Written to be checked, not to be waved through
Privacy Policy
These are small shops run by one person. The data they hold is the minimum needed to sell you a file and support you afterwards, and this page says exactly what that is, who touches it, and how to get it back or deleted.
Last updated
The short version
We store your Discord account details, your orders and your email, on our own servers in Germany. Card details never reach us — Stripe handles those. Nothing is sold or shared for advertising. No tracking script loads until you say yes, and on most of these shops there is none at all. Email us and your data is exported or deleted.
01Who is responsible
The controller for the data described here is TopserverSystems, a sole trader based in Romania, operated by PiTyUs.
- Email, including for any request under this policy: pityussuperstar@gmail.com
- Discord: support server
There is no separate data protection officer; requests go to the address above and are handled by the operator personally.
02Which sites this covers
This policy covers pityus.net and every shop billing through the same merchant account:
- fivem-minimaps.com — MiniMaps for FiveM
- fivem-weapons.com — Weapon Skins for FiveM
- fivemgraphics.com — FiveM Graphics
- fivemdeals.shop — FiveM Deals
- topserver.dev — TopServer
- fivemloadingscreen.pro — FiveM Loading Screen Maker
- discord-ai.net — DiscordAI
Where one of those sites publishes its own privacy policy, that document describes the detail for that site and this one gives the shared picture. Neither contradicts the other; if you ever find that they do, tell us and we will fix it.
03What we collect, and why
Everything below is collected because something would not work without it. There is no profiling, no automated decision-making with legal effect, and no data broker anywhere in this list.
| Data | Why | Legal basis |
|---|---|---|
| Discord account: user ID, username, display name, avatar and the email on the account | To sign you in, to attach your orders and downloads to an account, and to give you the buyer role on the Discord server | Performance of a contract |
| Order record: what you bought, the price, the discount, the order number, the time, and the designs you built in a studio | To deliver the product, to let you download it again, to answer support, and to keep the books | Contract, and a legal obligation for the accounting copy |
| Email address | To send the receipt, the invoice, the download instructions, and — if you bought something — a single review request | Contract, and legitimate interest for the review request |
| Server logs: IP address, user agent, the pages and files requested, and the time | To keep the sites up, to find faults, to stop scraping and abuse, and to rate-limit the preview tiles | Legitimate interest in running a secure service |
| Support messages you send us, by email or on Discord | To answer you, and to keep a record of what was agreed | Contract, and legitimate interest |
| A review you choose to write, with the display name and avatar of your account | To publish it next to the product, which is the point of leaving one | Consent, which you give by submitting it and can withdraw |
You can browse and read everything on these sites without an account. An account is only needed to buy, to download again, or to use a studio that saves your work.
04Payments: what we never see
Checkout is handled by Stripe Payments Europe, Ltd.. Your card number, expiry and security code are entered on Stripe’s own payment page and never reach our servers. We cannot see them, store them or recover them.
What comes back to us is the result: whether the payment succeeded, the amount, the currency, the last four digits and the card brand, a payment reference, and the billing country Stripe collected for tax. That is what sits in the order record.
Stripe is an independent controller for its own fraud prevention and regulatory obligations. Its policy is at stripe.com/privacy.
06Who processes it for us
- Contabo GmbH (Germany) — the servers everything runs on, including the databases and the files you download.
- Stripe Payments Europe, Ltd. (Ireland) — payments, invoices and receipts.
- Cloudflare — DNS, caching and protection in front of every site. It sees the requests before they reach us.
- Discord — sign-in, the support server, and the buyer role. Your Discord profile comes from them; what you write in the server is governed by their policy too.
- Resend — transactional email, where it is not sent directly from our own mail server.
- Microsoft Clarity and TikTok — only on shops that enable them, and only after consent, as above.
We do not sell personal data, and we do not share it for anyone else’s advertising. Beyond the list above, data leaves us only where the law requires it.
07Where the data goes
The servers are in Germany and the primary payment processor is in Ireland — both inside the European Economic Area.
Cloudflare, Discord, Microsoft and TikTok are international and may process data outside the EEA. Where they do, transfers rely on the European Commission’s standard contractual clauses or an adequacy decision, as set out in each provider’s own terms.
08How long we keep it
- Order and invoice records — kept for as long as tax and accounting law requires. This is the one category we cannot delete on request while that period runs.
- Account and profile — until you ask us to delete it, or the account goes unused for an extended period.
- Designs saved in a studio — until you delete them, or the workspace expires unpaid.
- Server logs — a short rolling window, long enough to investigate an incident.
- Support correspondence — while it is useful for the next question, then deleted.
- A published review — until you ask for it to come down.
09Your rights
If the GDPR applies to you, you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw a consent you gave.
Email pityussuperstar@gmail.com from the address on your account, or open a ticket on Discord from the account concerned. We will answer within thirty days, normally far sooner, and we will not charge you for it.
The only thing we will push back on is deleting an invoice inside its statutory retention period — that one is not ours to give away. In that case we restrict it instead: it stays in the books and comes out of everything else.
10How it is protected
- Everything is served over HTTPS, with HSTS and a strict content security policy.
- Passwords are not stored at all, because sign-in goes through Discord rather than a password of ours.
- Payment pages are Stripe's, not ours.
- Download links are tied to the account that bought the product.
- Access to the servers is by key, and the secrets that applications need are kept outside the code.
No system is perfect. If you believe you have found a vulnerability, email us before publishing it and we will work with you — a quiet report gets fixed faster than a public one.
11Age
These shops are not aimed at children. You need a Discord account to buy, and Discord sets its own minimum age. If you believe a child has given us personal data, tell us and we will remove it.
12Changes
When this policy changes, the date at the top changes with it and anything material is announced in the Discord server. We will not quietly start doing something this page says we do not do.
13Complaints
Come to us first — email is the fastest route and most things are fixed the same day.
You also have the right to complain to a supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP). If you live elsewhere in the EEA you may complain to the authority in your own country.
The commercial side of your purchase is covered by the terms of service, and how to reach us about an order is on the support page.