Privacy Policy

Last updated: July 2026

Privacy at a Glance

General Information

The following notices provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

Data Collection on This Website

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Notice Regarding the Responsible Party".

Your data is collected on the one hand by you providing it to us. Other data is collected automatically or with your consent when you visit the website by our IT systems (e.g. internet browser, operating system, time of the page request).

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients, and purpose of your stored personal data, as well as the right to have this data corrected or deleted. You can contact us at any time regarding this and other questions.

Hosting

We host the contents of our website with the following provider:

netcup GmbH, Daimlerstraße 25, D-76185 Karlsruhe, Germany

When you visit our website, netcup, acting as a processor, automatically records the following information transmitted by your browser in server log files: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and the IP address. This data is not merged with other data sources.

Storage Period: Server logs are processed exclusively for the purposes of technical provision, stability, and security. They are deleted as soon as they are no longer required to achieve these purposes, or, in the event of a security incident, until the incident has been conclusively resolved. We do not associate this data with your person.

Legal basis: Processing is based on the legitimate interest in the technically error-free provision and security of our website (Art. 6(1)(f) GDPR).

Further information: netcup Privacy Policy.

Data Processing Agreement

We have concluded a data processing agreement (DPA) for the use of the service mentioned above.

General Information and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Notice Regarding the Responsible Party

Moritz Kohm
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

Email: info@msk-scripts.de

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses, or similar).

Data Protection Officer

There is no statutory obligation for our company to appoint a data protection officer. For questions regarding data protection, please contact us directly using the contact details listed under "Notice Regarding the Responsible Party".

Storage Period

Unless a more specific storage period has been mentioned, your personal data will remain with us until the purpose of the data processing no longer applies.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You can revoke a consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged violation. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in the performance of a contract handed over to you or a third party in a common, machine-readable format.

Information, Correction, and Deletion

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipient, and the purpose of data processing, as well as the right to have this data corrected or deleted.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was/is being carried out unlawfully, you can request the restriction of data processing instead of deletion.
• If we no longer need your personal data, but you need it for the exercise, defence, or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data, apart from being stored, may only be processed with your consent or for the establishment, exercise, or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL / TLS Encryption

For security reasons, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://".

Data Collection on This Website

This website operates the following distinct services, each with its own data processing:

a) MSK Scripts Shop: for purchasing FiveM resources and Discord bots via Tebex.

b) MSK Ticket Bot Transcript Service: an optional hosted service for users who self-host the MSK Ticket Bot. It stores ticket transcripts online and provides public links. Users authenticate via Discord OAuth to obtain an API key.

c) Hosted Bot Management: an optional, fully managed hosting service for Premium and Premium+ customers. The bot runs on MSK Scripts' servers; management is performed via the web dashboard.

d) MSK Giveaway Bot: a free Discord bot operated by MSK Scripts as an official public instance. Once invited to your Discord server, it lets you create and run giveaways. It processes Discord identifiers (server, channel, role and user IDs) to manage entries and draw winners. A public, anonymous statistics page is available at www.msk-scripts.de/giveaway/stats. Server administrators can optionally manage their giveaways through a web dashboard (Discord login), and when a giveaway ends a public results page showing the winners and the anonymous participant count is hosted under www.msk-scripts.de/giveaway/g/….

Data Collected by the Shop

• CFX.re / FiveM username and user ID: required for authentication and delivery via the FiveM Asset Escrow system
• Discord ID: required for packages with Discord role assignment
• IP address: transmitted to Tebex for fraud prevention when creating a basket
• Basket data: stored locally in the browser (localStorage)
• Technical log data: web server access logs including IP address, browser type, date and time

Data Collected by the Ticket Bot Transcript Service

• Discord user ID: collected via Discord OAuth during the verification process, for identity and account ownership
• Discord server ID (guild ID): linked to the API key to assign transcripts to the correct server
• Subscription tier: determined based on your Stripe subscription status (Basic, Premium, Premium+)
• Stripe customer / subscription IDs: references stored in our database to link a subscription to your server; we store no payment data
• API key: randomly generated token stored in our database to authenticate transcript uploads
• Custom domain (optional, Premium and Premium+): stored if a custom domain is configured
• Ticket transcript content: HTML files generated by the bot and uploaded to our server; stored for 30–365 days depending on tier
• Ticket attachments (Premium and Premium+): files sent in the ticket, stored alongside the transcript
• Rate limiting data: request counts per API key per hour to prevent abuse

