Skip to content
Legal

Privacy Policy

Last updated: 22 October 2026

1. Who we are

This Privacy Policy explains how Themeasy ("Themeasy", "we", "us") collects and uses personal data when you use our Services: the website themeasy.co (the "Site"), the Themeasy Hub at hub.themeasy.co (the "Hub"), the template library at library.themeasy.co and its service at cms.themeasy.co (the "Library"), our theme demos, each at its own address such as achroma.themeasy.co (the "Demos"), and the Themeasy plugin, including Themeasy Lite, and the Themeasy themes (the "Software").

We are the controller of this data: we decide how and why it is processed. Section 17 says who we are and how to reach us. This policy applies wherever you live, and section 9 explains the rights that the European GDPR, the Brazilian General Data Protection Law (LGPD) and other laws give you.

2. In short

  • We do not sell your personal data, show you personalized ads or track you across other websites. With your consent, we measure which of our own ads lead to visits and purchases.
  • The Software sends us nothing about your site or its visitors unless you use a feature that needs it: the Library, license activation, updates through the Hub, or an opt-in.
  • Direct purchases are sold and charged by Freemius, our merchant of record, and ThemeForest purchases go through Envato. We never see your full card details.
  • Analytics and the measurement of our ads, on our websites, the Demos and the Hub, run only if you accept them.

3. When you visit our websites

On themeasy.co and library.themeasy.co:

  • Technical data. Our hosting providers record your IP address, browser and device details, the pages you request and when, in server logs used to deliver the websites and keep them secure.
  • Your preferences. Your light or dark theme and your cookie choice stay in your browser (see our Cookie Statement).
  • Sign-in status. If you are signed in to the Hub, our websites ask the Hub whether you are, to show your name and the content your plan includes. The Library keeps your account name and that status in your browser so the page does not flicker. This request goes to the Hub, which may record it as described in section 5.
  • Analytics, only with your consent. If you accept analytics cookies, Google Analytics measures how the websites are used, in aggregate: pages viewed, approximate region, device type, and whether your visit came from one of our ads. If you then buy, see section 6.
  • Web fonts. Adobe Fonts serves our fonts, so your browser connects to Adobe, which receives your IP address.

If you email us, we receive your email address, your name if you include it, and your message, and we use them to answer you.

If you join the Themeasy Lite waitlist on themeasy.co, the Hub keeps your email address for one purpose: to send you a single email when Themeasy Lite is available on WordPress.org. We then delete it.

If you review Themeasy on themeasy.co, the Hub keeps your rating, your review, the theme you chose and, if you give them, your name and email address. We read reviews to improve the Services and use your email address only to reply to you. We publish a review, with the name you gave, only if you tick the box that allows it.

On the Demos, which show each theme with sample content, our hosting providers keep the same server logs, and your cookie choice is the one you make on our other websites (the Demos ask for it in the theme bar at the bottom of the page). If you accept analytics cookies, Google Analytics measures the Demos as it does our websites, and also records which theme you are viewing and whether you open its documentation, the Pro plan or its checkout. Once the page has loaded, the Buy button loads Freemius's checkout script from checkout.freemius.com, so the checkout can open over the Demo: your browser connects to Freemius, which receives your IP address, and what you enter at checkout goes to Freemius (section 6). A theme's web fonts may come from Google Fonts, which receives your IP address. On the store Demos, a sample cart, wishlist or currency you choose is kept, linked to a cookie, only to show it back to you: nothing is sold or shipped.

4. When you use the Library from the Themeasy plugin

The Themeasy plugin connects to the Library only after you click the Themeasy button in the Elementor editor. Nothing is sent before that.

