This policy explains how BunyadTech LLC ("ThemeSphere," "we," "us," "our"), a company incorporated in Wyoming, with its principal place of business at Wyoming, USA, collects, uses, and protects information when you visit theme-sphere.com or use any of our products and services (together, the "Site"). We serve customers worldwide, and this policy applies no matter where you are accessing the Site from.
For EU/EEA and UK visitors, we are the data controller for the personal data described here, even though we are based in the US. If you have questions about this policy or want to exercise any of the rights below, contact us at info@theme-sphere.com.
Information We Collect
Automatically, when you visit the Site
IP address, browser type and version, device and operating system, referring page, pages viewed, time on page, and general location derived from your IP. We use this to keep the Site running, spot abuse, and understand usage patterns in aggregate. It is not used to build individual profiles.
When you give it to us directly
- Name and email address (account creation, contact forms, support requests)
- Billing name, address, and payment details when you buy a theme or plugin. Payment card data is processed by our payment processor (for example, Stripe or Paddle) and never touches our own servers
- Account username, password (stored hashed), and support ticket content
- Anything you submit in comments, reviews, or forum posts
When you activate a license
When you enter a license key to activate one of our themes or plugins, the software sends the following back to our licensing server: the license key itself, the domain or site URL where it is being activated, and basic software metadata such as the theme or plugin version, PHP version, and WordPress version running on that site. We use this only to validate that a license is active, enforce the number of sites allowed per license, and push update notifications to you. We do not use it for advertising, and we do not sell it. If you deactivate the license, the associated site URL is removed from your active-sites list. We do keep a log of the activation history tied to your account for support and fraud-prevention purposes, as described under Retention below.
We do not knowingly collect sensitive categories of personal data, such as health, religion, or political views.
Why We Process It
- To create and run your account
- To process purchases and deliver license keys or downloads
- To validate license activations and provide software updates
- To respond to support requests
- To send transactional emails, like receipts, license renewals, or security notices
- To send marketing emails, only if you have opted in (see Newsletters below)
- To detect fraud and abuse, including license key sharing beyond permitted activations
- To meet legal and tax obligations in the US and, where applicable, in your own country
For visitors in the EU/EEA/UK, our legal bases under GDPR are: performance of a contract (processing your order and validating your license so the software you paid for actually works), consent (marketing emails, non-essential cookies), legitimate interest (fraud prevention, license enforcement, site security), and legal obligation.
Who We Share It With
We do not sell personal information. We share it only with:
- Our hosting provider, which hosts the Site, database, and licensing server
- Our payment processor, which processes payments and has its own privacy policy
- Our email service provider, which sends transactional and, if you have opted in, marketing emails
- Our licensing system, which handles license key validation and stores the activation records described above
- Google Analytics (or your actual analytics tool), for aggregated usage statistics. You can opt out through the Google Analytics browser add-on
- Law enforcement or regulators, only when legally required
Each of these processes data under a data processing agreement, and only for the purpose we have hired them for.
California Residents (CCPA/CPRA)
We do not sell or share your personal information for cross-context behavioral advertising. If that changes, we will post a "Do Not Sell or Share My Personal Information" link on this page and update this section.
In the past 12 months we have collected identifiers (name, email, IP), commercial information (purchase and license history), internet activity (browsing behavior on the Site), and technical or device information (site URLs and software versions tied to license activations). You can request:
- Disclosure of the categories and specific pieces of personal information we hold
- Deletion of your personal information, subject to legal exceptions
- Correction of inaccurate personal information
- To not be discriminated against for exercising these rights
Send requests to info@theme-sphere.com. We will verify your identity before acting on the request and respond within 45 days. You can also designate an authorized agent to make a request on your behalf. This section is reviewed and updated at least once every 12 months.
Your Rights (EU/EEA/UK Visitors)
You can ask us to:
- Confirm whether we process your data, and get a copy of it
- Correct inaccurate data
- Delete your data (the "right to be forgotten"), subject to legal retention requirements
- Restrict processing in certain circumstances
- Receive your data in a portable format
- Object to processing based on legitimate interest or direct marketing
- Withdraw consent at any time, without affecting processing already carried out
You can also lodge a complaint with the data protection authority in the EU/EEA country where you live, work, or where you believe an infringement occurred. You do not need to go through us or our EU representative first. A list of national authorities is maintained by the European Data Protection Board.
International Transfers
We are based in the US. If you are contacting us from the EU/EEA, UK, or anywhere else, your data gets transferred to and processed in the US, and possibly other countries where our processors listed above operate. For transfers from the EU/EEA or UK, we rely on Standard Contractual Clauses approved by the European Commission, or an equivalent adequacy mechanism, as the legal basis for that transfer.
How Long We Keep It
- Account data: kept while your account is active, plus 90 days after deletion in case of billing disputes
- Purchase and invoice records: kept for 7 years, in line with IRS recordkeeping guidance for business income records
- License activation records (site URL, license key, software version): kept for the life of the license, plus 12 months after expiry or cancellation, so we can resolve reactivation and support disputes
- Marketing consent records: kept until you unsubscribe, plus proof of consent for 3 years after that
Cookies
We use cookies for three purposes. Strictly necessary cookies (login sessions, shopping cart) are always active and cannot be turned off without breaking the Site. Analytics cookies (Google Analytics) and marketing cookies (for embedded content or ads) only get set after you accept them in the cookie banner.
On your first visit, a consent banner lets you accept or reject non-essential cookies individually. You can change your choice anytime through the cookie settings link in the footer. Rejecting non-essential cookies will not stop you from browsing or buying, it only limits analytics and ad personalization. One thing worth noting: the license activation request your own site sends to our licensing server is not a cookie and cannot be switched off from a browser, since the software itself needs it to check that it is licensed.
Newsletters
Subscribing is opt-in and voluntary. Every marketing email includes an unsubscribe link, and all such emails identify us as the sender, per the CAN-SPAM Act. You will still get transactional emails, like receipts, security alerts, or license expiry notices, even after unsubscribing from marketing, since those are not optional.
Children's Privacy
The Site is not directed at children. We do not knowingly collect personal information from anyone under 13 in the US, or under 16 in the EU/EEA (or a lower age if your own country's law sets one). If you believe a child has given us personal information, contact us and we will delete it.
Security
We use TLS encryption for data in transit, hashed password storage, and restricted access to production systems, including the licensing server that stores activation records. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we review our safeguards regularly.
Data Breach Response
If we discover a breach affecting your personal data, we will notify affected users by email without undue delay. We will notify the relevant EU/EEA supervisory authority within 72 hours where GDPR applies, and any applicable US state attorney general or regulator within the timeframe that state breach notification law requires.
Third-Party Links and Embedded Content
The Site links to other websites we do not control, and our theme demos may include content from Instagram, YouTube, or similar platforms. Their own privacy policies apply once you interact with that content. For our Instagram Photo Feed widget specifically, no data is collected on our end, but Instagram's privacy policy governs the connection itself.
Governing Law
This policy is governed by the laws of Wyoming, USA, without regard to conflict-of-law rules, except where local mandatory consumer protection or data protection law, such as GDPR or CCPA, gives you rights this section cannot override.
Changes to This Policy
We will post the effective date at the top whenever this policy changes. For material changes affecting how we use your personal data, we will notify you by email or with a notice on the Site before the change takes effect.
Contact
ThemeSphere
Operated by BunyadTech LLC
Wyoming, USA
info@theme-sphere.com
The privacy policy terms are subject to change. Please review periodically.