Privacy

Who handles your data

Furia Store sells script licenses for FiveM servers, such as Loudly, and is the controller of the data described on this page. The controller's identification details (name or company name, tax number and address) are provided to anyone who asks through the Furia Store Discord, where we also handle any request about your data.

What data we collect, what for and on what legal basis

Discord account

When you sign in, Discord gives us, with your authorization, your identifier, your username and display name, your profile picture and your email (only when Discord marks it as verified). We only ask for the identify and email permissions: we don't see your password, your messages, your servers or your friends. The access token is used only for the login and is revoked right after. We use this data to identify your account, link your licenses and orders to it and send your email to Stripe for the receipt. Legal basis: performance of the contract (buying and using the license).

Session and cookies

After you sign in we store a session cookie (__Host-fs_sess) with a random value, marked HttpOnly, Secure and SameSite=Lax. On the server we keep only the hash of that value, along with your customer identifier, the IP and browser you signed in with, and the usage dates. The session ends after 7 days without use, or 30 days after it was created, whichever comes first, or when you sign out. During login there is also a temporary cookie (__Host-fs_oauth) that lasts 5 minutes. When you pay, your browser keeps a random order key in the tab (sessionStorage), so that a repeated click doesn't create two orders. These are cookies and storage strictly necessary for the service: we don't use advertising or analytics cookies, so there is no consent banner. Legal basis: performance of the contract and legitimate interest in the security of your account.

IP address

We process the IP of people who visit the site to limit attempts and protect the store against abuse (temporary counters that last from seconds to minutes); to record sensitive actions, such as creating an order, generating a key, changing the IP and using 2FA, in an audit log that also stores the browser; to find out the country and, with it, decide whether payment in reais is available, which we store on the order; and in the server's technical logs. The country lookup uses a geolocation database that runs on our own server (DB-IP), without sending your IP to third parties. Legal basis: legitimate interest (security and prevention of fraud and abuse) and, for the currency, performance of the contract.

Second factor (2FA)

If you turn on 2FA, we store the authenticator app secret encrypted (AES-256-GCM) and tied to your account, and ten recovery codes that are kept only as a hash (HMAC-SHA256 with a secret server key). The codes are shown only once, when you generate them; we can't read them afterwards. We use this only to check the code on protected actions, such as generating the key and changing the IP. Legal basis: performance of the contract and legitimate interest in the security of the license.

Orders and payment

For each order we store the script, the plan, the currency, the amount, the IP's country, the status and the dates. Payment happens on the page of Stripe, the processor: your card or other payment method data goes straight to them, doesn't pass through our servers and isn't kept by us. We send Stripe the order identifier, the amount, your email (if any) and the page language. Legal basis: performance of the contract and compliance with legal obligations (accounting and tax).

License

To deliver the license, we create a record in our license authenticator with your Discord name and identifier, the script, the plan, the term, the region (Brazil or not) and your server's IP. That IP is reported by the script itself when it runs on your server and is pinned to the license. We keep the history of IP changes (previous IP, date and who made the change) and the date the key was generated. The key is shown only once. Legal basis: performance of the contract.

Support

If you talk to us on Discord, we process what you send to solve your case. Discord processes that data under its own policy.

Who we share it with

• Discord: login and support happen on their platform.
• Stripe: processes payments and receives the data described above.
• Hosting: the site, the database and the authenticator run on servers of a hosting provider in Europe.

We don't sell your data or use it for advertising. We may disclose it when the law or an order from a competent authority requires it. These services may process data outside the European Economic Area, with the safeguards provided by law, such as standard contractual clauses, described in each one's policies.

How long we keep it

• Session: up to 7 days without use or 30 days since creation. Attempt-limit counters: seconds to minutes.
• Account data, licenses and 2FA secret: while the account exists and the license is active, and afterwards only for as long as needed for support and to prove what was sold.
• Orders and payment records: for the period required by accounting and tax law.
• Audit log and the server's technical logs (with IP): for as long as needed for security and abuse prevention.

Once the period is over, we delete the data or make it anonymous.

Your rights

You can request access to your data, correction of anything wrong, deletion, restriction of processing, portability, and object to processing based on legitimate interest, under the GDPR and the LGPD. Just ask through the Furia Store Discord, preferably from the account you sign in with; we reply within one month. Deletion doesn't cover what we're required by law to keep. If you think we process your data improperly, you can also complain to the data protection authority of your country (for example, the CNPD in Portugal or the ANPD in Brazil).

Security

We use an encrypted connection (HTTPS), session cookies that JavaScript can't access, secrets that are encrypted or kept only as a hash, attempt limits and restricted access to the servers. No system is infallible; if an incident puts your data at risk, we'll notify you as the law requires.

Minors and changes

The service is not aimed at children. When this page changes in a relevant way, the update date at the top changes with it; the version in force is always the one published here.