, billing details and transaction data. We do not have access to your full payment card details.

Tebex Limited is a company registered in England and Wales (Company No. 08129184), with its registered office at 201 Haverstock Hill, Second Floor C/O Fkgb, London, England, NW3 4QG. VAT: GB167189962 & EU372035465. See the Tebex Impressum.

For how Tebex handles your data during checkout, see the Tebex Privacy Policy. Tebex acts as an independent data controller for checkout, billing, fulfilment and refunds.

3. Data we collect

• Account & sign-in data. When you sign in we receive your Cfx.re (FiveM) identifier and your Discord profile (ID, username and email) through their OAuth flows. We use this to identify you, grant purchases and provide support.
• Purchase data. Tebex shares the order outcome (transaction id, products, amount and currency) so we can fulfil your order and display your purchases. Card details are handled entirely by Tebex - we never see or store them.
• Technical data. Your IP address, browser/device information and approximate (country/region) location. We use your IP for security, abuse prevention and rate limiting; for the one-per-visitor welcome offer we store only a hashed (non-reversible) form of your IP, never the raw address.
• Usage & advertising data.Pages viewed, products viewed, cart and checkout actions, and the ad click that referred you (e.g. Google click identifiers and UTM tags).
• Communications data. Your email address (from your Discord profile when you sign in), used to identify your account and provide support. If - and only if - you tick the optional marketing box when signing in, we also store your email to send newsletters, product updates and offers via MailerLite. Order receipts and billing emails are sent by Tebex Limited as Merchant of Record, not by us. You can withdraw marketing consent at any time (see "Managing & opting out" below).
• Discord support & community. If you open a support ticket, write in our Discord server, or use support bots / channels, we (and authorised staff) process the content of those messages, your Discord ID and username, timestamps, attachments you send, and any notes staff add while helping you. We do not access your Discord password or private DMs outside channels you use to contact us. Please do not send passwords, payment-card details, identity documents, medical data or other highly sensitive information in tickets unless we expressly ask for something specific and it is strictly necessary to resolve your request.
• Public purchase ticker. After a successful purchase, limited purchase details may be shown publicly on our Website as a "recent buyer" notice (social proof): your Cfx.re nickname, your Cfx.re profile avatar (from forum.cfx.re), and the name(s) of the product(s) purchased. We do not display the price paid, your email, Discord ID, payment card data or full order receipt on that ticker. You may ask us to hide your nickname from the ticker - see "Managing & opting out" below.

4. Sources of data

We obtain personal data from:

• You directly - when you browse the site, sign in, opt in to marketing, open a support ticket or otherwise contact us.
• Discord and Cfx.re - profile and account identifiers returned by their OAuth / auth flows when you choose to sign in.
• Tebex Limited - order outcome and related fulfilment data after checkout (never full card numbers).
• Automatically - technical and usage data generated by your browser, our servers, Cloudflare and (with consent) Google Analytics / Ads.

5. Voluntariness

Providing personal data is voluntary. However, some data is required to use key features: without signing in with FiveM / Discord you cannot add products to the cart or check out, and without the information needed for a support request we may be unable to help. Optional marketing and analytics cookies / emails are never required to browse or purchase.

6. How we use and share your data

We use and share personal data only as needed to:

• Provide, secure and improve our Services
• Link your Discord / FiveM identity to purchases and deliver products you buy
• Respond to support requests (including Discord)
• Show limited recent-purchase social proof on the Website (Cfx.re nick, avatar and product names - never the price)
• Send marketing emails if you have opted in
• Analyse Website usage and measure advertising (when you allow optional cookies)
• Prevent fraud, abuse and automated misuse

In particular, we pass or receive data with these recipients:

• Tebex Limited. We pass your Discord / Cfx.re identifiers (and related account context needed for checkout) so Tebex can link purchases to your account, fulfil orders and assign delivery. Tebex may also share order outcome data back with us for fulfilment and support. Payment card data stays with Tebex / its payment processors.
• MailerLite. If you opt in to marketing at sign-in, your email (and basic subscription metadata) is sent to MailerLite to deliver newsletters and product updates.
• Google. With your consent for analytics / ads cookies, usage and conversion data may be processed by Google Analytics 4 and Google Ads. We may also send a hashed (SHA-256) email to Google for Enhanced Conversions - Google cannot recover the original email from the hash.
• Discord & Cfx.re. Used for authentication and community / ticket support under their own policies. Message content you send in our Discord support channels is visible to authorised OTHERPLANET staff. We do not access your Discord password or private messages outside those channels.
• Hosting & security providers (OVHcloud, Cloudflare) process technical data as needed to host and protect the site.

We do not sell your personal data. We only share it with the providers listed in this policy, and only for the purposes described here.

