Agency Scripts
EnglishDeutschFrançaisEspañolPortuguêsРусскийالعربية中文हिन्दी

Products

Agency ScriptsAgency PhoneAgency PadAgency WatchCompanion AppAgency LifeAgencyModComparisons

Resources

ToolsBlogChangelogDocumentationHelp & SupportServer Status

Community

DiscordYouTubeGamesAffiliateAll links
Shop
Privacy

Privacy Policy

How we handle your data, transparent and GDPR compliant.

The protection of your data has the highest priority for us. On this page you will learn how we process personal data - transparent, secure and of course GDPR compliant.

1. Responsible Entity (Verantwortlicher)

Agency Scripts, Sole Proprietor: Leon Rudolf
Die Halde 2
64853 Otzberg
Deutschland
E-Mail: [email protected]

2. Legal Basis for Processing (Art. 6 DSGVO)

We process personal data only on the following legal bases:

  • Art. 6(1)(a) DSGVO, Consent: For loading optional external services (Discord widgets, YouTube content, Brevo newsletter). These are only activated after your explicit consent via our privacy banner.
  • Art. 6(1)(b) DSGVO, Contract Performance: For the partner and affiliate program on partner.agencyg.de; details are set out in Section 9e.
  • Art. 6(1)(f) DSGVO, Legitimate Interest: For server log files required for website security, stability, and error diagnosis. Our legitimate interest is the secure and reliable operation of this website.

3. Access Data & Hosting

When accessing our website, technically necessary server log data is processed temporarily by our hosting provider. This includes: IP address, date and time of access, requested URL, referring URL, browser type and version, and operating system. This data is used exclusively to ensure secure delivery, operational stability, and abuse prevention. The IP address is stored in full in the server logs and deleted after 14 days at the latest. Legal basis: Art. 6(1)(f) GDPR.

Hosting Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare acts as a data processor on our behalf and processes data in accordance with the EU-US Data Privacy Framework. For details, see Cloudflare's Privacy Policy.

Cloudflare Web Analytics: In addition, we use Cloudflare Web Analytics, a cookieless performance telemetry (Real User Monitoring) that collects technical metrics such as load times. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in a fast and stable website. Recipient is Cloudflare, Inc., USA. The transfer is safeguarded by Cloudflare, Inc.'s certification under the EU-US Data Privacy Framework.

4. Data Retention Periods

We retain personal data only as long as necessary for the respective purpose:

  • Server log files: Automatically deleted after 14 days at the latest.
  • Consent preferences: Stored in your browser's local storage until you clear it or withdraw consent.
  • Affiliate applications: Applications from the former form are stored on our Discord and deleted upon request. New registrations take place via partner.agencyg.de; storage duration see Section 9e.
  • Newsletter subscriptions: Stored by Brevo until you unsubscribe.

5. Cookies & Local Storage

This privacy policy also applies to companion.agencyg.de (our app landing page). It uses only functional Local Storage (language and theme) and sets no cookies, no analytics, tracking or consent banner is used there.

We use local storage (browser storage) and one first-party cookie only for technically necessary preferences:

  • Local Storage: language selection, theme preference (dark/light), exit popup display status.
  • First-party cookie agency_privacy_consent_v1 (scope: .agencyg.de, lifetime: 1 year): stores your privacy consent decision so you only have to decide once across our subdomains (agencyg.de, docs.agencyg.de, agencyscripts.dev). Contains a single boolean flag plus timestamp, no personal identifiers.

Before you grant consent, no tracking or marketing cookies are set. We do not use cookies for our visitor statistics: we run our own cookieless statistics in which the IP address is only processed as a strongly truncated hash that cannot be traced back. In the shop (agencyscripts.dev), a completed purchase is additionally reported server-side to Google Analytics; the shop's own privacy policy provides the details.

