Privacy policy

Controller

Email: fabian.bauer@elektrotechnik-lube-holger.de

“F&J Studios” is the shop name of the controller.

Hosting and server logs

This website is hosted by Vercel Inc. (USA). Whenever a page is requested, Vercel processes technically necessary connection data, in particular your IP address, date and time, the requested address, the referrer and your browser identifier (user agent). Vercel keeps logs of this for operation and security; their retention follows Vercel's rules. More information: Vercel privacy notice.

Our application additionally writes technical operating messages, for example about the outcome of a purchase notification from Tebex. These messages contain no names, email addresses or IP addresses.

Fonts are served by this website itself. Regular product images from Tebex are loaded through this website's image proxy (Next.js); your browser does not connect to Tebex for them. For products with a 360° view, your browser may instead load the individual frames directly from Supabase Storage; Supabase then receives, for technical reasons, your IP address and information about your browser.

Sign-in with Discord and F&J account

Signing in is optional and only starts when you click the button to sign in with Discord; the catalogue can be used without signing in. At the moment it creates an F&J account. It is required for the purchase of products for which Tebex needs a Discord ID (e.g. for Discord roles) and for personal features of your F&J account once they are enabled.

For the sign-in we use the sign-in service of Supabase. Our Supabase project is set up in the region “EU West (Ireland)”. Your browser is redirected to Discord via Supabase. Only the permissions “identify” and “email” are requested from Discord; we do not request further permissions, such as server lists.

Through these permissions, Discord makes available to Supabase in particular your Discord ID, your username, your display name, the address of your avatar and your email address. Supabase stores this information in our sign-in system and may store information about your sign-in sessions (e.g. time, IP address and browser identifier).

About the email address: Supabase always requests it during the Discord login for technical reasons. We do not use it – neither for purchases nor for unlocking products or for support. It is not sent to Tebex and not shown on the website.

Our application reads from the sign-in session the Discord ID, a display name (preferably your Discord display name, otherwise the name supplied by Discord) and the address of your avatar, and checks its host. For the functions of the shop we only use the Discord ID and the display name; we show the display name. We do not show the address of your avatar and do not store it in our own tables.

When you sign in for the first time, we create an F&J account with a random internal identifier. We do not copy Discord data such as the Discord ID, name or avatar into our own tables.

The sign-in session remains active until you sign out or it is ended. Your account and sign-in data are kept until you request deletion (see “Deleting your account”).

Privacy notices: Discord, Supabase.

Discord community widget

We offer an optional Discord community widget to display community content in the store. Without valid consent, this embedding loads no Discord resources. If you agree, your browser connects to Discord and its content delivery services, including discord.com and cdn.discordapp.com. This transmits, among other things, your IP address, browser information and resource requests. The shop origin may be sent as a referrer. You can use the remaining store functions without widget consent. The embedding is separate from any Discord sign-in used by the store.

For EEA users, Discord identifies Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands, as its service controller. See the Discord Privacy Policy and Cookie Policy. Discord may process information in the United States and other third countries. Widget consent does not replace the additional requirements for transfers to third countries.

The optional embedding is based on your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 25(1) TDDDG. You can decline or withdraw at any time through “Privacy settings – Discord” in the footer. We then remove the embedding and delete our local decision where the browser permits. This cannot retrospectively erase transmissions already started, information already sent or cookies set by the provider. Withdrawal does not affect the lawfulness of processing before withdrawal.

Under fj.discord-consent, this browser's localStorage holds only your decision, the notice version and expiry time. The decision is valid for up to 30 days. With valid consent, the widget loads automatically on return visits. We attempt to remove invalid, outdated or expired entries on the next access to these settings. Without another access, or where storage is blocked, entries may physically remain for longer; deletion at exactly 30 days is not guaranteed. If storage fails, the widget remains blocked.

