Privacy Policy

01The checkout belongs to Tebex

Every order placed here is sold through Tebex Limited, registered in England and Wales, acting as merchant of record. The payment, the invoice, billing support and refunds are theirs, and so is the personal data you enter while paying. For that data Tebex is the controller, and their privacy policy applies alongside this one. Card numbers and billing addresses never reach our servers.

What their notice says, in short, summarised here so you know what it covers before you decide whether to read it in full:

• The controller is Tebex Limited, company number 08129184, registered in London. Questions about checkout data go to their data privacy manager, named in their notice.
• The categories they name include identity and contact details, financial data such as bank account and payment card details, transaction records, and technical and usage data.
• They may share it with their own processors, their webstore partners and Amazon Web Services, and with a buyer if parts of their business change hands.
• Transfers outside the EEA rely on an adequacy decision or an equivalent safeguard.
• They keep it as long as the purpose requires, including what legal, accounting and reporting duties oblige them to keep.
• Complaints about their handling go to the Information Commissioner’s Office, the UK regulator.

The full text is theirs and lives on their site: Tebex privacy policy. We summarise rather than copy it deliberately: a copy on our page would go stale the day they change it, and you would have no way of telling.

Everything that happens on this website before and after that payment window is ours, and it is what the rest of this page describes.

02The short version

• Until you answer the cookie panel, analytics and advertising are switched off: no cookie of theirs is written and nothing is tied to you. Google’s tag does load in that refused state and sends a request stripped of advertising identifiers, which is described in full further down.
• Anything stored on your device without asking is there because the store cannot work otherwise: a basket, a sign in, a discount code.
• Payments never touch our servers. Checkout is owned and operated by Tebex Limited, who are the merchant of record and handle billing, fulfilment and refunds.
• We do not sell your personal information, we do not share it for advertising, and nothing here is used to build a profile of you.

03Who we are

PinkFrog is the trading name of FrogScripts Piotr Malawski, a sole trader registered in Poland under tax identification number (NIP) 8982274713, which operates pinkfrog.io and authors the FiveM resources sold through it. For the purposes of the GDPR and equivalent laws elsewhere, that is the controller of the data described on this page.

Write to [email protected], or open a ticket on our Discord server if that is where you already are. Either reaches us. Requests about your data are answered within one month, which is the deadline the GDPR sets.

04What is stored on your device

Privacy law in the EU, the UK and a growing number of other jurisdictions treats anything written to your device the same way, whether it is a cookie or browser storage. Consent is required unless the storage is strictly necessary for something you asked for. Everything in the table below is there to run the shop itself, which is why it is written without asking; the one entry where we think that line deserves stating out loud is named under the table. Anything outside that category (measurement and advertising) is in the section after it, and waits for your answer.

One of those deserves naming plainly: pf-visitor is the only entry that also serves us. It is what lets someone on support see that a basket has been sitting untouched and answer the question behind it. It holds a random number and nothing else, and a basket left empty is deleted rather than kept.

You can clear all of it at any time from your browser settings. The site keeps working; you will simply be signed out and your basket will be empty.

05Analytics and advertising

These only run if you say yes in the cookie panel, and you can change that answer at any time through Cookie settings at the bottom of any page. Saying no, or never answering at all, leaves them off; the store works the same either way and nothing about your experience gets worse for declining.

With advertising consent granted, Google may also set cookies on its own domains for remarketing, which is what allows our ads to be shown to people who have visited the store. What we ask Google for is aggregate: how many people arrived, which pages they read, which ads led to a sale. We do not receive a list of who you are.

The tag is loaded with Google Consent Mode v2 and every signal (ad_storage, ad_user_data, ad_personalization and analytics_storage) set to denied by default. Denied means Google is instructed not to write cookies, not to use advertising identifiers and not to build a profile; while it holds, advertising identifiers are stripped from any request. Only your yes lifts it.

If your browser sends a Global Privacy Control signal, we treat that as a standing refusal of advertising and keep it off regardless of what else is stored. In California that signal is a binding opt out of sale and sharing; we apply it to everyone.

On sale and sharing: we do not sell personal information for money, and never have. Using Google Ads for remarketing can count as “sharing” under California law, which is precisely what the advertising switch controls. Turn it off, or send GPC, and there is nothing to share.

