Privacy Policy

The controller for personal data processed on this website is: Kaan Torun contact@ktox.dev Purchases themselves are processed by Tebex Limited as merchant of record. For everything that happens inside the Tebex checkout, Tebex is the controller; see their privacy policy at https://www.tebex.io/legal/privacy.

You can browse the entire catalogue without signing in and without accepting any cookies. No tracking or advertising cookies are set. Fonts are served from this domain. They are downloaded at build time, so your browser never contacts Google. Product images are loaded from Tebex's content delivery network. Your browser contacts that CDN directly, which means your IP address is visible to it. This is technically necessary to display the images. If you add items to a cart without signing in, they are stored in your browser's local storage only. Nothing is sent to us.

This site uses Vercel Web Analytics and Vercel Speed Insights to count page views and measure loading performance. Both are configured by Vercel to work without cookies and without storing data that identifies you personally. We see aggregate figures such as which pages are visited and how fast they load, not individuals. We also record the steps of a purchase on our own server: adding an item to the cart, pressing checkout, and being sent to the payment page. Each record holds the step, the package, the page, and a code that groups the steps of one visit together. That code is a one-way hash of your IP address, your browser identification and the current date. It cannot be turned back into any of them, it changes every day, and nothing is stored on your device for it. We keep no cart contents and no identity in these records. Legal basis: our legitimate interest in understanding and improving the performance of our website (Art. 6(1)(f) GDPR).

Signing in is optional. You can buy without an account. If you sign in with Discord, we receive and store your Discord user ID, username, avatar and email address. If you sign in with FiveM (Cfx.re), we receive and store your Cfx user ID, username, avatar and an API key issued by Cfx.re for your session. We never receive or store your password for either service. A session cookie holds a signed token so you stay logged in. It is technically necessary and is not used for tracking. Legal basis: performance of a contract and pre-contractual steps at your request (Art. 6(1)(b) GDPR).

• Account data: the identifiers listed in section 4 • Cart contents: which packages you added, their name and price, and when • Purchase history: Tebex transaction ID, purchased packages, total amount, any coupon used, and status • The date of the last cart reminder we sent you Payment details are never stored by us. Card data, billing addresses and invoices are handled entirely inside Tebex. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for purchase records also our legal retention obligations (Art. 6(1)(c) GDPR).

If you signed in with Discord and left items in your cart, we may send you a direct message on Discord reminding you. At most one such message is sent per user in any seven-day period. If you do not want these messages, tell us via Discord or at contact@ktox.dev and we will switch them off for your account. You can also block direct messages from the bot in your Discord privacy settings. Legal basis: our legitimate interest in recovering abandoned carts (Art. 6(1)(f) GDPR). You may object to this processing at any time under Art. 21 GDPR.

If you have linked Discord and completed a purchase, we ask Discord to assign you a customer role in our server. This requires sharing your Discord user ID with Discord, which already holds it.

We use the following providers. Each processes data on our behalf or as an independent controller for their own part of the service: • Vercel Inc.: Hosting, Web Analytics and Speed Insights https://vercel.com/legal/privacy-policy • Neon Inc.: PostgreSQL database hosting https://neon.tech/privacy-policy • Tebex Limited: Merchant of record, payment processing and product delivery https://www.tebex.io/legal/privacy • Discord Inc.: Optional sign-in, role assignment and direct messages https://discord.com/privacy • Cfx.re (Cfx Systems Ltd.): Optional FiveM sign-in https://fivem.net/privacy Some of these providers are based outside the European Economic Area or operate infrastructure there. Transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent mechanism. We do not sell personal data, and we do not share it for advertising.

• Cart items: until you remove them, complete the purchase, or ask us to delete your account • Account data: until you ask us to delete it • Purchase records: retained for as long as statutory bookkeeping and tax rules require, even if you delete your account. Your account is unlinked from the record in that case. • Analytics: aggregated by Vercel; no personal profile is retained by us • Checkout steps: kept for 12 months, then deleted. The code that groups one visit is unusable after the day it was made.

Under the GDPR you have the right to: • access the personal data we hold about you (Art. 15) • have inaccurate data corrected (Art. 16) • have your data deleted (Art. 17) • have processing restricted (Art. 18) • receive your data in a portable format (Art. 20) • object to processing based on legitimate interest, including cart reminders (Art. 21) To exercise any of these, write to contact@ktox.dev. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority. In Germany this is the data protection authority of the federal state in which you live.

Traffic to this site is encrypted with TLS. Session tokens are signed and stored in cookies marked HttpOnly and Secure. Database access is restricted to the application. No system is perfectly secure. If we ever become aware of a breach affecting your data, we will notify you and the competent authority as required by Art. 33 and 34 GDPR.

We may update this policy when the site changes. The revision date at the top of this page always reflects the current version.