  • Your site's server sends our library service (cms.themeasy.co) the categories, tags and search words you choose, and requests the templates you insert. WordPress identifies itself in each request with your site's address, and our hosting provider sees your server's IP address.
  • If your plan includes the cloud Library (Pro or Agency), the plugin also sends your license ID and license key when you insert a template, so that we can check the license with Freemius. We keep only a short-lived verification result (12 hours if the license is valid, 1 hour if not), stored under a one-way hash, never the key itself.
  • Your browser loads the template preview images from our servers, which receive your IP address and browser details. An inserted template can keep using sample images hosted on our servers until you replace them; when your visitors load those pages, our servers receive their IP address and browser details.
  • Our library service does not store your search words or your site's address in its database. They appear only in our hosting provider's server logs, which are kept for a limited time for security and troubleshooting.

5. When you use the Hub

  • Account. Your name, email address and password (stored hashed), and optionally a profile photo, language, time zone and notification preferences. If you sign in with Google, Envato or GitHub, we receive your basic profile from that provider (such as name, email address, username and picture) and keep its access tokens, encrypted, to keep you signed in.
  • Security. The date, IP address and browser of each sign-in, and your active sessions, to protect your account and detect misuse. Two-factor authentication is available.
  • Licenses and purchases. Your licenses, plans, subscription status and purchase history, which Freemius sends us when you buy, renew or cancel, including your name and email address but never your full card details.
  • ThemeForest purchases. When you claim a purchase, or sign in with Envato, we ask Envato to verify the purchase and keep its details (such as the item, your Envato username, and the purchase and support dates). When you activate a theme from its setup wizard and agree to it, the theme sends us the purchase code, your site's domain, and your name and email address. We then create your Hub account and register a license for your site with Freemius under that name and email address, so that it can deliver updates. We keep the purchase code only as a one-way hash.
  • Downloads and updates. Which releases you download, with the date and IP address; and, for sites that receive updates through the Hub, the site's domain, the installed version, an installation ID and the license key, to deliver updates and apply the license's site limits.
  • Support. The messages you send us through the Hub or by email, their attachments, the email headers that come with them, and any satisfaction rating you give. Emailing support creates a Hub account for your address if you do not have one, so you can follow the conversation.
  • AI-assisted support. When these features are enabled, reply drafts, ticket triage, summaries and the help chat send the text of the ticket or chat to AI providers (Anthropic, OpenAI or Voyage AI). Before sending, we mask email addresses, card-like numbers, IP addresses and license keys. You can opt out in your account settings.
  • Emails. Messages about your account, licenses and tickets; product announcements, which you can turn off in your notification settings; and our newsletter, only if you turn it on.
  • Documentation feedback. When you rate a help article, we store a one-way hash of your IP address and browser, not the IP address itself.
  • Feedback board. The ideas and comments you post on the Hub's feedback board, and your votes.
  • Status page. If you subscribe to updates about the status of our services, your email address and the services you follow.
  • Analytics, only with your consent. If you accept analytics cookies, Google Analytics also measures how the Hub is used, in aggregate, as on our websites (section 3). The Hub holds your account, so there we send less: analytics never loads on the pages where you set a new password, verify your email address or enter a two-factor code to sign in, or while a member of our staff is signed in; the page address it reports leaves out the query string, except campaign parameters; pages behind sign-in report a generic page name instead of their title; and we send no user ID.

6. When you buy

Freemius, Inc. (United States) sells our plans and direct theme licenses as our authorized reseller and merchant of record: it is the seller on your invoice. At checkout you give Freemius your name, email address, billing address and payment details. Freemius uses them to take the payment, prevent fraud, apply and remit taxes and issue your invoice, under its own privacy policy.

Freemius also runs licensing for us and, in that role, processes customer data on our behalf. It sends us your name, email address, license, plan and the status of your payments and subscription, never your full payment details.

ThemeForest purchases are made on Envato Market, where Envato takes the payment and handles the purchase data under its own privacy policy. Section 5 describes what we receive from Envato.

Measuring our ads. If you accepted analytics cookies, then when you come back from checkout to the Hub, the Hub links your purchase to the identifiers in your Google Analytics cookies. When the payment is confirmed, it sends Google Analytics the order number, the product, the amount and the currency, and later any refund. It never sends your name, email address or payment details. Google Analytics counts the purchase as a conversion for our Google Ads account, so we can see which of our ads lead to sales. We tell Google not to use this data to personalize ads. If you rejected analytics cookies, nothing about your purchase is sent to Google.