06What we collect, and why

We do not collect special category data, we do not ask for it, and nothing on this site is designed to infer it.

Payment details never reach us. Card numbers, PayPal accounts and billing addresses are handled entirely inside the Tebex checkout. We receive the fact that an order completed and what it contained, not the means of payment.

07Who else sees it

• Tebex Limited: checkout, billing, fulfilment, refunds and the order records we read back.
• Discord: when you sign in, and for the server membership check behind the discount reward.
• Cfx.re: when you link an account so licences can be delivered.
• Cloudflare: sits in front of the site as proxy and protection, and therefore sees the requests reaching it.
• YouTube: only if you press play on a product video. Nothing is loaded from YouTube until you click. The still image behind the play button is served from Google’s image host.
• Google (Analytics and Ads): with your consent they receive measurement tied to a visitor; without it the tag still loads and sends a request stripped of advertising identifiers, which is the mode described above. Google Ireland Limited is our counterparty in the EEA; Google LLC in the United States processes on their behalf.

That is the whole list. We do not sell personal data and we have no relationship with data brokers.

08Where the data goes

PinkFrog operates from Poland and the site is hosted in the European Union. Some of the services above are based elsewhere, including the United Kingdom and the United States, so data reaching them leaves the EEA. Those transfers rely on the European Commission’s Standard Contractual Clauses or on an adequacy decision, which is the mechanism the GDPR provides for exactly this. Google LLC is certified under the EU-US Data Privacy Framework, which is the adequacy route for transfers to it.

09How long we keep it

• Sign-in sessions: until you sign out or the session expires.
• Basket data: until the basket is completed or abandoned, then cleared by Tebex on their schedule.
• Order records: for as long as we may need them for support and accounting. Tebex, as merchant of record, keeps the transaction records required by tax law.
• Technical logs: a short rolling window, kept only for security and diagnostics.
• Discord tickets: as long as the conversation is useful for support, subject to Discord’s own retention.

10Your rights, wherever you are

Different countries grant different rights. Rather than sorting people by passport, we apply the following to everyone who asks, regardless of where you live:

• Access: a copy of what we hold about you.
• Correction: fixing anything wrong.
• Deletion: removal of what we are not required to keep.
• Portability: your data in a machine-readable form.
• Objection and restriction: telling us to stop a particular use.
• Withdrawing consent: at any time, without affecting what was lawful before you withdrew it.
• No discrimination: exercising any of these never costs you worse service, a worse price or a lost discount.

Named laws, for the avoidance of doubt: the GDPR in the EEA and the UK GDPR; the CCPA as amended by the CPRA in California, including the right to know, delete, correct and to opt out of sale or sharing. We sell nothing. Advertising consent can amount to sharing under that law, and the advertising switch in the cookie panel is the opt out; a Global Privacy Control signal has the same effect without you having to click anything. Brazil’s LGPD; Canada’s PIPEDA; Australia’s Privacy Act and its Australian Privacy Principles; Switzerland’s FADP; and comparable state laws in Virginia, Colorado, Connecticut, Utah, Texas and the states that have followed them.

To use any of these, write to [email protected] or open a ticket on our Discord. We may ask you to prove you control the account in question, which is protection for you rather than an obstacle: it stops someone else asking for your data. There is no charge, and we answer within one month.

If you are in the EEA and think we have handled this badly, you may complain to your national supervisory authority. In Poland that is the President of the Personal Data Protection Office (UODO); in the UK, the Information Commissioner’s Office (ICO). We would rather you told us first, but the right is yours either way.

11Children

This store is not intended for children. In line with the Tebex terms that govern every purchase, you must be at least 16 years old to buy. If you believe a child has given us personal data, tell us and we will remove it.

12Security

The site is served over HTTPS end to end, behind Cloudflare. Sign-in cookies are HTTP-only and marked secure, so no script on the page can read them. Payment data is out of our reach by design, because it never arrives here in the first place. No system is perfect, and if a breach ever affects your rights we will tell you and the relevant authority within the deadlines the law sets.

13Changes

When this policy changes, the date at the top changes with it. Material changes will be announced on our Discord rather than slipped in quietly.