Privacy Policy

This policy explains what data is collected when you visit this store and what happens to it. The controller is the provider named in the legal notice.

Visiting the site

When you open a page, your browser transmits technically necessary information: IP address, time, requested address, referring page and browser identification. This goes into the server and error logs and serves operation and abuse prevention. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure operation. Logs are deleted after 14 days at the latest.

Delivery runs through Cloudflare as a content network, which means your IP address is transmitted to Cloudflare.

Cart

Your cart is stored in your browser's local storage so it survives navigation. This is not a cookie and is not transmitted to us as long as you are not signed in. You can clear it at any time in your browser settings.

Wall of Fame

On the Wall of Fame page we publish the Cfx username of everyone who has obtained a script from us. That name is the only thing published. We do not publish which product was obtained, when, for how much, the order number, or the email address. The list is sorted alphabetically so that the order allows no conclusions about purchase time or amount.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in showing verifiable evidence of how widely our scripts are used, rather than stating a figure nobody can check. Since the Cfx name is a self-chosen pseudonym under which the person appears publicly anyway, we consider the interference to be minor.

You may object to this publication at any time, without giving reasons, informally via help.agencyg.de or by email to [email protected]. We will then remove your name from the Wall of Fame and add it to a suppression list so that it does not reappear when the page is updated.

Signing in with Discord

You can browse without signing in. For a purchase, signing in with Discord is required so the purchase can be assigned to your account. If you sign in, Discord gives us your Discord ID, display name, avatar and email address. We store this along with your cart, your loyalty points and your order numbers. The legal basis is Art. 6(1)(b) GDPR, as this processing is required to operate the user account.

By signing in you also allow Discord to add you to our Discord server. This happens once, at sign-in. You can leave the server at any time; your account in this store is unaffected.

Signing in sets a technically necessary session cookie. It contains your Discord ID, name and avatar, is signed, and expires after 30 days. It is deleted when you sign out.

Purchase and payment

The purchase contract is concluded with Tebex Limited. When you go to checkout, the selected items are transmitted to Tebex, where you also enter your payment and billing details. We neither see nor store payment data.

So the purchased resources can be unlocked, you link your Cfx.re account once at Tebex. This linking takes place at Tebex.

After a purchase, Tebex sends us a confirmation with order number, amount, currency, purchased items and, where available, email address and username. We store this to process the order and because of statutory retention obligations.

The privacy policy of Tebex Limited applies in addition.

Emails, newsletter and reminders

We use Brevo as a processor for sending all of our emails (Brevo SAS, France, and Sendinblue GmbH, Germany; processing within the EU). Brevo processes the data only on our instructions.

We send the newsletter only if you signed up for it and confirmed the sign-up via the confirmation link in the first email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR).

After you obtain a free script we send a short welcome series with pointers to our scripts, but only if you consented to promotional emails at that point. The legal basis is again your consent (Art. 6(1)(a) GDPR).

We send cart reminders and similar emails to existing customers only if you consented to promotional emails or if we received your email address in connection with a purchase and may advertise our own similar products to you (§ 7(3) of the German Act against Unfair Competition, UWG). The legal basis in that case is Art. 6(1)(f) GDPR, our legitimate interest in direct marketing to existing customers.

To pick suitable content we store purchase attributes, such as which scripts you obtained. Every such email contains an unsubscribe link. You can object to the promotional use of your email address at any time and withdraw any consent at any time, via the unsubscribe link, via help.agencyg.de or by email to [email protected]. After you unsubscribe we delete your address from the mailing list.

No analytics or advertising scripts in your browser

This store embeds no analytics or advertising scripts in your browser and no cross-site tracking. There is therefore no consent banner for non-essential cookies, because there are none. Fonts are served from our own server and not loaded from third parties. The server-side reporting of completed purchases is described in the next section.

Measuring completed purchases

After a purchase we report the completed order server-side to Google Analytics 4, a service of Google LLC, USA. We transmit your email address in hashed form as an identifier, the order number, the amount and the list of purchased items. Your IP address is not transmitted. The report is sent from our server; no script runs in your browser for this.

The purpose is measuring the success of our advertising in Google Ads. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in knowing which advertising leads to purchases. You can object to this processing at any time via help.agencyg.de or by email to [email protected].

Google LLC is certified under the EU-US Data Privacy Framework. The transfer to the USA is based on the adequacy decision of the European Commission (Art. 45 GDPR).

AgencyAI advice chat

For the AgencyAI advice chat, our server transmits your chat input to OpenAI (USA) to generate a reply. No account data is sent along, OpenAI only receives the chat history. Please do not enter sensitive data in the chat. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in offering quick advice; using the chat is voluntary. The transfer to the USA is based on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

To limit usage we count requests per IP address. This count is deleted after 24 hours.

Reviews

Customers can review a script that is in their account. We check submitted reviews before publication. They then appear publicly on the product page together with your Discord display name. We point this out at the form. The legal basis is your consent, which you give by submitting after this notice (Art. 6(1)(a) GDPR).

You can have your review deleted at any time via support at help.agencyg.de.

Product images

Product images are loaded from Tebex's image network (Amazon CloudFront, a service of Amazon.com, Inc., USA), which means your IP address is transmitted to that service.

Product videos

Product videos initially show only a preview image served from our own server. Only when you click the preview image is the video loaded from YouTube, a service of Google (USA). Google then receives your IP address. The legal basis is your consent, which you give by clicking (Art. 6(1)(a) GDPR). Without a click, no connection to YouTube is made.

Transfers to third countries

Some of the recipients named above are located outside the EU. For Cloudflare, Inc. (delivery of the pages), Amazon.com, Inc. (Amazon CloudFront, delivery of the Tebex product images), Google LLC (measuring completed purchases, product videos) and Discord, Inc. (sign-in), transfers to the USA are based on the adequacy decision of the European Commission on the EU-US Data Privacy Framework, under which these providers are certified (Art. 45 GDPR). For OpenAI (advice chat), standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR). For Tebex Limited in the United Kingdom, the adequacy decision of the European Commission for the United Kingdom applies (Art. 45 GDPR).

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. A message to [email protected] is enough. You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wiesbaden, Germany.

If you want your account deleted, write to us. Order data we are required to retain stays stored until the statutory period expires and is only used for that purpose until then.