Privacy Policy

This policy explains what data is collected when you visit this store and what happens to it. The controller is the provider named in the legal notice.

Visiting the site

When you open a page, your browser transmits technically necessary information: IP address, time, requested address, referring page and browser identification. This goes into the server and error logs and serves operation and abuse prevention. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure operation. Logs are deleted after 14 days at the latest.

Delivery runs through Cloudflare as a content network, which means your IP address is transmitted to Cloudflare.

Cart

Your cart is stored in your browser's local storage so it survives navigation. This is not a cookie and is not transmitted to us as long as you are not signed in. You can clear it at any time in your browser settings.

Wall of Fame

On the Wall of Fame page we publish the Cfx username of everyone who has obtained a script from us. That name is the only thing published. We do not publish which product was obtained, when, for how much, the order number, or the email address. The list is sorted alphabetically so that the order allows no conclusions about purchase time or amount.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in showing verifiable evidence of how widely our scripts are used, rather than stating a figure nobody can check. Since the Cfx name is a self-chosen pseudonym under which the person appears publicly anyway, we consider the interference to be minor.

You may object to this publication at any time, without giving reasons, informally via help.agencyg.de or by email to [email protected]. We will then remove your name from the Wall of Fame and add it to a suppression list so that it does not reappear when the page is updated.

Signing in with Discord

You can browse without signing in. For a purchase, signing in with Discord is required so the purchase can be assigned to your account. If you sign in, Discord gives us your Discord ID, display name, avatar and email address. We store this along with your cart, your loyalty points and your order numbers. The legal basis is Art. 6(1)(b) GDPR, as this processing is required to operate the user account.

By signing in you also allow Discord to add you to our Discord server. This happens once, at sign-in. You can leave the server at any time; your account in this store is unaffected.

Signing in sets a technically necessary session cookie. It contains your Discord ID, name and avatar, is signed, and expires after 30 days. It is deleted when you sign out.

Purchase and payment

The purchase contract is concluded with Tebex Limited. When you go to checkout, the selected items are transmitted to Tebex, where you also enter your payment and billing details. We neither see nor store payment data.

So the purchased resources can be unlocked, you link your Cfx.re account once at Tebex. This linking takes place at Tebex.

After a purchase, Tebex sends us a confirmation with order number, amount, currency, purchased items and, where available, email address and username. We store this to process the order and because of statutory retention obligations.

If you use the code of a participant in our affiliate programme, we pass the order number, the code, the amount paid without tax and your Discord ID internally to our partner programme on partner.agencyg.de so that the participant's commission can be calculated (Art. 6(1)(f) GDPR). Your Discord ID is only used to recognise purchases made with a participant's own code and is not stored there. The participant only sees the number, amounts and dates of purchases, nothing about you.

The privacy policy of Tebex Limited applies in addition.

Emails, newsletter and reminders

We use Brevo as a processor for sending all of our emails (Brevo SAS, France, and Sendinblue GmbH, Germany; processing within the EU). Brevo processes the data only on our instructions.

We send the newsletter only if you signed up for it and confirmed the sign-up via the confirmation link in the first email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR).

After you obtain a free script we send a short welcome series with pointers to our scripts, but only if you consented to promotional emails at that point. The legal basis is again your consent (Art. 6(1)(a) GDPR).

We send cart reminders and similar emails to existing customers only if you consented to promotional emails or if we received your email address in connection with a purchase and may advertise our own similar products to you (§ 7(3) of the German Act against Unfair Competition, UWG). The legal basis in that case is Art. 6(1)(f) GDPR, our legitimate interest in direct marketing to existing customers.

To pick suitable content we store purchase attributes, such as which scripts you obtained. Every such email contains an unsubscribe link. You can object to the promotional use of your email address at any time and withdraw any consent at any time, via the unsubscribe link, via help.agencyg.de or by email to [email protected]. After you unsubscribe we delete your address from the mailing list.

No analytics or advertising scripts in your browser

This store embeds no analytics or advertising scripts in your browser and no cross-site tracking. There is therefore no consent banner for non-essential cookies, because there are none. Fonts are served from our own server and not loaded from third parties. The server-side reporting of completed purchases and the attribution to Google ads are described in the next sections.

Measuring completed purchases

After a purchase we report the completed order server-side to Google Analytics 4, a service of Google LLC, USA. We transmit your email address in hashed form as an identifier, the order number, the amount and the list of purchased items. Your IP address is not transmitted. The report is sent from our server; no script runs in your browser for this.

The purpose is measuring the success of our advertising in Google Ads. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in knowing which advertising leads to purchases. You can object to this processing at any time via help.agencyg.de or by email to [email protected].

Google LLC is certified under the EU-US Data Privacy Framework. The transfer to the USA is based on the adequacy decision of the European Commission (Art. 45 GDPR).

Attributing purchases to Google ads

If you reach us through a Google Ads advertisement, Google appends a click identifier to the address (the gclid parameter). We do not store this identifier in your browser, neither as a cookie nor in local storage. It is only carried along in the address during your visit and is stored on our server only when you sign in or start an order, attached to your account and your order.

