Privacy Policy
What personal data we handle, why, for how long, who processes it with us, and how you exercise your rights under the GDPR, the CCPA and the LGPD.
Contents, 14 sections
In short
- We collect the minimum to deliver what you bought: your Discord ID and name, the email you type at checkout and what you send to support.
- We never ask for ID numbers, phone, address or card details, and we do not sell your data or share it for advertising.
- The site has no analytics, no ad pixels and no tracking cookies.
- You can access, correct, export or delete your data by writing to [email protected].
Who we are and what this covers
Aqua Nuis is the controller of the personal data handled by the site aquanuis.com, the Central, the store, the Aqua Bot service, the Aqua Staff bot (our official bot on Discord) and our support.
For anything about your data, write to [email protected] with the subject Privacy.
This policy does not cover the data that your own server handles with our scripts (see Players on your server), nor the services of Discord, Cfx.re, Tebex and Mercado Pago, which have their own policies.
What we collect
| When | What | What for |
|---|---|---|
| You sign in to the Central | Your Discord ID and username. The list of servers you are in is read at sign-in only, to know which ones you manage. We do not ask Discord for your email. | Your account and your access |
| You start a checkout | The email you type and the items in your cart. | Finishing the purchase, and the emails described in How we use it |
| You buy the Aqua Bot | The email you type at checkout. | Sending the code, the receipt and the expiry notices |
| You buy a script | Your Cfx.re login, done at Tebex, and your IP address, which Tebex requires. Of the IP we keep only a cryptographic hash, never the address. | Delivery to your Cfx.re account and fraud prevention |
| You contact support | The subject, the messages, the attachments you send and your rating. | Answering you |
| You use the Aqua Bot panel | Your server's name, icon, channels and roles, the settings you save, and the Discord ID of each person you give panel access. | Running the bot |
| Your members use the allowlist | The candidate's Discord ID and name, character name and answers. A linked player's FiveM license is kept only as a hash. | The allowlist of your server |
| Your members open tickets | Who opened, who took part, when, the category and the rating. The text of the conversation is not kept by us. | Ticket history and metrics |
| You write a testimonial | Rating, text, display name and server, only when you choose to publish. | Showing reviews on the site |
| You open a product page | A hash of your IP address and browser, made with a key that changes every day. | Counting how many people viewed the page, without cookies |
What we do not collect
We do not ask for ID numbers, phone, address or date of birth. Card details are typed at Mercado Pago or Tebex and never pass through us.
The site has no analytics tool, no ad pixel and no third-party tracking.
How we use it
- To deliver what you bought, keep your subscription running and give you support.
- To keep our services secure and prevent fraud and abuse, for example by limiting orders per email and per IP.
- To show counts on product pages, such as how many people viewed a product today or how long ago a city bought it, without identifying anyone.
Emails
Besides receipts, codes and expiry notices, if you typed your email at one of our checkouts or bought from us, we may email you about your cart, your purchase, your renewal and products like the ones you looked at. Every email says why you are receiving it and has a one-click unsubscribe, and the unsubscribe stays in effect.
Messages on Discord
Aqua Staff, our official bot, sends direct messages only to people who linked Discord to the Central and are in our server, and only for three things: a cart reminder, if you asked for it on the site; a check after a purchase, to see if the installation went well; and the end of a subscription. It never sends ads or coupons by message, and every message has a Stop button that works.
Legal bases
Each use of your data rests on a legal basis of the GDPR and of the LGPD:
| Purpose | GDPR | LGPD |
|---|---|---|
| Your account, delivering products, subscriptions and support | Contract, Art. 6(1)(b) | Contract, Art. 7, V |
| Sales and payment records | Legal obligation, Art. 6(1)(c) | Legal obligation, Art. 7, II |
| Security, fraud prevention, visit counts, and emails to people who have a relationship with us | Legitimate interests, Art. 6(1)(f) | Legitimate interest, Art. 7, IX |
| Publishing your testimonial and cart reminders on Discord | Consent, Art. 6(1)(a) | Consent, Art. 7, I |
You can withdraw a consent at any time, and you can object to the emails about our products at any time, with the unsubscribe link.
