Privacy Policy — Themeopia

Last Updated: Oct 14, 2026

1. Who We Are

Themeopia is an independent studio that creates high-performance WordPress themes, starter templates, and plugins. We are the data controller for everything described on this page.

• Website: 
• Contact Email: 
• Address:

Write to [email protected] about anything on this page, and a real human from our team will respond as soon as possible.

2. What This Policy Covers

This policy covers two primary web properties operated by Themeopia. These mainly include the following domains.  

1. themeopia.com: Our main shop window containing product pages, blog posts, contact forms, direct checkout entries, etc.

3. Reading the Site

Browsing themeopia.com requires no account, registration, or personal information. You can access it without any of that and explore as much as allowed unconditionally. 

The server sets no cookies until you interact with our analytics consent banner. If you decline, no analytics scripts or cookies are loaded. That means you don’t have to worry about providing consent before starting your exploration. 

Cloudflare Protection:

Cloudflare sits in front of themeopia.com as a Content Delivery Network (CDN) and security shield. Requests reach Cloudflare before reaching our servers to ensure fast content delivery and mitigate DDoS attacks. Cloudflare processes technical connection data (including your IP address) on our behalf under the Cloudflare Privacy Policy.

4. Analytics

We use Google Analytics 4 to understand which pages are visited and how traffic arrives. Each site uses a dedicated property. 

Analytics runs only if you explicitly accept it. Until accepted, Google scripts remain completely unloaded. We do not run remarketing tags or upload customer data to Google, and no analytics event carries your name, email address, or account identifier. Thus, there is no risk of data theft by attackers. You can browse safely.   

Data processing by Google is governed by the Google Privacy Policy. You can opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on. That means you are not bound to follow anything out of your immediate consent. In other words, you might have opted for a particular option in the past, but you can opt out of it at any time.

5. When You Write to Us

When you submit our contact form, we ask for your name, email address, subject, and message. These details are emailed directly to our team inbox so we can reply. Contact form messages are not stored in our website’s database. They reside securely in our mailbox.

• Spam Prevention: Our form uses Cloudflare Turnstile, a privacy-focused alternative to traditional CAPTCHAs. It inspects browser signals and IP addresses to prevent automated submission spam without requiring image recognition puzzles or building ad profiles. 
• Transactional Delivery: Transactional emails are routed via Brevo, which processes recipient addresses and message contents solely for delivery. 

When any part of this section of the policy changes, you are supposed to take note of that yourself by visiting the policy from time to time. In the event of a policy update, we are not supposed to inform you of the fact personally.

6. When You Ask for Updates by Email

We maintain one primary marketing email list. You are added only if you explicitly opt in by checking a consent box.

• Purchasing a theme, opening a support ticket, or contacting us does not automatically add you to this list.
• We store only your email address and the date you subscribed. We do not use tracking pixels, behavioral scoring, or ad platform syncs. 
• You can unsubscribe instantly by clicking the link at the bottom of any marketing email.

7. When You Buy From Us Directly

Your credit card and sensitive payment credentials never touch or pass through Themeopia servers.

1. Clicking a purchase button sends the product ID and selected license tier to our main domains.
2. No personal details (such as your name or email) are included in this initial checkout handshake.

Any third-party platform involved in this regard, acts as the Merchant of Record, collecting payments, calculating applicable VAT/sales taxes, and managing financial liabilities. What this particular platform collects is governed by its specific policies. 

Checkout Diagnostic Logs

When a checkout begins, our server logs diagnostic parameters to the main website or any other subordinate domain to help identify broken checkout buttons or gateway failures. This log records details such as selected product tier, displayed price, referring URL, campaign tags, browser language/user-agent, and country code provided by Cloudflare. It contains no names, email addresses, or IP addresses.

8. If You Leave a Checkout Unfinished

If you enter an email address on the payment page but close the window without completing the purchase, Platform engaged may send a single checkout recovery reminder after 24 hours.

• This recovery flow runs entirely on Creem’s platform under their privacy policy.
• Themeopia does not store or copy these email addresses into marketing databases.
• Recovery emails contain an instant opt-out link. You can also contact us via our email or any other provided channel to suppress abandoned recovery notices.

9. Technical Logs From Sites Running Our Products

Themeopia frameworks and plugins include error-reporting routines that send anonymized technical logs back to our diagnostic servers. It majorly happens when critical execution faults occur. Consider the following in this regard.

• Log Contents: Stack traces, PHP error types, memory limits, and Themeopia code execution paths.
• Excluded Data: Database contents, user details, customer lists, passwords, and form inputs are never captured.
• Technical logs are used exclusively by our engineering team to patch bugs and optimize theme stability.

10. Why We Are Allowed to Hold Your Data! 

We are allowed to hold your personal data with us for the following reasons.  

• Contract Performance: Managing your account, delivering downloads, processing license updates, and providing technical support for products you bought.
• Consent: Operating analytics cookies, sending marketing newsletters, or issuing welcome offer codes upon request. Consent can be revoked at any time.
• Legitimate Interest: Shielding our site from attacks, responding to inquiries, identifying broken checkout funnels, issuing checkout reminders, and analyzing technical error logs to fix theme bugs.
• Legal Obligation: Retaining invoice records, purchase tax validation data, and accounting records as mandated by tax authorities.

11. How Long We Keep Things

• Accounts & Licenses: Kept active for the lifetime of your account. Closing an account removes associated personal records, barring archived invoice logs required for tax auditing.
• Support Tickets: Retained while useful to assist with future support requests and technical documentation references.
• Contact Messages: Retained in our primary support mailbox and cleared out during periodic data maintenance.
• Newsletter List: Retained until you request removal via the unsubscribe link or email request.
• Checkout Diagnostic Logs: Auto-overwritten continuously; only the most recent 200 attempts are retained.
• Anti-Abuse Counters: Hashed string entries automatically deleted within 24 hours.

12. Your Rights

Under global data protection laws (including GDPR, UK-GDPR, and CCPA/CPRA), you have the right to:

1. Request access to a copy of the personal data we hold about you.
2. Request correction or updates to inaccurate records.
3. Request erasure (“right to be forgotten”) of your account and personal details.
4. Request restriction or object to data processing based on legitimate interest.
5. Receive your data in a structured, portable, machine-readable format.
6. Withdraw processing consent at any time without affecting past lawful processing.

To exercise any of these rights, email us. We respond within 30 days (and usually much faster). If you believe your data has been handled improperly, you have the right to lodge a complaint with your local data protection authority.

13. Where Your Data Goes

Themeopia operates globally, utilizing infrastructure deployed across the United States, the European Union, the United Kingdom, etc. 

When data moves across international borders, we rely on legally approved data transfer mechanisms provided by our service partners—including Standard Contractual Clauses (SCCs) and official Data Privacy Framework (DPF) adequacy decisions.

14. Children’s Privacy

Themeopia products and developer tools are not intended for or marketed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided us with personal information, contact us, and we will delete it immediately.

15. Changes to This Policy

When we update infrastructure providers or alter data processing practices, this page will be updated alongside the “Last Updated” date at the top. Any structural shifts requiring renewed legal consent will be presented to you explicitly via modal or account notification. However, you are supposed to act within reasonable time periods.