If a purchase or a free download follows within 90 days of the click, we report the click identifier, the time, the amount and the currency to Google Ads so that the ad is counted as successful. No further details about you, such as your name or email address, are sent to Google in this process. Unused identifiers are deleted no later than 90 days after the click, reported ones no later than 90 days after the purchase.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in knowing which ads lead to purchases. You can object to this processing at any time via help.agencyg.de or by email to [email protected].

AgencyAI advice chat

For the AgencyAI advice chat, our server transmits your chat input to a specialized AI provider based in the USA to generate a reply. No account data is sent along; the provider only receives the chat history. Please do not enter sensitive data in the chat. We will name the provider upon request. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in offering quick advice; using the chat is voluntary. The transfer to the USA is based on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

To limit usage we count requests per IP address. This count is deleted after 24 hours.

Reviews

Customers can review a script that is in their account, or Agency Scripts as a whole. A submitted review is public immediately and appears with your Discord display name on the product page and on the shop’s reviews page. Since 11 September 2026 there is no check before publication; we can, however, take a review offline again at any time afterwards. The legal basis is your consent, which you give by submitting after the notice at the form (Art. 6(1)(a) GDPR).

Title and text are machine-translated into all nine shop languages when you submit them. For this purpose, we send those two texts and nothing else to a specialized AI provider based in the USA, whose name we will provide upon request. We do not send your name, Discord ID, or email address. Your original text remains stored unchanged, and each translation includes a note stating that it was machine-generated and indicating the language it was translated from.

Our Discord bot also announces every new review automatically in a public channel of our Discord server, with your display name, the rating, the script reviewed and your original text. A second, short notice goes to an internal channel that only our team can see; that is where we take a review offline if we need to.

Below your review it says whether you bought the script or obtained it for free. We read that from the orders already held on your account; no additional data is collected for it. If neither can be established, nothing is shown there.

You can withdraw your consent at any time with effect for the future and ask us to delete your review, via help.agencyg.de or by email to [email protected]. We then remove it from the shop and the announcement from the Discord channel.

Loyalty tasks

On the rewards page you can collect points without buying anything. For every task you complete we store exactly two things on your account: which task it was and when it was credited. No analysis of your behaviour on the site takes place. The legal basis is Art. 6(1)(b) GDPR, as this processing serves the operation of the loyalty programme.

Whether you are on our Discord, whether you have already obtained a script and whether you have submitted a review is read from information that is already held on your account. No additional data is collected for this.

Proof of the YouTube subscription

For the task “subscribe on YouTube” you may voluntarily provide the address of your YouTube channel. We then make a single request to Google’s YouTube Data API asking whether that channel subscribes to ours. This only works if your subscriptions are public; if they are not, we receive no answer and the task stays open.

We store only the channel identifier, so that the same channel cannot be used for several accounts. We do not store a list of your subscriptions or any other information from your YouTube account. The request is made without you signing in and without any permission on your account; what is sent to Google is the channel identifier and our server’s IP address, not yours.

The legal basis is Art. 6(1)(b) GDPR. Providing the channel is voluntary; without it only this one task remains open.

Earlier orders at Tebex

The seller of every order is Tebex Limited. So that you can see your orders here as well, and so that purchases made before we had our own checkout can be linked to your account, we retrieve the payment overview of our Tebex store and store it on our server. It contains the time, amount, currency, status, the packages purchased, the Cfx name held at Tebex and the buyer’s email address.

A payment is linked to an account solely by an exact match of the email address. If no address matches, the payment stays unlinked and is visible to nobody in the shop.

The legal basis is Art. 6(1)(b) GDPR for showing you your own orders, and Art. 6(1)(f) GDPR, our legitimate interest in a complete purchase history for support and warranty. You may object to this storage and request deletion, via help.agencyg.de or by email to [email protected].

Product images

Product images are loaded from Tebex's image network (Amazon CloudFront, a service of Amazon.com, Inc., USA), which means your IP address is transmitted to that service.

Product videos

Product videos initially show only a preview image served from our own server. Only when you click the preview image is the video loaded from YouTube, a service of Google (USA). Google then receives your IP address. The legal basis is your consent, which you give by clicking (Art. 6(1)(a) GDPR). Without a click, no connection to YouTube is made.

Transfers to third countries

Some of the recipients named above are located outside the EU. For Cloudflare, Inc. (delivery of the pages), Amazon.com, Inc. (Amazon CloudFront, delivery of the Tebex product images), Google LLC (measuring completed purchases, product videos) and Discord, Inc. (sign-in, announcing new reviews), transfers to the USA are based on the adequacy decision of the European Commission on the EU-US Data Privacy Framework, under which these providers are certified (Art. 45 GDPR). For a specialized AI provider based in the USA (whose name we will provide upon request), standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR) for advice chat and translating reviews. For Tebex Limited in the United Kingdom, the adequacy decision of the European Commission for the United Kingdom applies (Art. 45 GDPR).

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. A message to [email protected] is enough. You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wiesbaden, Germany.

If you want your account deleted, write to us. Order data we are required to retain stays stored until the statutory period expires and is only used for that purpose until then.