7. The Themeasy plugin and themes on your site

The Software runs on your WordPress site, which you control. Apart from the Library requests described in section 4, it sends data only in these cases:

  • Freemius, which handles licensing. In Themeasy Lite it runs in anonymous mode and sends nothing unless you opt in from the Plugins screen. If you opt in, it sends Freemius, on our behalf, your WordPress user's name and email address, the site's address, title and language, the WordPress and PHP versions, the plugin's version and state and, unless you turn it off, the names and versions of your plugins and themes, until you opt out. Activating a paid license also registers the site with Freemius.
  • Deactivation feedback. When you deactivate the plugin, an optional form asks why. Your answer is anonymous unless you choose otherwise in the form.
  • Updates through the Hub, for sites licensed through a theme purchase (section 5).
  • Font services you set up in the paid plugin, such as Google Fonts or Adobe Fonts, which your site's server contacts with your own settings.

Some widgets embed content from other services, such as YouTube or Vimeo, and the readme of each product lists them. When your visitors load that content, their data goes to those services, not to us, and your site's own privacy notice should cover it.

8. Why we process data (legal bases)

  • To provide the Services you ask for (GDPR art. 6(1)(b); LGPD art. 7, V): your account, licenses, purchases, downloads, updates, the Library and support.
  • For our legitimate interests (GDPR art. 6(1)(f); LGPD art. 7, IX): security and server logs, preventing fraud and abuse, applying license terms, improving the Services, including from the reviews you send us, and telling customers about product changes (you can opt out). We balance these interests against your rights, and you can object (section 9).
  • With your consent (GDPR art. 6(1)(a); LGPD art. 7, I): analytics cookies and the measurement of our ads, the Freemius opt-in, activating a ThemeForest purchase from a theme's setup wizard, the newsletter, the Themeasy Lite waitlist, and publishing a review you allowed us to quote. You can withdraw consent at any time, without affecting what happened before.
  • To comply with the law (GDPR art. 6(1)(c); LGPD art. 7, II): keeping the records that tax, accounting and consumer laws require, and answering lawful requests from authorities.

9. Your rights

Depending on where you live, you have the right to:

  • confirm whether we process your data, access it and receive a copy, including in a portable format;
  • correct data that is incomplete, inaccurate or out of date;
  • have data deleted, anonymized or blocked when it is unnecessary, excessive or unlawfully processed, and delete your account;
  • object to processing based on our legitimate interests, and ask us to restrict it;
  • withdraw your consent, and be told what happens if you do not give it;
  • know with whom we share your data; and
  • complain to a data protection authority: in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados); in the European Union and the United Kingdom, the authority of your country.

You can do much of this yourself in the Hub: export your data, change your details and notification settings, or delete your account. For anything else, email hello@themeasy.co. We may need to confirm your identity, and we answer within the time the law sets (under the LGPD, 15 days for a complete statement of how we process your data; under the GDPR, one month). We do not make decisions about you based solely on automated processing.

If you live in California or another US state with a privacy law: we do not sell your personal information or share it for cross-context behavioral advertising, and we will not treat you differently for exercising your rights.

10. Who we share data with

We share personal data only with the providers that help us run the Services, each for its own part, and with authorities when the law requires it:

  • Hostinger — hosting of the Hub, the library service and the Demos, and our email.
  • Cloudflare — hosting and delivery of themeasy.co and library.themeasy.co, delivery of the Demos, and our domain's DNS.
  • Freemius — checkout, payments, invoices and taxes as merchant of record; licensing; and the plugin's opt-in.
  • Envato — the ThemeForest marketplace, verification of ThemeForest purchases, and sign-in with Envato.
  • Google — sign-in with Google; Google Analytics and the measurement of our Google Ads, only with your consent; and the web fonts of some Demos.
  • GitHub — sign-in with GitHub, if you use it.
  • Adobe — web fonts.
  • Anthropic, OpenAI and Voyage AI — only for the AI-assisted support features, when enabled.
  • Error-monitoring and backup storage providers, which receive technical data needed to keep the Services running.