Who processes data with us
We use these providers to run our services. Each one receives only what its job needs:
| Provider | What it does for us | What it receives |
|---|---|---|
| Supabase | Database, sign-in and support attachments | The data in this policy |
| Mercado Pago | Payment for the Aqua Bot | Your email and the order |
| Tebex | Payment for scripts | Your IP address and your cart |
| Cfx.re | Sign-in and delivery of scripts to your account | Your Cfx.re account |
| Discord | Sign-in, the bots and direct messages | Your Discord ID |
| Resend | Sending emails | Your email and the message |
| Square Cloud | Hosting of the site and of our bots | The data passing through them |
| Cloudflare R2 | Storage of the media you upload for the loading screen | The files you upload |
International transfers
Some of these providers process data outside your country, including in the United States and in Brazil. The transfer happens to perform the contract with you, as GDPR Art. 49(1)(b) and LGPD Art. 33, IX allow, and under the data protection terms each provider offers.
How long we keep it
| Data | How long |
|---|---|
| Aqua Bot tickets | Deleted 180 days after the ticket closes |
| Allowlist | Answers are removed 30 days after the decision, and applications are deleted after 90 days |
| Aqua Bot panel audit log | 180 days |
| A server without an active Aqua Bot subscription | Its settings, tickets and allowlist are deleted 90 days after the last subscription ends |
| Visit counts | The daily key is deleted the next day, and the hashes after 8 days |
| Email list | Until you unsubscribe. We keep the record of the unsubscribe, so it stays in effect |
| Orders, payments and receipts | For as long as tax and consumer law require |
| Account and support | While your account exists, or until you ask us to delete it, except what the law requires us to keep |
Your rights
In the European Union, the EEA and the United Kingdom
Under the GDPR you can ask for access to your data, correction, erasure, restriction and portability, object to processing based on legitimate interests, object to direct marketing at any time, withdraw a consent, and complain to the data protection authority of your country.
In California
Under the CCPA, as amended by the CPRA, you can ask to know what we collect, to delete it and to correct it. We do not sell or share personal information, and we do not use sensitive personal information to infer anything about you. We will not treat you differently for using these rights. We honor these requests whether or not the law applies to us.
In Brazil
Under the LGPD you can ask for confirmation that we process your data, access, correction, anonymization, blocking or deletion, portability, the list of who we share it with, and withdraw a consent. You can also complain to the ANPD, the Brazilian data protection authority.
How to make a request
Write to [email protected] with the subject Privacy, or ask through support in the Central. We may confirm that the request is yours through your linked Discord account, and we reply within 15 days. Someone you authorize may make the request for you.
Players on your server
Our scripts run on your server and write to your database. With Aqua Logbook turned on, your server records data of your players, such as license, Discord, Steam, IP address and game events, for as long as you configure.
In that case, you, the server owner, decide how that data is used, and it is up to you to inform your players. Aqua Nuis does not receive a copy of those records.
The same goes for the members of your Discord server: the Aqua Bot handles their tickets, allowlist and moderation on your behalf, as you configure it. If a member asks us about their data, we help you answer.
Children
Our services are not directed at children under 13, or under 16 in the European Union, and we do not knowingly collect their data. Buying requires being 18 or having a guardian's permission. If you believe a child sent us data, write to us and we will delete it.
Security
Your data is stored in a database with row-level access control, support attachments sit in private storage behind links that expire in 60 seconds, and player licenses and IP addresses are kept only as cryptographic hashes.
No system is unbreakable. If an incident affects your data, we will tell you and notify the authorities, as the law requires.
Changes to this policy
We update this policy when our products or the law change, and the date at the top changes with it. A change that affects your rights is announced in advance, by email or in the Central.
Contact
- Privacy: [email protected], with the subject Privacy.
- Support: in the Central, under Support.
Questions about our policies?
Write to [email protected] or talk to our team in support.