6. External Services (only after consent)

The following external services are only loaded after your explicit consent via our privacy banner. Without your consent, none of these services are called and no data is transmitted to them:

  • Discord (Discord Inc., USA): Embedded community widgets. Discord may process your IP address when loaded. Discord, Inc. is certified under the EU-US Data Privacy Framework. Discord Privacy Policy.
  • YouTube (Google LLC, USA): Video feed from our YouTube channel. Google may set cookies and process your IP address. Google LLC is certified under the EU-US Data Privacy Framework. Google Privacy Policy.
  • Brevo (Sendinblue GmbH, Germany): Newsletter form processing. Brevo Privacy Policy.
  • Cloudflare Turnstile: Spam protection for the newsletter form. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. Cloudflare Privacy Policy.

7. Data Processors (Auftragsverarbeiter)

We use the following data processors:

  • Cloudflare, Inc., CDN and hosting (EU-US Data Privacy Framework)
  • Brevo (Sendinblue GmbH), Newsletter delivery (servers in EU)
  • Tebex Limited, UK, Payment processing for script sales (independent data controller for purchases). Tebex Privacy Policy.

Note: Purchases are handled entirely by Tebex. We do not process payment data or personal purchase information on our website.

8. Fonts (Self-Hosted)

We use the fonts "Inter" and "Orbitron" which are hosted locally on our own server. No connection to Google or other external font servers is established. No data is transmitted to third parties for font delivery.

9. Affiliate Applications

The affiliate form on this page has not been available since September 2026; /affiliate redirects to partner.agencyg.de. There, you log in with Discord; what is processed in this process is set out in Section 9e. Data from previous applications submitted through the old form remains stored on our Discord and is deleted upon request.

9b. Social-Proof Display (agencyscripts.dev)

On agencyscripts.dev a subtle toast in the lower-left corner shows recent purchases ("Someone bought Agency-Phone 2 hours ago"). The data is fetched server-side from our Tebex account and strictly stripped of all personal data before reaching your browser: customer names, emails, UUIDs, gateway identifiers and payment amounts are removed on the server. Only the purchased product name, an ISO timestamp and a product thumbnail reach the browser. Legal basis: Art. 6(1)(f) DSGVO (legitimate interest in social proof for the storefront; no identifiable third-party data processed).

9c. Newsletter Opt-in (agencyscripts.dev)

Via the exit-intent coupon popup on agencyscripts.dev you can optionally submit your e-mail address to receive launch alerts and early-access deals. If you do, the following processor is used:

  • Sendinblue / Brevo (Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany), receives your e-mail address and a source tag ("exit-popup"). Double-opt-in is used: you receive a confirmation mail and only become an active subscriber after you confirm the link. You can unsubscribe any time with a one-click link in every e-mail. Brevo's privacy policy applies in parallel to this notice.

Legal basis: Art. 6(1)(a) DSGVO, explicit consent (the opt-in checkbox + your active form submission).

9a. AgencyAI chat assistant (agencyg.de, agencyscripts.dev, docs.agencyg.de)

On agencyg.de, agencyscripts.dev and docs.agencyg.de we offer an AI-powered chat ("AgencyAI"). When you send a message:

  • Your message text plus the previous messages of the current conversation (max. 12 turns) are transmitted to our server and from there to the AI provider (based in the USA, name available upon request), which generates the reply. Standard Contractual Clauses are in place for third-country transfers (USA).
  • Your conversation is stored only in your browser’s sessionStorage and is deleted when you close the tab. We do not keep chat contents on our servers.
  • For abuse protection we count requests per IP address. We do not store the raw IP: it is immediately hashed (HMAC-SHA256). Two salts are used: one rotates every 24 hours and carries the daily limit of ten questions per IP, a second rotates every seven days and carries the weekly limit of 50 questions. Only these non-reversible hashes plus timestamps are stored, for at most 24 hours and seven days respectively. The weekly counter is kept on disk so a restart of the service does not hand back questions already used.
  • A short, pseudonymous log line (eight characters of the hash, provider, language, number of turns) is written to our operational log for diagnostics and rotated as per section 4.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in providing AI support and preventing abuse and runaway costs (Recital 49 explicitly names network abuse prevention as a legitimate interest). You can always use the chat without identifying yourself; if you do not wish to use it, simply do not open it.

