Data processing agreement

On this page

• 1. Roles
• 2. What is processed
• 3. What we commit to
• 4. Security
• 5. Other processors
• 6. Transfers outside the European Economic Area
• 7. Requests from players
• 8. Deletion
• 9. Breaches
• 10. Checking on us
• 11. Liability and term

In force from 21 October 2026.

1. Roles

You, the holder of the FiveSpoof account, are the controller of your players' data. We, the makers of FiveSpoof, are your processor. We process the data only on your documented instructions. These terms, your settings in your account and the bans you make on your server are those instructions.

For one purpose we are a controller ourselves: improving how FiveSpoof recognizes returning players. Our basis for it is our legitimate interest in recognizing returning players reliably. Players are told about it on the card shown before they join, before anything is read from their game, and we answer for that use directly.

2. What is processed

3. What we commit to

• We use the data of your players to protect your server and, as described in section 1, to improve recognition. We do not use it for marketing, sell it, or pass it to other customers.
• Everyone who can access the data on our side is bound to confidentiality.
• We tell you if we believe an instruction of yours breaks data protection law.
• We help you answer players' requests and assess the impact of the processing.

4. Security

• Identifiers, device information and the player's IP address and network are stored encrypted, with keys kept apart from the database, so that we can check and improve recognition. Matching uses keyed hashes specific to your server, and one server's data never decides on another server.
• What is read on the player's device is encrypted there and can only be opened by our service. Your server passes it on without being able to read it.
• Requests between your server and us are signed, time limited and usable once.
• Each customer's data is separated in every query. Access to production is limited to the people who operate the service.

5. Other processors

You give us general permission to use other processors. At the moment there are three:

• Cloudflare: computing and the database. The database is stored in the European Union. Requests may be handled at Cloudflare locations elsewhere on the way.
• Discord: hosts our support server, where you write tickets.
• An AI service: drafts answers to support tickets. It sees only what is written in the ticket and the status of your own servers, so leave player details out unless a person from FiveSpoof asks for them.

We tell you in your account at least 30 days before adding or replacing a processor. If you object for a reason related to data protection and we cannot solve it, you may end the agreement and get the unused part of your period refunded.

If you connect a Discord channel in your account, we send the name, account and code of each blocked player to that channel. That is a transfer you instruct us to make, and Discord acts for you there, not for us.

When a player's FiveM account is linked to Discord, your account shows that Discord account on the player's cases and in Player data. To show its current public name and picture, we ask Discord for them with the account's id, at most once a day per player, and keep them and a copy of the picture encrypted with the player's other data. They are deleted with it.

6. Transfers outside the European Economic Area

The data is stored in the European Union. Where a processor handles it elsewhere, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision. If you are established outside the European Economic Area, the standard contractual clauses for transfers from a processor to a controller apply between us.

7. Requests from players

• Your account has a tool for looking up one player and producing a copy of what is stored about them.
• If a player writes to us directly, we send them to you and tell you about it.
• A block by FiveSpoof is checked again every 7 days and lasts only while the ban it is linked to stands. You make sure a person on your staff reviews it when the player asks.
• We do not disclose how detection works to players or customers. If an authority or a court requires it, we provide it to them in confidence.

8. Deletion

• Deleting a server in your account deletes everything stored for it at once.
• Without that, a player's data is deleted at the latest 24 months after their last visit, and cases and ended bans 24 months after they happened or ended. We keep it that long to check and improve recognition. Nothing is deleted while a ban or block on the player stands, and a decision by your staff to let a player in stays until your staff undo it.
• When your plan, the free tier or the free trial ends, the data stays under the same schedule until you delete the server.

9. Breaches

If your players' data is breached on our side, we tell you without undue delay and at the latest within 48 hours of learning of it: what happened, which data, what we have done and what we suggest you do.

10. Checking on us

On request we give you the information needed to show that we keep this agreement, in writing. Where the law requires more, you may have an independent auditor bound to confidentiality inspect the relevant controls, once a year, at your cost and with 30 days' notice. The detection logic itself is a trade secret and is shown only to an authority or a court.

11. Liability and term

The liability terms of the terms of service apply to this agreement as between you and us. They do not limit what either of us owes to players under the law. This agreement lasts as long as we process your players' data.