Data Collected by the Hosted Bot Management Service

• Bot configuration files: config.jsonc and snippets.jsonc are stored on our server as part of providing the service
• .env file: contains sensitive credentials of the customer (e.g. Discord bot token, MSK API key); stored on our server and required to operate the bot
• PM2 log output: runtime output of the bot process; accessible live via the dashboard, not persistently stored
• Discord server ID (guild ID): used to identify the hosted bot instance; linked to the existing Transcript Service account

Data Collected by the Giveaway Bot

When the official Giveaway Bot instance is added to a Discord server, the following data is stored in its database:

• Discord server ID (guild ID): to store the server's giveaway settings and assign giveaways to the correct server
• Discord channel and message IDs: to locate the giveaway message and its entry button
• Discord role IDs: server-wide and per-giveaway configuration (manager / notify role, whitelist / blacklist roles, bonus-entry roles)
• Discord user ID of the giveaway host: the member who created the giveaway
• Discord user IDs of participants: stored when a member joins a giveaway via the button; removed again immediately if they leave before it ends
• Discord user IDs of winners: stored when winners are drawn (including rerolls)
• Giveaway content: title, description, duration, number of winners and status
• Per-server settings: language, embed colour, button style and emoji, and the configured eligibility rules (minimum account / membership age)

When a giveaway ends, the usernames of the winners are resolved once and published on that giveaway's public results page (together with the anonymous participant count, never the participant list). Apart from this, we do not collect message content, email addresses, usernames or any other Discord profile data through the Giveaway Bot.

Data We Do NOT Collect

• We do not collect any payment data for the shop. Payment processing is handled exclusively by Tebex Limited.
• We do not use tracking cookies, analytics services, or advertising technologies.
• We do not read or store any Discord messages beyond what the bot operator uploads as a transcript.

Legal Bases for Processing

Cookies and Local Storage

Session Cookies (Ticket Bot Transcript Service)

During the verification process at www.msk-scripts.de/ticketbot/verify, httpOnly session cookies are used to maintain the multi-step OAuth flow:

All session cookies are:

• httpOnly: not accessible via JavaScript
• Secure: transmitted exclusively over HTTPS
• SameSite=Lax: protected against cross-site request forgery

Legal basis: Art. 6(1)(b) GDPR, technically necessary to provide the verification service.

Session Cookies (Giveaway Dashboard)

When you use the giveaway dashboard at www.msk-scripts.de/giveaway/dashboard, the following httpOnly session cookies maintain the Discord login and server selection:

These cookies are httpOnly, Secure and SameSite=Lax, exactly like the verification cookies above.

Legal basis: Art. 6(1)(b) GDPR, technically necessary to provide the dashboard.

Local Storage (Shop: Basket)

The browser's localStorage is used to store the basket identifier. This data does not leave your browser and is not transmitted to our servers.

Legal basis: Art. 6(1)(b) GDPR, technically required for the basket.

Session Storage (Shop: Authentication)

sessionStorage is used to temporarily store FiveM and Discord authentication status during the Tebex checkout flow. The data is automatically deleted when the browser tab is closed.

Language Preference Cookie

On the pages /terms (legal texts), /stats, /giveaway/stats, /giveaway/g/… (public results), /verify, and /dashboard, a technically necessary cookie is set to remember your chosen display language (German or English) across pages:

On your first visit, the language is detected automatically from your browser's Accept-Language header. As soon as you switch the language manually, your choice is stored in this cookie. The cookie is SameSite=Lax and is transmitted exclusively over HTTPS (Secure). It is not httpOnly, so the selection can be toggled directly in the browser without an additional server round-trip.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in providing a consistent language presentation (technically necessary preference cookie, no tracking function).

Abuse Prevention (Rate Limiting)

To protect the publicly reachable endpoints (the giveaway results pages /giveaway/g/… and the dashboard login /api/giveaway/auth) from automated abuse, the server temporarily processes your IP address in memory to count requests within a short time window. This IP-based counter is not written to any database, is not used for profiling or tracking, and is discarded automatically after the window elapses. (Separately, the web server keeps standard access logs as described under "Technical log data".)

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in the security, integrity and availability of the service.

Tracking and Analytics

This website uses no tracking cookies, analytics tools (e.g. Google Analytics), or advertising technologies. A cookie consent banner is not required, as no non-essential cookies are set.