9d. Discord Wall of Fame (agencyg.de)

On our Wall of Fame page we display members of our Discord community with their Discord display name and their rank role. No other data is processed. The purpose is to present our community. The data comes from the Discord guild API and is cached on our side for at most 10 minutes. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in presenting our community. You can object to being displayed at any time: sign in via the Discord login directly on the Wall page and opt out. Your entry is then placed on a permanent block list and is no longer shown. Discord, Inc. (USA) is certified under the EU-US Data Privacy Framework.

9e. Partner programme (partner.agencyg.de)

On partner.agencyg.de you can apply as a server or dev partner and, as a partner, use the partner portal. You sign in with Discord (scope "identify": Discord ID, name and avatar). The cookie "agp_sitzung" is strictly necessary and lasts seven days; "agp_oauth" secures the sign-in for ten minutes.

Application. We process your details (project name, description, e-mail address, the language of your community) and the channels you enter. If you connect your Discord server, Discord provides us with the list of your servers including member counts and your permissions there (scope "guilds") and a webhook in the channel you choose (scope "webhook.incoming"). We use this webhook to publish our news in your channel. You can delete it in your Discord at any time.

Easy Setup with AgencyMod. Instead of the Discord window, you can add our bot AgencyMod to your server. Discord then asks you for these permissions: view channels, read message history, send messages, embed links, attach files, mention @everyone, create invites and manage webhooks. We do not ask for administrator rights. Through the Discord API, the bot then reads your server's name, icon, description, language setting, member count and number online, the channel list including channel topics, your roles there (to check that you manage the server) and the last up to 50 messages from at most six channels where servers usually show their links (such as welcome, info, rules, announcements). From this we only take the links found to your FiveM server, store, website, YouTube, TikTok and Twitch into your draft. If your description is still empty, an excerpt of these texts (at most 4,500 characters) together with the server name and channel names goes to AgencyAI, which writes a suggestion for your project description and detects the language of your community; the same processor as for the live check applies. We do not store the messages that were read. The bot also creates a webhook in the channel you choose for our posts and creates a permanent invite to your server, unless you have your own vanity address. The cookie "agp_bot" secures this process for 15 minutes. You can remove AgencyMod from your server at any time, which ends any further access by the bot. The legal basis is Art. 6(1)(b) GDPR. Where the messages read contain information about other members of your server, we rely on our legitimate interest in a simple application process (Art. 6(1)(f) GDPR); we process this information only during the setup.

Live check. For this, our server only retrieves publicly available information: the invite data of your Discord server, the Cfx.re server list (FiveM), public channel data via the YouTube Data API (Google), public TikTok profiles and the websites you enter. AgencyAI, our AI service, reviews your project description and public page texts for content we do not support (for example leaks or cheats). For this processing we use a specialised AI service provider based in the USA as our processor (Art. 28 GDPR). The provider is not certified under the EU-US Data Privacy Framework, so the transfer is based on EU standard contractual clauses (Art. 46(2)(c) GDPR). On request we name the specific recipient and send you a copy of the clauses. If an application meets all conditions published on the page, it is accepted automatically. Every application that is not accepted automatically is decided by a person on our team; a rejection is never made by the system alone (Art. 22 GDPR). You can withdraw your application at any time.

As a partner. We publish your project name, the logo and banner of your Discord server (mirrored by us so that visitors load nothing from Discord), your description, your links and the measured member count. Once a day we measure the public figures of your connected channels again to calculate your credit level. Coupon codes from your credit and gift cards (bonuses, commissions) are created with our payment provider Tebex, with only your Discord ID as a note. Our Discord bot checks your role every time you open the portal and sends you status messages via Discord.