Discord or its technical service providers may use their own cookies and similar technologies. Our isolated test on 26 October 2026 observed _cfuvid as a session cookie and a partitioned cf_clearance cookie lasting approximately one year on .discord.com. These cookies remained after withdrawal of widget consent. The 30-day validity of our decision does not apply to provider cookies. You can manage third-party website data through your browser settings; controls and deletion depend on your browser. This observation is not an exhaustive cookie list for all visits or browsers and does not guarantee the absence of tracking.

The direct invitation link lets you open Discord without agreeing to the widget. Only using that link opens an external Discord page, where the provider's information and settings apply.

Discord identifies Discord Netherlands BV as its service controller for EEA users. Its Terms of Service give the address Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands. Discord describes its processing and service providers in its Privacy Policy. The recipient categories described there include hosting and cloud providers. These general statements are not a complete list of every company used by the widget.

According to Discord, processing takes place in the United States and potentially other countries. For transfers outside the EEA, Discord names, in particular, European Commission standard contractual clauses, Modules 1 and 2, and applicable adequacy decisions. Information about applicable safeguards can be requested from privacy@discord.com.

On 26 October 2026, the official DPF register listed Discord, Inc. for Non-HR Data with the status “Active - Re-certification under Review”. The EU adequacy decision 2023/1795 concerns covered transfers to participating US organisations. This register finding does not establish coverage of every provider or onward transfer used by our widget.

Discord's retention information bases retention on the relevant purpose and legal requirements. It does not state a separate fixed deletion period for all data of visitors using a widget without signing in. Specific periods for accounts, content or other data categories are not a general widget deletion period. Our 30 days concern only the validity of the locally stored decision, not Discord's records.

Cookies and local storage

We set our own cookies for the store functions described in this section. After you consent to the optional Discord community widget, third-party cookies and similar storage technologies may also be used. Further information is provided in the “Discord community widget” section.

In addition, your browser stores locally on your device (localStorage): for the product comparison under “fj:compare:v1” the identifiers of the selected products (at most four) with a timestamp. Entries older than 30 days are no longer taken into account. This website currently does not offer a “Recently viewed” list; nothing is stored in the local storage when you open a product page. If earlier versions of this website created entries under “fj:recently-viewed:v1”, they may remain in your browser until you delete them in your browser settings. The local storage is not transmitted to our server as a whole. The identifiers of the products selected for comparison can, however, reach our server in the “p” address parameter of the comparison page: when you open the comparison and possibly earlier, for example if your browser automatically preloads the link to the comparison. You can delete the local storage at any time in your browser settings.

When you use external sign-in, checkout or video services, the respective providers may use their own cookies and similar technologies; their privacy notices apply. With your consent, Discord may also store or access information on your device through the community widget embedded within the store page. Your browser's widget decision does not delete provider cookies already present.

Basket and purchase via Tebex

The seller and Merchant of Record is Tebex Limited (United Kingdom). As soon as you add a product to the basket, our server creates a basket at Tebex. We transmit the selected products, entered coupon or creator codes and return addresses – and, if you are signed in, your internal F&J identifier (so a purchase can be matched to your account) and, for products that require it, your Discord ID. In addition, the public IP address from which you access our website may be transmitted to Tebex, depending on how our server is set up for this.

For FiveM products, Tebex asks you to sign in with Cfx.re so the products are assigned to your Cfx.re account. We do not receive any credentials. We display the Cfx.re username Tebex returns for the basket but do not store it.

In the checkout you enter your data directly at Tebex. We do not receive payment details. The Tebex privacy notice applies to the checkout.

Purchase notifications and product unlocks

When Tebex notifies us of a purchase, refund, chargeback or subscription change, we verify the message signature and store only: type and time of the event, transaction or subscription reference, payment status, the purchased products and – if you were signed in when buying – the link to your F&J account. We do not store names, email addresses, IP addresses or payment details from the message.

The purpose is to show your products in your account and to take refunds or chargebacks into account correctly.

Support

Our support system at support.fjstudios.dev is a separate system. This website only links to it and does not pass on any data.

Contact by email

If you contact us by email, we process your email address, the content of your message and the usual technical details of the email, such as its date and time. We also process any additional information you include in your message. We use this information to handle and respond to your enquiry.

