Privacy policy

Privacy Policy for ThemeShopy

Last updated: July 6, 2026
Effective date: July 6, 2026

1. Who we are

ThemeShopy (“we”, “us”, “our”) is a digital themes and templates provider operating from Nagpur, Maharashtra, India. We are the data controller for personal data collected via our website https://www.themeshopy.com/ and related services (collectively, the “Site”).

Contact: help@themeshopy.com
Privacy contact: help@themeshopy.com (for privacy requests and questions)

2. Scope of this policy

This Privacy Policy explains how we collect, use, share, protect and retain personal data when you:

  • visit or use the Site;
  • purchase, download or request support for our digital themes/templates;
  • subscribe to our mailing list or marketing communications;
  • contact us by email, social media or support channels; or
  • apply for employment with us (if applicable).

The Site may contain links to third‑party websites or services (e.g., Shopify, payment processors, social media). Those third parties have their own privacy policies and practices; we are not responsible for them.

3. Personal data we collect

We may collect and process the following categories of personal data:

3.1 Information you provide directly

  • Account and contact data: name, email address, billing/shipping address (if applicable), phone number, country of residence.
  • Purchase and transaction data: order details, payment information (processed via third‑party payment processors), invoice/billing details, transaction IDs, license keys.
  • Support and correspondence: messages sent to help@themeshopy.com, support forum posts, tickets, chat logs, and any attachments or screenshots you provide.
  • Marketing preferences: opt‑in choices for newsletters, product updates, and promotional offers.
  • Job applications (if applicable): resume/CV, cover letter, education and employment history, and other details you choose to provide.

3.2 Information collected automatically

When you use the Site, we and our service providers may automatically collect:

  • Device and technical data: browser type and version, operating system, device type, screen resolution, IP address, time zone, language settings.
  • Usage data: pages viewed, time spent, clickstream, navigation paths, referral URLs, search terms, download actions, and interaction with emails (e.g., opens and clicks via web beacons/pixels).
  • Location data: approximate geographic location derived from IP address or coarse device location.
  • Demographic/interest data: where provided by third parties or inferred from your Google account settings and similar sources.
  • Cookie and identifier data: cookie IDs, advertising IDs, and similar identifiers set by us or our partners.

We may combine automatically collected data with data you provide to personalize your experience, improve the Site, and serve relevant content and advertising.

4. How we use your personal data

We use personal data for the following purposes, as permitted by applicable law:

  • To provide and manage our services: process orders, deliver digital products (themes/templates), manage licenses/updates, provide customer support, and communicate about your account or purchases.
  • To communicate with you: respond to inquiries, send service‑related notices (e.g., order confirmations, security alerts, support updates), and provide requested information.
  • To improve the Site and our products: analyze usage patterns, test features, fix bugs, conduct research, and develop new themes, templates and functionality.
  • To personalize your experience: remember your preferences, tailor content and recommendations, and customize the Site based on your interests and past interactions.
  • Marketing and promotions (with consent where required): send newsletters, product announcements, special offers, and targeted advertising via email, SMS, social media and other channels; measure the effectiveness of our campaigns.
  • Security and fraud prevention: detect, investigate and prevent fraudulent transactions, abuse, security incidents, and other harmful activities; verify identities and protect our rights and property.
  • Legal and regulatory compliance: comply with applicable laws, tax and accounting obligations, respond to legal requests, enforce our terms of service, and protect our legal rights.
  • Business operations and transfers: in connection with audits, advisors, financing, mergers, acquisitions, reorganizations, or sale of assets, where personal data may be transferred as a business asset.

5. Legal bases for processing (for EEA/UK and similar jurisdictions)

Where required by law (e.g., GDPR), we rely on the following legal bases to process your personal data:

  • Performance of a contract: to fulfill your orders, deliver digital products, provide support, and administer your account.
  • Legitimate interests: for site security, fraud prevention, analytics, product improvement, direct marketing (subject to your rights to object), and general business operations.
  • Consent: where we ask for your explicit consent (e.g., certain marketing communications or cookies where required).
  • Legal obligation: to comply with applicable laws, regulations, court orders, or governmental requests.

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

6. Cookies and similar technologies

We use cookies, web beacons, pixels, log files and similar technologies to:

  • enable essential Site functionality (e.g., shopping cart, authenticated sessions);
  • remember your preferences and settings;
  • analyze Site usage and performance (e.g., via Google Analytics);
  • deliver and measure advertising and retargeting (e.g., Google Ads remarketing, Meta/Facebook Pixel);
  • track email interactions (opens/clicks) to improve our communications.

You can manage cookie preferences through your browser settings or any cookie consent tool we provide. Disabling certain cookies may limit your ability to use some features of the Site.