Ticket Bot Transcript Service: Detailed Processing

Verification and Account Creation

When registering at www.msk-scripts.de/ticketbot/verify, the following data processing takes place:

Discord OAuth: You are redirected to Discord. After authorisation, Discord transmits your Discord user ID and a list of servers on which you have administrator rights (server names, IDs, and icons). Server icons and the list of non-selected servers are used exclusively for displaying the selection and are not stored. Your Discord user ID, the selected server's ID and its name are stored in our database. The name is shown in your dashboard so you can tell your servers apart.

Data stored in our database upon successful verification:

Transcript Storage

When a ticket is closed on a self-hosted bot with a valid API key, the bot uploads the generated HTML transcript to our server. We store:

• The HTML file of the transcript on our server's filesystem
• Metadata in our database: upload timestamp, file size, expiry date, server reference

The transcript HTML is generated by the self-hosted bot before upload and may contain personal data of the ticket participants, in particular their Discord usernames and display names, user avatars, custom server emojis, the message content of the ticket and timestamps (and, for Premium and Premium+, file attachments; see below). Avatars and custom emojis are embedded directly into the file. The operator of the self-hosted bot decides which tickets are uploaded and is responsible for the content of those transcripts; we store and serve the resulting file on their behalf.

Transcripts are automatically deleted after the retention period applicable to your tier (30, 180, or 365 days). Transcripts are publicly accessible via their unique URL (containing a random UUID), but are not indexed or linked.

Attachment Storage (Premium and Premium+)

For Premium and Premium+ users, file attachments from tickets (images, PDFs, etc.) are downloaded from Discord's CDN and stored on our server alongside the transcript. These files are deleted together with the transcript upon expiry.

Basic users do not have access to attachment storage; no file attachments are stored on our servers for this tier.

Custom Domain (Premium and Premium+)

If a custom domain is configured, the domain name is stored in our database. Upon activation:

• An Apache2 VirtualHost configuration is created on our server
• A free SSL certificate (Let's Encrypt) is set up via Certbot; in this process, our admin email (info@msk-scripts.de) is registered with Let's Encrypt for certificate notifications

Your domain name may appear in public Certificate Transparency logs as a result of the SSL certificate issuance. This is a standard feature of the public Web PKI infrastructure.

Stripe Subscription Webhook

We operate a webhook endpoint that receives events from Stripe when your subscription is created, renewed, changed, or cancelled. We process these events to automatically activate, upgrade, or downgrade your subscription tier and to record the trial status. We receive no card or payment data through this webhook.

Data processed: Stripe customer and subscription IDs, subscription status and tier, current period end, your Discord user ID and server ID (passed as metadata).

Legal basis: Art. 6(1)(b) GDPR, necessary to deliver the subscribed service.

Hosted Bot Management

For Premium and Premium+ customers who use the Hosted Bot Management service, the following data is stored on our servers in a directory assigned to your Discord server ID:

Sensitive credentials: The .env file may contain your Discord bot token and other API keys. This file is stored on our server and is required to operate the bot. MSK Scripts personnel may access this file for maintenance and support purposes. You are responsible for ensuring that the credentials stored therein are not compromised.

Upon termination of the hosting arrangement, all files in your bot directory (including the .env file) are deleted from our servers within 14 days.

Legal basis: Art. 6(1)(b) GDPR, processing is necessary for the performance of the hosting contract.

Access control: The configuration files can only be accessed by the service operator (MSK Scripts) and by you via the authenticated dashboard at www.msk-scripts.de/ticketbot/dashboard.

Giveaway Bot: Detailed Processing

MSK Scripts operates the official public instance of the Giveaway Bot. When a server administrator invites the bot to their Discord server, MSK Scripts acts as the controller for the data the bot stores in its database.

What Is Stored and Why

The bot stores per-server settings and, for each giveaway, the giveaway content together with the Discord user IDs of the host, the participants and the winners. Participant IDs are required to prevent duplicate entries, to apply the configured eligibility rules and to draw winners. Winner IDs are stored so that results remain visible and rerolls are possible.

When a member leaves a giveaway before it ends (by pressing the button again), their entry is deleted immediately.

Retention

Giveaway data is retained only while the bot is a member of your server, so that commands such as /ginfo and /greroll continue to work. When the bot is removed from a server, all of that server's data (per-server settings, giveaways, entries, winners and templates) is deleted immediately and automatically. While the bot remains on the server, per-server settings persist until they are changed. You may also request erasure of your data at any time (see "Your Rights Under the GDPR" below).

