TML Scripts
Privacy & GDPR

Privacy notice

Last updated 26 September 2026

This notice explains what personal data TML Scripts (ThatMaddLadd) collects when you use this site, buy a script or ask for support, why we use it, and your rights under the UK GDPR and EU GDPR. The store’s other rules are on the store policies page.

Who is responsible for your data

ThatMaddLadd is the data controller for the data described here. For anything about your data, email us at [email protected].

Payments are handled by Tebex Limited, which is the seller and merchant of record and a separate controller for the payment data it collects. Card and bank details go to Tebex and its payment providers only; we never see or store them. See the Tebex privacy policy for how Tebex uses your data.

What we collect and why

When you browse this site

  • Server logs. Like most websites, our web server records basic request details: IP address, date and time, the page requested and your browser’s user agent. We use them to keep the site running and secure (legitimate interests). They are kept for a short time and then deleted.
  • No cookies, analytics or tracking. This site sets no cookies and runs no analytics, advertising or tracking scripts.
  • Browser storage. Your cart (which scripts you added) and a reference to your checkout basket are saved in your own browser’s local storage, and the product list is cached for a few minutes in session storage. This stays on your device, is never sent to us, and is only there so the cart and checkout work. You can clear it at any time from your browser settings.
  • Tebex content. Prices, product descriptions and some images are loaded from Tebex while you browse, so Tebex receives your IP address and browser details when that happens.

When you buy a script

Tebex shares the details of each order with us: for example your name, email address, Cfx.re (FiveM) username and account ID, IP address, country, what you bought, the price and the transaction ID. We use this to:

  • grant the licence to your Cfx.re account and provide updates and support (performance of a contract);
  • handle chargebacks and disputes, and prevent fraud, leaks and licence abuse (legitimate interests);
  • keep the records the law requires (legal obligation).

Signing in at checkout happens on Cfx.re’s own site. We do not see your Cfx.re password.

When you contact us

If you ask for help in our Discord or by email, we see whatever you send us: your Discord username or email address, your messages, and any server details, logs or screenshots you share. We use them only to answer you and fix problems (legitimate interests, or the contract when it is about a script you bought). Discord is a separate controller for data on its platform.

Leak reports and bans

When we investigate a leak, a chargeback or a breach of the licence, we may keep records of the accounts involved (for example Cfx.re, Discord and Tebex identifiers) so we can enforce bans. We do this to protect our work and our customers (legitimate interests).

What we do not do

  • We do not sell or rent your data.
  • We do not send marketing emails or add you to mailing lists.
  • We do not use your data for automated decisions or profiling.

Who we share it with

Only the services needed to run the store: Tebex (payments and orders), Cfx.re (licence delivery), Discord (support) and our web hosting provider. We may also share data when the law requires it, or with Cfx.re and hosting sites when reporting a leak. Some of these services are based outside the UK and EEA, and they use their own legal safeguards, such as standard contractual clauses, for those transfers.

How long we keep it

  • Order records: for as long as your licence exists, and afterwards for as long as the law requires for accounting and tax.
  • Support conversations: until the issue is resolved, then for a reasonable time in case it comes back.
  • Ban and enforcement records: for as long as the ban applies.
  • Server logs: a short time only, then deleted.

Your rights

Under the UK GDPR and EU GDPR you have the right to:

  • access the personal data we hold about you and get a copy of it;
  • have inaccurate data corrected;
  • have your data deleted, where we no longer have a valid reason to keep it;
  • restrict or object to how we use it, including anything based on legitimate interests;
  • receive the data you gave us in a portable format.

To use any of these rights, email [email protected]. We reply within one month. We may ask you to confirm your identity first. Deleting order data does not remove a licence you still own, but we cannot delete records the law requires us to keep, or records needed to enforce a ban.

If you are unhappy with how we handle your data, you can complain to the data protection authority where you live. In the UK that is the Information Commissioner’s Office (ICO). We would appreciate the chance to sort it out with you first.

Changes to this notice

If we change how we use your data, we will update this page and the date at the top.