Privacy Policy

Z-Lab Engine · MANTIS · ANUBIS Last updated: 20 August 2026

The short version

The software runs on your computer and does not report back to us. There is no analytics, no telemetry, no usage tracking and no licence check phoning home. We cannot see your server, your files, your players or your database.

The things we *do* know about you come from buying (an order and an email address, handled by the store) and asking for help (whatever you tell us).

Two optional features send something to an AI service run by Google, and only when you choose to use them: explaining a conflict sends a short description of that conflict, and diagnosing from a screenshot sends the picture you upload. Both are described in full below, because the second one deserves your attention before you use it.

The detail is below, including the parts where data leaves your machine to go somewhere that is not us.

1. Who is responsible for your data

Surika Elizabeth Ozoh, trading as Z-Lab Engine, a sole proprietor in South Africa, is the responsible party (under South Africa's Protection of Personal Information Act, "POPIA") and the data controller (under the UK and EU GDPR, where those apply). Z-Lab Engine is not a registered company, so there is no company registration number to quote, and a full postal address is provided on request.

Information Officer: Surika Elizabeth Ozoh, reachable at biankariven@gmail.com.

2. What the software does on your computer

This is the part most people actually want to know, so it comes first.

It does not send us anything

The Products contain no analytics, no telemetry, no crash reporting and no usage statistics. They do not contact a Z-Lab Engine server, and they do not need an internet connection to us in order to run. This was verified against the source code on 13 August 2026 by listing every outbound connection the software can make.

Your server files, your resources, your maps, your database contents and your players' data stay on your machine. We never receive a copy.

What the software does connect to

All of these are downloads *from* somewhere, or connections *to a system you control*:

| Destination | Why | What is sent | |---|---|---| | Cfx.re / FiveM servers | Download the FiveM server runtime | Nothing about you beyond an ordinary web request | | GitHub | Download the framework and resources for a new server | As above | | MariaDB | Download the database installer | As above | | Microsoft's package installer | Install optional tools you choose (an SFTP client, a database viewer) | As above | | Your own server, over SSH/SFTP | Read or write your server's files, if you connect one | The credentials you entered, sent to your host | | Your hosting provider (only if you use the VPS feature) | Create or manage a server on your account | The API key you entered, sent to that provider |

We are not a party to the last two. Those are your systems and your accounts, reached with your own credentials, which the software holds in memory for the session and does not transmit to us.

The optional AI features

Some Products can use an AI service provided by Google to explain a problem in plain English. There are two such features, and both run only when you ask them to. If you never use them, nothing is ever sent.

1. Explaining a conflict.

• What is sent: a short description of the conflict — file names, resource

names, file types, and counts such as "three resources ship this file".

• What is not sent: the contents of your files, your database, your server

configuration or your players' data.

2. Diagnosing from a screenshot.

If you upload a screenshot to be diagnosed, the image itself is sent to Google so it can be read. Please understand what that means in practice: a screenshot of your game or your server shows whatever was on your screen when you took it — which may include chat, player names, your server's interface, or anything else visible at that moment.

• What is sent: the image you chose, and nothing else.
• Look at the picture before you send it. If something in it is private,

crop it or do not use the feature.

For both features: the data goes to Google's generative AI service and is handled under Google's terms. We do not keep a copy, and we do not use anything you send to train anything of our own.

3. What we collect, and why

When you buy

The Products are not currently offered for sale. When they are, payment will be taken by a third-party payment provider acting as seller of record. They take the payment; we never see your card details. From them we would receive your order details and the email address you used, so that we can deliver your licence and support you. That provider will be named here before any sale is taken.

• Lawful basis: performance of our contract with you.
• Kept for: as long as needed for support and warranty, and thereafter as long

as tax law requires us to keep records of sales.

When you join our community server

Support runs on Discord. If you join, we can see your Discord username, ID, avatar and the messages you send in our channels. Discord is a separate company with its own privacy policy, and your relationship with them is not something we control.

• Lawful basis: our legitimate interest in supporting our users.
• Kept for: as long as the messages remain in the channel.

When you contact us for help

Whatever you choose to send us: your description of the problem, screenshots, log extracts, and — if you use the built-in diagnostics — a report you copy and send deliberately.

Diagnostic reports are never sent automatically. The software prepares one and puts it on your clipboard; you decide whether to send it, and to whom. A report may contain file paths, resource names, version numbers and error messages from your machine. Read it before you send it, and remove anything you would rather we did not see.

• Lawful basis: performance of our contract, and our legitimate interest in

fixing our software.

• Kept for: up to 24 months, so we can recognise a recurring problem.

If you download a free Product through a sign-in

We plan to make the free Product available through a Discord sign-in. This is not live yet. When it is, we will receive your Discord ID, username and, if you authorise it, your email address, in order to give you the download and tell you about updates. This section will be activated with the exact detail at that time, and we will not backfill it quietly.

4. What we do not do

• We do not sell your personal information. Not to anyone, at any price.
• We do not use it for advertising, profiling or automated decision-making.
• We do not track you across websites.
• We do not read your server, your files or your database.

5. Who else sees your data

Only the parties needed to run the business:

• Our payment provider, once the Products go on sale — payment, invoicing,

order records. It will be named here before any sale is taken.

• Discord — if you join our community server.
• Google — the conflict descriptions and any screenshot you upload for

diagnosis, as described in section 2, and only when you ask for one of those two things.

• Our email provider — if you write to us.
• Professional advisers or authorities — if the law requires it.

Some of these are outside South Africa. Where personal information is transferred abroad, we rely on the recipient being subject to laws or binding agreements that provide comparable protection, as POPIA section 72 requires, and on the standard contractual clauses or equivalent safeguards under GDPR where it applies.

6. Security

We keep what little we hold to a minimum, which is the most effective security measure available to a small business.

Credentials you enter into the software — SSH passwords, database passwords, hosting API keys — are held in memory for your session and sent only to the system you are connecting to. They are not transmitted to us.

One thing we would rather say than have you discover: a server folder built by our software contains a database password in its configuration file, because a FiveM server needs one to work. That file lives on your machine. If you zip your server folder and send it to someone, you are sending them that password. Recent versions scope it to that server's own databases rather than your whole database system, which limits the damage, but the caution stands.

7. Your rights

Under POPIA, and under GDPR where it applies, you may:

• ask what we hold about you, and get a copy;
• correct anything wrong;
• delete it, where we do not need it for law or contract;
• object to processing based on legitimate interest;
• withdraw consent where we relied on consent;
• take your data elsewhere in a portable form;
• complain to a regulator.

Write to biankariven@gmail.com. We will answer within 30 days. We do not charge for a reasonable request.

In South Africa you may complain to the Information Regulator (inforeg@justice.gov.za). In the EU or UK, to your national data protection authority.

8. Children

The Products are not aimed at children. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, write to biankariven@gmail.com and we will delete it.

9. Changes to this policy

If we change how the software handles data, this policy changes in the same release — not afterwards. Material changes will be announced in our community server and the date at the top will change. We will not quietly expand what we collect.

10. Contact

Surika Elizabeth Ozoh, trading as Z-Lab Engine Privacy, data requests, general and support: biankariven@gmail.com South Africa — a full postal address is provided on request.