Public Statistics Page

The page at www.msk-scripts.de/giveaway/stats displays only anonymous, aggregated totals, for example the number of servers using the bot, the total number of giveaways, entries and winners, and the distribution by language and status. It contains no server IDs, user IDs, usernames or other personal data.

Public Results Pages

When a giveaway ends, the bot publishes a public results page at www.msk-scripts.de/giveaway/g/{token} (the token is a random, unguessable string). This page shows the giveaway title and prize, the usernames of the winners, and the anonymous number of participants. It deliberately does not list the participants. The link is shared in the Discord results message and in the winner notifications. The page is removed when the bot is removed from the server (server data deletion).

Web Dashboard

Server administrators may manage their giveaways at www.msk-scripts.de/giveaway/dashboard. Access requires logging in with Discord (OAuth scopes identify and guilds); we use this only to determine which servers you administer and that the bot is present there. A signed, httpOnly session cookie (msk_giveaway_session) then authorises management actions for that server. Management actions are forwarded to the bot over a server-internal, secret-authenticated localhost channel.

Responsibility of Server Administrators

If you invite the bot to a server you manage, you are responsible for the giveaways you run on it, including their legality (prizes, eligibility, applicable promotion or sweepstakes law) and for informing your members that a third-party service (MSK Scripts) operates the bot.

Payment Processing (Tebex, Shop)

All shop purchases are processed via Tebex Limited, 201 Haverstock Hill, Second Floor, London, NW3 4QG, United Kingdom. Tebex acts as the Merchant of Record and is solely responsible for payment processing.

• Tebex Privacy Policy
• Tebex Terms of Service

Subscription Payments (Stripe)

The Premium and Premium+ subscription for the Ticket Bot Transcript Service is processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).

To set up a subscription, you enter your name, billing address, email address and payment details directly with Stripe during checkout. Stripe handles all payment processing, invoicing, and refunds. We do not receive or store your card details. We only store the Stripe customer and subscription IDs and your subscription tier to provide the service.

Stripe Privacy Policy: stripe.com/privacy

Authentication via CFX.re / FiveM (Shop)

To purchase shop packages, you authenticate via the Tebex identity service using your CFX.re account. Your FiveM username and user ID are temporarily stored in your browser's localStorage.

Authentication via Discord (Shop)

For packages with Discord role assignment, your Discord ID is collected via the Tebex identity service and transmitted to Tebex as part of the purchase. No permanent storage takes place on our servers.

Web Server Logs

Our server automatically records access logs containing: IP address, date and time, URL accessed, HTTP status code, browser/client type. These are used for security and operational purposes and are automatically deleted after a maximum of 14 days.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in operating and securing the website.

Discord Member Count

Our homepage displays the current online member count of our Discord server. The result is cached on our server for 60 seconds. No personal data is transmitted to Discord.

Resource Statistics (fivestats.io)

The public page at www.msk-scripts.de/resources shows the live adoption of our FiveM resources, meaning the number of servers running a resource, its rank and a 7-day trend. These figures come from the third-party service fivestats.io (operated by fivestats.io).

The data is fetched server-side only. Our server queries fivestats.io for statistics about our own resources and displays them. Your browser never connects to fivestats.io directly. No personal data of yours is transmitted to fivestats.io, neither your IP address nor cookies or any other identifiers. Only the names of our own resources and our API key are sent, and the response consists of aggregated server counts with no personal reference. The result is briefly cached on our server.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing the adoption of our resources; no personal data is transmitted).

Storage Period

Data Transfer to Third Countries

Tebex Limited (UK): The United Kingdom has an adequacy decision from the EU Commission. Transfers to Tebex are considered GDPR-compliant.

Stripe Payments Europe, Ltd. (Ireland): Subscription payments are processed by Stripe within the EU. Where Stripe transfers data to its US parent, this is done on the basis of Standard Contractual Clauses. See: stripe.com/privacy

Our web server, as well as all transcript and attachment data, are stored within the European Union.

Your Rights Under the GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): Request information about stored data
• Right to rectification (Art. 16 GDPR): Request correction of inaccurate data
• Right to erasure (Art. 17 GDPR): Request deletion of your data
• Right to restriction (Art. 18 GDPR): Request restriction of processing
• Right to data portability (Art. 20 GDPR): Receive data in a machine-readable format
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interests
• Right to lodge a complaint: with the competent supervisory authority (in Germany: the State Commissioner for Data Protection of your federal state)

To exercise your rights, please contact: info@msk-scripts.de

We will process your request within 30 days.

Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes to our services or applicable law. The current version is always available at this URL. The date above indicates when the last update took place.