For email communication, we use STRATO as our email provider and Microsoft Outlook as an email application installed locally on our PC. Your message is processed in the STRATO mailbox and may also be stored locally on our computer, depending on the Outlook configuration. This does not establish whether Microsoft cloud services are used.

We do not use the email address from your Discord account to handle these email enquiries. The separate support system at support.fjstudios.dev operates independently.

We regularly delete emails manually. The timing depends on the content of the message and the status of its handling; there is no fixed deletion period. Statutory retention obligations may prevent deletion.

Videos (YouTube)

Videos are only loaded when you click them. Before that there is no connection to YouTube. After the click, the video is loaded from YouTube (Google) via youtube-nocookie.com; Google receives in particular your IP address and information about your device. More information: Google privacy policy.

Recipients outside the EU

Some of the providers named above are based outside the European Union: Vercel and Google (USA), Supabase (a provider based outside the European Union; our project is set up in the region “EU West (Ireland)”) and Tebex (United Kingdom).

The following statements reflect what the providers themselves state in their public documents about transfers to third countries. They do not confirm that every individual data flow on our website is based on one of these mechanisms.

• Vercel names standard contractual clauses of the EU Commission in its data processing agreement and participation in the EU-US Data Privacy Framework in its privacy notice. Sources: Vercel DPA, Vercel privacy notice.
• Supabase names standard contractual clauses of the EU Commission in its data processing addendum and in its information on data transfers. Sources: Supabase DPA, Supabase on data location and transfers.
• Discord names standard contractual clauses and compliance with the EU-US Data Privacy Framework in its privacy policy (section “International data transfers”). Source: Discord.
• Google names participation in the EU-US Data Privacy Framework and standard contractual clauses on its page on data protection frameworks. Source: Google.
• Tebex generally names adequacy decisions of the EU Commission and standard contractual clauses in its privacy notice (section “International Transfers”). Source: Tebex privacy notice.

Our Supabase project is set up in the region “EU West (Ireland)” (eu-west-1). This does not mean that all processing takes place exclusively in the EU: according to Supabase, support access, the processing of log and usage data, and the delivery of files may, among other things, also take place outside this region.

For our mailbox we use STRATO (see “Contact by email”). According to STRATO's data processing agreement, processing generally takes place in a Member State of the EU or the EEA. The agreement permits the use of subprocessors; in its list, STRATO also names companies based outside the EEA (among others in Singapore, the USA and Switzerland) and EU standard contractual clauses for them. This section does not say that every subprocessor listed there is used for our mailbox.

Retention overview

• Cookies: see the table above.
• Local storage for the product comparison: entries older than 30 days are no longer taken into account. Entries from earlier versions under “fj:recently-viewed:v1” are neither read nor deleted by this website; they remain in your browser until you delete them there.
• Account and sign-in data: until your account is deleted.
• Product unlocks: until your account is deleted.
• Purchase records from Tebex notifications: as long as they are needed to match your products and to handle refunds or chargebacks.
• Hosting logs: according to Vercel's rules.
• Email correspondence: deleted manually on a regular basis, depending on content and handling status, without a fixed deletion period; statutory retention obligations may apply.

Your rights

Under the General Data Protection Regulation (GDPR) you have in particular the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object (Art. 21 GDPR)

Contact fabian.bauer@elektrotechnik-lube-holger.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Deleting your account

Deleting your account directly on the website is not possible yet. Write to fabian.bauer@elektrotechnik-lube-holger.de. We will then delete your sign-in data, your F&J account, your wishlist, your reviews and your product unlocks.

Purchase records and the related payment events (such as the transaction number, payment status and purchased products) may be kept without a direct link to your F&J account; we remove the internal identifier of your account from these records. This is not full anonymisation: through the transaction number, the records can still be matched to a person at Tebex. An ongoing subscription at Tebex is not cancelled by deleting your account. Your products at Cfx.re are not affected. Data collected by Tebex in the checkout is managed by Tebex.