Privacy
policy.

Last updated: 8 September 2026

Who controls what

Two organisations are involved in a purchase, and they are responsible for different things.

• Tebex Limited operates checkout. They are the seller and the data controller for everything collected during payment, including your payment details, billing information and their own records of the sale. See the Tebex checkout privacy policy. We never see your card details. They do not pass through this site or our systems at any point.
• Digital DEN is the controller for this website, for the purchase records Tebex sends us afterwards, and for our Discord server. That is what the rest of this policy is about.

Questions, or want to exercise a right below? Email hello@digitalden.shop.

What we collect

Browsing and building a basket

Nothing identifying. This site has no accounts and no sign-up. Your basket and your chosen currency are stored in your own browser using local storage. They are not sent to us and we cannot see them. Clearing your browser data removes them.

When you buy something

After a payment completes, Tebex sends us a record of it. We store:

• Your CFX (FiveM) username, which is who the licence belongs to
• Your email address, as supplied to Tebex, so we can identify you if you contact us
• What you bought, the amount, the currency and the date
• The transaction id, so a support ticket can be tied to a real purchase

Lawful basis: performance of a contract for the licence and the support that comes with it, and our legal obligation to keep business records.

If you link your Discord account

Linking is optional and nothing about buying depends on it. If you use the /link command we store your Discord user id and username against your CFX username, so that support can see what you own without asking you for a transaction id.

We do not receive your Discord password, your direct messages, or the list of servers you are in. Ask us and we will unlink it.

Lawful basis: consent, which you can withdraw at any time.

In our Discord server

If you join, we keep moderation records where they are needed: warnings, timeouts, bans and the reason for them, plus a transcript of any support ticket you open so the conversation is not lost when the channel closes. Message deletions and edits in public channels are logged to a staff channel.

Lawful basis: our legitimate interest in running a safe server and in being able to answer a question about a past decision.

Automatically

Our host records standard server logs: IP address, browser type, pages requested and timestamps, for security and to keep the site running. We do not use analytics, advertising or tracking cookies.

The public customers page

This is worth stating plainly rather than burying. Our customers page publishes, for recent and top customers: the CFX username, the amount spent, and the date. Where you have a public profile picture on the Cfx.re forum, we show that too.

We never publish your email address, your transaction id or your Discord account. Customers with no username recorded are left out entirely rather than shown as anonymous.

Lawful basis: our legitimate interest in showing the store is real and active. If you would rather not appear, email us and we will remove you. No reason needed.

Cookies and consent

This site sets no cookies and runs no analytics or advertising. It uses browser local storage for your basket and currency choice, both functional, neither used for tracking.

The banner on your first visit is not a cookie notice. It asks about one thing: whether we may fetch exchange rates from a third party so prices can be shown in your currency, which reveals your IP address to them. Declining genuinely stops it and prices are shown in pounds only. Change your mind by clearing this site's data in your browser.

Typefaces are served from our own domain rather than a font service, so loading a page does not tell anyone else that you visited.

Tebex sets its own cookies inside the checkout window. That is covered by their policy, not ours.

Who else processes your data

• Tebex: operates checkout and takes payment. Controller in its own right, not our processor. See their policy, linked above.
• Cloudflare: hosting, content delivery and server logs.
• Supabase: stores the purchase records and Discord links described above. Hosted in Ireland (EU).
• Discord: our community and support live there. Anything you send us in Discord is processed by Discord under their own policy.
• PebbleHost: hosts our Discord bot.
• Resend: sends any email we send you directly. EU region. Your Tebex receipt comes from Tebex, not from us.
• Cfx.re forum: we fetch public profile pictures for the customers page. No data about you is sent to them.
• open.er-api.com: exchange rates for the currency selector, and only if you agree. Decline and the request is never made.

We do not sell your data, and we do not share it with anyone for marketing.

How long we keep it

• Purchase records: six years, the period UK tax rules require business records to be kept.
• Discord links: until you ask us to unlink, or you leave the server.
• Ticket transcripts and moderation records: two years, then deleted.
• Server logs: retained by our host on their standard schedule.

Your rights

Under UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything inaccurate
• Delete your data ("right to be forgotten")
• Restrict or object to how we use it
• Transfer it to another provider
• Withdraw consent for anything based on it, such as the Discord link

Email hello@digitalden.shop and we will respond within one month. There is no charge.

One limit worth being honest about: we cannot delete a purchase record we are legally required to keep for tax purposes, and we cannot delete anything held by Tebex. For their records, ask them.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office, the UK's data protection regulator.

Security

The site is served over HTTPS and enforces a content security policy. There are no accounts and no passwords on this site, so there is no password of yours for us to lose. Payment details never reach us.

Our own access to the purchase database is limited to keys held on our server and never present in the website's code.

Children

This site is not intended for under-16s and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Changes

If we change this policy we will update the date above, and announce anything material in our Discord.