If Themeasy is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of it, and we will tell you before it becomes subject to a different privacy policy.

11. International transfers

Themeasy operates from Brazil, which the European Commission recognizes as providing an adequate level of protection for personal data (adequacy decision of 26 January 2026). Several of the providers above process data in other countries, including the United States and member states of the European Union.

When personal data leaves your country, or leaves Brazil, we rely on the safeguards the law provides — such as adequacy decisions and standard contractual clauses (GDPR arts. 45 and 46; LGPD art. 33 and ANPD Resolutions CD/ANPD No. 19/2024 and No. 32/2026) — or on another lawful ground, such as the performance of a contract you asked for.

12. How long we keep data

  • Hub account: while your account exists. When you ask to delete it, the account is closed after a 14-day grace period and then deleted, except for the records below.
  • Licenses and purchase records: while the license exists and afterwards, at least for as long as tax, accounting and consumer laws require (generally five years). Deleting your Hub account does not delete them: they stay, detached from it, with the buyer's email address, so licensed sites keep their updates. Once that period has passed, you can ask us to delete them.
  • Purchase notifications from Freemius: in full for 90 days, then reduced to their reference numbers.
  • Sign-in history (date, IP address and browser): 180 days.
  • Download records: the IP address is removed after 90 days; the record stays, without it, to count downloads.
  • Support conversations: while your account exists. When it is deleted, your own messages and attachments are deleted with it; the subject and our replies, which may still mention you, are kept without your account for five years, the limitation period for consumer claims, and then deleted.
  • AI-assisted support: the requests sent to AI providers and their responses, with personal details masked, for 90 days; help-chat conversations for 30 days after the last message.
  • Documentation feedback: the one-way hash of your IP address and browser is removed after 90 days; the rating stays.
  • Feedback board: your ideas, comments and votes stay on the board after your account is deleted, without your name.
  • Status page subscriptions: until you unsubscribe or delete your account.
  • Themeasy Lite waitlist: until we send the email announcing Themeasy Lite, then deleted; never more than 12 months.
  • Reviews: until you ask us to delete them. The email address, kept only to reply to you, is removed after 12 months. A review we publish with your permission comes down when you withdraw it.
  • Hub records: application logs for 14 days; emails that failed to send, kept to retry them, for 30 days; the audit log of changes to accounts and licenses for 12 months; data export files for 48 hours, until their download link expires.
  • Server logs of our websites, the Demos and the library service: for the limited period our hosting providers set, for security and troubleshooting.
  • Backups: up to six months, on a rolling basis.
  • Analytics: no more than 14 months.
  • The link between a purchase and your analytics identifiers: 63 days.

13. Cookies

Our websites, the Demos and the Hub use essential cookies and similar storage to work, and optional analytics cookies, which also measure our ads, only with your consent. Our Cookie Statement lists them and explains how to change your choice.

14. Security

We protect personal data with technical and organizational measures, including encryption in transit, hashed passwords, encrypted access tokens, optional two-factor authentication and restricted access. No method of transmission or storage is completely secure. If a security incident creates a relevant risk to you, we will notify you and the competent authorities as the law requires.

15. Children

The Services are meant for professionals and are not directed to children. You must be of legal age to create a Hub account or to buy, and we do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

16. Changes to this policy

We may update this policy. If a change is material, we will tell you by email or in the Hub before it takes effect. The date at the top shows the current version.

17. Contact and data protection officer

Controller: Themeasy, operated by F DA S LIMA, a business established in Brazil. For privacy requests and questions, including those for our data protection officer (encarregado), email hello@themeasy.co.

See also our Terms of Service and our Cookie Statement.