For more information and opt‑out options:

  • Google Analytics: https://tools.google.com/dlpage/gaoptout
  • Google Ads settings: https://adssettings.google.com/
  • Meta (Facebook) ad preferences: https://www.facebook.com/ads/preferences/
  • Industry opt‑out tools (e.g., DAA/EDAA): available via your local digital advertising alliance.

7. Who we share personal data with

We may share your personal data with the following categories of third parties, for the purposes described above:

  • Service providers and processors:
    • Analytics and advertising: Google Analytics, Google Ads, Meta (Facebook) Pixel and related ad networks.
    • Email and marketing: providers such as Mailchimp, SendGrid or similar services.
    • Payment processing: Stripe, PayPal and other payment gateways.
    • Cloud, hosting and infrastructure: providers such as AWS, Google Cloud, Azure, or similar hosting and CDN services.
    • Customer support and CRM: ticketing systems, live chat, and CRM platforms.
    • Data storage and backup providers.
  • Professional advisors: legal, financial, tax, audit and business advisors.
  • Affiliates and related entities: parent, subsidiary or affiliated companies involved in our operations.
  • Legal and regulatory authorities: where required by law, court order, governmental request, or to protect our rights, safety, or the rights and safety of others.
  • Business transfer counterparties: in connection with a merger, acquisition, sale of assets, financing, or other corporate transaction, personal data may be transferred as part of the due diligence and closing process.

Our service providers are contractually required to use your data only on our instructions and to implement appropriate security measures.

8. International transfers of personal data

We operate from India but use service providers and infrastructure located in various countries, including the United States, Canada, the European Union and others. As a result, your personal data may be transferred to, stored, and processed in countries other than your country of residence.

Where personal data is transferred internationally, we take appropriate safeguards, such as entering into standard contractual clauses or other legally approved transfer mechanisms, and requiring recipients to protect your data in line with this policy and applicable law. By using the Site, you acknowledge and agree that your personal data may be transferred to such countries.

9. How long we keep your personal data

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Our standard retention periods are:

  • Account and customer data: while your account is active and for up to 3 years after your last purchase or interaction, unless a longer period is required by law or needed for legitimate business purposes.
  • Transaction and financial records: typically 7 years from the date of transaction, to comply with tax, accounting and legal obligations.
  • Support and correspondence: generally 3 years from the date of the last communication, or longer if needed to resolve ongoing issues or comply with legal requirements.
  • Marketing lists: until you unsubscribe or request deletion, or after 2 years of inactivity (whichever is earlier), unless you re‑engage.
  • Analytics and log data: typically retained in aggregated or pseudonymized form for up to 26 months (or as configured in our analytics tools), unless a longer period is required for security or legal reasons.
  • Job application data (if applicable): generally 12–24 months from the application date, unless you consent to longer retention for future opportunities.

When personal data is no longer needed, we delete or securely destroy it, unless we must retain it for legal, regulatory, or legitimate business purposes (e.g., dispute resolution, fraud prevention).

10. Your rights and choices

Depending on your location and applicable law, you may have some or all of the following rights:

  • Access: request a copy of the personal data we hold about you.
  • Correction: request correction of inaccurate or incomplete data.
  • Deletion: request deletion of your personal data, subject to certain exceptions (e.g., legal obligations, ongoing disputes).
  • Restriction or objection: request restriction of processing or object to certain processing (e.g., direct marketing).
  • Data portability: receive your data in a structured, commonly used, machine‑readable format and, where feasible, transmit it to another controller.
  • Withdraw consent: withdraw consent where processing is based on consent, without affecting prior lawful processing.
  • Opt‑out of marketing: unsubscribe from marketing emails via the “unsubscribe” link or by contacting help@themeshopy.com.
  • Do not sell or share (where applicable): in jurisdictions that recognize such rights (e.g., certain US states), you may opt out of “sale” or “sharing” of personal data for targeted advertising.

To exercise your rights, please email help@themeshopy.com with a clear description of your request. We may need to verify your identity before responding and will respond within the timeframes required by applicable law.

We do not discriminate against you for exercising your privacy rights.

11. Security of personal data

We implement commercially reasonable technical, organizational and administrative measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including:

  • encryption in transit (e.g., HTTPS/TLS);
  • access controls and authentication;
  • secure development practices and regular security updates;
  • monitoring for suspicious activity and potential breaches.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we will notify you and relevant authorities of data breaches as required by law.

12. Children’s privacy

Our Site and services are not intended for children under the age of majority in their jurisdiction (or under 13/16 where specified by local law). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that data and, if necessary, terminate the relevant account.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or our services. We will post the updated policy on this page with a new “Last updated” date. Material changes will be communicated via notice on the Site or by email where appropriate and required by law. We encourage you to review this policy periodically.

14. Contact us

If you have questions, concerns, or requests about this Privacy Policy or our data practices, please contact us:

For privacy‑specific requests (access, deletion, correction, etc.), please clearly state “Privacy Request” in your email subject line.