7. Cookies & similar technologies

We use a small number of cookies and local storage:

• Strictly necessary. op_session - a signed, HttpOnly session cookie that keeps you logged in and links your basket (expires after at most 24 hours, and sooner on inactivity). currency - remembers your display currency. These are required for the site to work and cannot be turned off.
• Analytics & advertising (consent-based). Google Analytics 4 and Google Ads cookies (e.g._ga) measure traffic, the conversion funnel and build remarketing audiences. op_ads_attr - a first-party cookie (max 90 days) storing the Google click id (gclid / gbraid / wbraid) and UTM tags from your own landing URL, so a completed purchase can be credited to the right campaign. These load only after you give consent.
• Cookie preference. Your Accept / Decline choice is stored in local storage so the banner does not keep asking. You can change it later via "Cookie settings" in the footer.

8. Service providers & partners

We rely on the following third parties, who process data on our behalf or as independent controllers, each under their own privacy policy:

• Tebex Limited. Checkout and payment processing as Merchant of Record, including order receipts and billing communications. Registered office: 201 Haverstock Hill, Second Floor C/O Fkgb, London, England, NW3 4QG. Privacy policy.
• Google (Analytics & Ads). We use Google Analytics 4, Google Ads conversion tracking and remarketing. We operate Google Consent Mode v2: in the EEA/UK, analytics and ad cookies stay disabled until you give consent. Privacy policy.
• Discord. Used for authentication and support. Privacy policy.
• Cfx.re (FiveM). Used to verify your FiveM identity at sign-in; governed by its own privacy policy.
• OVHcloud. Our hosting provider - the servers that run this website and database are operated on OVH infrastructure (EU). Privacy policy.
• Cloudflare. CDN, DNS and security / bot-protection layer in front of the site; may process limited technical data (e.g. IP) to keep the service available and block abuse. Privacy policy.
• MailerLite. Email marketing provider used to send newsletters and updates, if you opt in. Privacy policy.

9. Legal bases (EEA/UK)

• Contract. Sign-in, basket, purchase fulfilment and related support (including Discord tickets tied to a purchase).
• Legitimate interests. Security, fraud/abuse prevention, service reliability, Discord community moderation / support handling, the public recent-purchase ticker (limited social proof), and (where appropriate) limited product analytics that do not override your rights. You may object to processing based on legitimate interests (see "Your rights").
• Consent. Analytics and advertising cookies, and marketing emails (when you tick the optional box at sign-in). You can withdraw consent at any time (see below).
• Legal obligation. Where we or Tebex must retain records for tax, accounting or other legal requirements.

10. Data retention

• The op_session cookie and its server-side session expire after at most 24 hours (and sooner on inactivity).
• The op_ads_attr attribution cookie lasts at most 90 days and is cleared as soon as a purchase is credited.
• Hashed-IP records used for welcome-offer eligibility and rate limiting are short-lived and expire automatically.
• Marketing email data is retained until you unsubscribe or ask us to delete it.
• Support communications (email and Discord) are retained as long as needed to provide ongoing support, resolve disputes and protect against abuse.
• Recent-purchase ticker entries are short-lived display data derived from Tebex payment records (nickname, avatar URL source, product names) and are rotated as newer purchases arrive.
• Google Analytics data is retained per Google's configured retention period (up to 14 months).
• Purchase records are retained by Tebex as required for tax and accounting.

11. International transfers

Our website and database are hosted in the EU (OVHcloud). Some providers - in particular Google, Cloudflare and MailerLite - may process data outside the EEA (e.g. the United States). Where that happens, the transfer relies on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses to ensure an adequate level of protection.

12. Your rights

Subject to your local law (including GDPR for EEA/UK residents), you may request access, correction, deletion, restriction or portability of your data, and you may object to processing based on legitimate interests (including the public recent-purchase ticker). To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO - uodo.gov.pl), the Polish supervisory authority, or your local data protection authority.

13. Managing & opting out

• Marketing emails. Unsubscribe at any time via the link in the footer of any marketing email, or by emailing [email protected]. Withdrawing marketing consent doesn't affect order receipts or billing emails sent by Tebex Limited as Merchant of Record.
• Recent-purchase ticker. To ask us to stop showing your Cfx.re nickname (and related ticker entry) on the Website, email [email protected] with your Cfx.re nickname. We will hide it from the public ticker as soon as reasonably possible. This does not cancel or refund your purchase.
• Use the cookie banner (or footer "Cookie settings") to grant or decline analytics and advertising cookies.
• You can clear cookies or use your browser's privacy controls at any time.
• Opt out of Google Analytics with the Google Analytics Opt-out add-on, and manage ad personalisation in your Google Ad Center.

14. Children

Our products and store are not directed at children under 16. We do not knowingly collect data from children. If you believe we have collected such data in error, contact us and we will delete it promptly.

15. Data security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), signed session cookies, access controls and rate limiting. No method of transmission over the internet is 100% secure.

16. Changes

We may update this policy as our service or legal obligations change. Material changes will be reflected by updating the date below. Continued use of the Services after an update constitutes acceptance of the revised policy.