Discord and activity. After acceptance we create a post for your project in our partner forum that mentions you, and we announce the partnership once with @everyone in the channel you connected. We measure the activity of your server (members and number online) several times: when you connect it, when your invite is checked, during the check itself, hourly for up to seven days while the application is with our team, and daily as a partner. We keep the measurements of the last seven days. If only information is missing from an application, the system asks you to complete it; this is not a rejection. You also receive a personal invite link to our Discord. When someone joins our Discord, our bot recognises which invite was used. For partner invites we only store a checksum of the Discord ID, the code and the time, to count how many people joined through your link and stayed (Art. 6(1)(f) GDPR, our legitimate interest in fair bonuses). For milestones you receive credit as a Tebex gift card.

Affiliate programme. Even without a partnership you can sign in with Discord on partner.agencyg.de/affiliate and create your own discount code. We store your Discord ID, your name, the code, the split you choose and its changes. We create the code as a coupon with Tebex. When it is used for a purchase, our shop reports the order number, the code, the amount paid without tax and the buyer's Discord ID; we only use that ID to recognise purchases made with your own code and do not store it. You only see the number, amounts and dates of purchases, no details about buyers. We pay out your commission monthly as a Tebex gift card and send you the code via Discord. The legal basis is Art. 6(1)(b) GDPR. We keep bookings and payouts while you take part and afterwards within the statutory retention obligations.

Team accounts. As a partner you can name further Discord accounts that get the same partner role and the same access to the portal, for example staff of your server. Only accounts that are already in our Discord can be selected; we store the Discord ID, the name shown there, the address of the profile picture and the time. Whoever names an account must be entitled to do so. You can remove accounts in the portal at any time, the role is gone immediately; when the partnership ends we remove all team accounts. The legal basis is Art. 6(1)(b) GDPR, and for the named accounts our legitimate interest in a partnership that can actually work (Art. 6(1)(f) GDPR).

Legal basis is Art. 6(1)(b) GDPR (application and partnership). Retention: unfinished drafts 14 days, rejected or withdrawn applications 30 days (because of the one-week waiting period before the next application), check logs 90 days, accepted applications and your listing for the duration of the partnership. When the partnership ends, we remove your public listing and delete the webhook. We keep activity measurements for seven days and join records for personal invites as long as the invite belongs to a partner.

9f. Weather feature of the product demos (Open-Meteo)

Our product demos include a weather feature. When you actively use it, your browser calls the services geocoding-api.open-meteo.com and api.open-meteo.com. This transmits your IP address, the location you selected and the language. The call is made only upon your action. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in functional product demos.

9g. Feedback in the documentation (docs.agencyg.de)

On docs.agencyg.de you can voluntarily give feedback on individual pages. Your feedback is delivered to us internally via a Discord webhook. Please do not enter any personal data there.

9h. Contact form (agencyg.de)

When you write to us via the contact form at agencyg.de/contact, we process your name, your email address, the subject, your message and, to prevent abuse, your IP address. The message is delivered to our mailbox via our email service provider Brevo (Sendinblue GmbH, Berlin, processor under Art. 28 GDPR). The sole purpose is handling your request.

The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or steps prior to one, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We keep the IP address only briefly in memory to limit the number of requests and do not store it permanently. We delete your message once your request has been dealt with, unless statutory retention obligations apply.

10. Your Rights (Art. 15-21 DSGVO)

You have the following rights regarding your personal data:

  • Right of access (Art. 15 DSGVO)
  • Right to rectification (Art. 16 DSGVO)
  • Right to erasure (Art. 17 DSGVO)
  • Right to restriction of processing (Art. 18 DSGVO)
  • Right to data portability (Art. 20 DSGVO)
  • Right to object (Art. 21 DSGVO)
  • Right to withdraw consent (Art. 7(3) GDPR) at any time without affecting the lawfulness of prior processing

11. Right to Lodge a Complaint (Art. 77 DSGVO)

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the DSGVO. The competent supervisory authority for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
https://datenschutz.hessen.de

12. Privacy Contact

If you have any questions about data protection, you can contact us at any time at [email protected].

Last updated: September 2026