Privacy Policy

1. Who we are

OTHERPLANET ("we", "us") is an independent creator of FiveM scripts. For questions about this policy or your data, contact us at [email protected]. All payments and order fulfilment are handled by our Merchant of Record, Tebex Limited, who act as an independent data controller for checkout, billing and refunds.

2. Data we collect

• Account & sign-in data. When you sign in we receive your Cfx.re (FiveM) identifier and your Discord profile (ID, username and email) through their OAuth flows. We use this to identify you, grant purchases and provide support.
• Purchase data. Tebex shares the order outcome (transaction id, products, amount and currency) so we can fulfil your order and display your purchases. Card details are handled entirely by Tebex - we never see or store them.
• Technical data. Your IP address, browser/device information and approximate (country/region) location. We use your IP for security, abuse prevention and rate limiting; for the one-per-visitor welcome offer we store only a hashed (non-reversible) form of your IP, never the raw address.
• Usage & advertising data.Pages viewed, products viewed, cart and checkout actions, and the ad click that referred you (e.g. Google click identifiers and UTM tags).
• Communications data. Your email address, used to send order/purchase confirmation emails and - only if you opt in - newsletters and product updates.

3. Cookies & similar technologies

We use a small number of cookies and local storage:

• Strictly necessary. op_session - a signed, HttpOnly session cookie that keeps you logged in and links your basket (expires after at most 24 hours, and sooner on inactivity). currency - remembers your display currency. These are required for the site to work and cannot be turned off.
• Analytics & advertising (consent-based). Google Analytics 4 and Google Ads cookies (e.g._ga) measure traffic, the conversion funnel and build remarketing audiences. op_ads_attr - a first-party cookie (max 90 days) storing the Google click id (gclid / gbraid / wbraid) and UTM tags from your own landing URL, so a completed purchase can be credited to the right campaign. These load only after you give consent.

4. Service providers & partners

We rely on the following third parties, who process data on our behalf or as independent controllers, each under their own privacy policy:

• Tebex. Processes payments as Merchant of Record under its own privacy policy.
• Google (Analytics & Ads). We use Google Analytics 4, Google Ads conversion tracking and remarketing. We operate Google Consent Mode v2: in the EEA/UK, analytics and ad cookies stay disabled until you give consent. We may use Enhanced Conversions, where a hashed (SHA-256) version of your email is sent to Google to improve conversion measurement - Google cannot read the original email from the hash. Privacy policy.
• Discord. Used for authentication and support. Privacy policy.
• Cfx.re (FiveM). Used to verify your FiveM identity at sign-in; governed by its own privacy policy.
• OVHcloud. Our hosting provider - the servers that run this website and database are operated on OVH infrastructure (EU). Privacy policy.
• Cloudflare. CDN, DNS and security / bot-protection layer in front of the site; may process limited technical data (e.g. IP) to keep the service available and block abuse. Privacy policy.
• Resend. Transactional email provider used to send order/purchase confirmation emails. Privacy policy.
• MailerLite. Email marketing provider used to send newsletters and updates, if you opt in. Privacy policy.

5. Legal bases (EEA/UK)

• Contract. Sign-in, basket and purchase fulfilment.
• Legitimate interests. Security, fraud/abuse prevention and keeping the service reliable.
• Consent. Analytics and advertising cookies. You can withdraw consent at any time (see below).

6. Data retention

• The op_session cookie and its server-side session expire after at most 24 hours (and sooner on inactivity).
• The op_ads_attr attribution cookie lasts at most 90 days and is cleared as soon as a purchase is credited.
• Hashed-IP records used for welcome-offer eligibility and rate limiting are short-lived and expire automatically.
• Google Analytics data is retained per Google's configured retention period (up to 14 months).
• Purchase records are retained by Tebex as required for tax and accounting.

7. International transfers

Our website and database are hosted in the EU (OVHcloud). Some providers - in particular Google and Cloudflare - may process data outside the EEA (e.g. the United States). Where that happens, the transfer relies on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses to ensure an adequate level of protection.

8. Your rights

Subject to your local law (including GDPR for EEA/UK residents), you may request access, correction, deletion, restriction or portability of your data, and you may object to processing based on legitimate interests. To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO - uodo.gov.pl), the Polish supervisory authority, or your local data protection authority.

9. Managing & opting out

• Use the cookie banner to grant or decline analytics and advertising cookies.
• You can clear cookies or use your browser's privacy controls at any time.
• Opt out of Google Analytics with the Google Analytics Opt-out add-on, and manage ad personalisation in your Google Ad Center.

10. Children

Our products and store are not directed at children under 16. We do not knowingly collect data from children.

11. Changes

We may update this policy as our service or legal obligations change. Material changes will be reflected by updating the date below.