--- title: "Privacy Policy" id: "27724" type: "page" slug: "privacy-policy" published_at: "2025-12-08T17:14:33+00:00" modified_at: "2026-10-01T23:08:47+00:00" url: "https://purethemes.net/privacy-policy/" markdown_url: "https://purethemes.net/privacy-policy.md" excerpt: "This privacy policy describes how your personal information is collected, used, and shared when you visit or make a purchase from https://purethemes.net (“the site”, “we”, “us”, or “PureThemes”). Last Updated: October 2026 Who we are We’re a WordPress theme and..." --- This privacy policy describes how your personal information is collected, used, and shared when you visit or make a purchase from [https://purethemes.net](https://purethemes.net) (“the site”, “we”, “us”, or “PureThemes”). **Last Updated: October 2026** ## Who we are We’re a WordPress theme and plugin business. Our website address is [https://purethemes.net](https://purethemes.net) . We develop and sell WordPress themes (Listeo, WorkScout) and plugins (PurioChat Pro, Listing Data Importer, Listeo Booking Plus, Listeo Monetization Plus). ## What personal data we collect and why we collect it ### Contact forms When visitors contact us via our contact forms, we collect the data shown in the form to reply to your enquiry or provide support for our products. Support tickets are stored in HelpScout, a third-party help desk service. We do not share this information with other third parties or use it for marketing purposes. ### **Trial Requests** When you request a product trial via our trial request form, we collect your email address and website domain. This data is used to generate and track temporary trial licenses (valid for 3 days). We store this information to enforce our one-trial-per-email policy and to follow up regarding your trial experience. Trial request data is retained indefinitely to prevent duplicate trial requests. ### AI Chatbot on this site We use PurioChat Pro on this website. Messages and relevant chat context are sent to the configured AI provider to generate a response. Chat history and related technical data, including the page URL and IP address, are stored on this WordPress site. The configured retention period is 90 days, with deletion performed by scheduled WordPress cleanup. We do not add account or license identifiers to model requests, but submitted content may itself contain personal data. ### Purio Cloud “No API Key” access When a WordPress administrator enables Purio Cloud (“No API Key” access), PureThemes processes the administrator’s email address, website domain, license/account identifiers, plan, usage, credit and billing records, related timestamps, and technical request data. We use this information to authenticate and provide the service, manage credits and payments, enforce limits, secure the service, and prevent abuse. We do not use it for marketing. Prompts, chat context, tool results, and text submitted for embeddings are sent over HTTPS through [Cloudflare](https://www.cloudflare.com/privacypolicy/) and Cloudflare AI Gateway to [OpenRouter](https://openrouter.ai/privacy/) and the underlying AI model provider. The gateway does not forward the administrator’s email, website domain, account ID, or license key as provider metadata. Request content may nevertheless contain personal or website data supplied by visitors, the site owner, or connected tools. The gateway does not centrally store raw prompts or embeddings. It stores account, usage, credit, billing and technical records, cryptographic request hashes and, for Trial and Pro chat requests, a temporary response cache for safe retries and duplicate-charge prevention. Cloudflare AI Gateway payload logging is disabled, although technical metadata may still be logged. OpenRouter and model providers process requests according to their privacy and retention policies. The customer website owner decides what visitor content is submitted and is responsible for informing visitors and establishing an appropriate legal basis. PureThemes processes that content to provide Purio Cloud and separately manages its account, billing, security and abuse-prevention records. Managed access can be disabled in the plugin. Privacy requests can be sent to [[email protected]](/cdn-cgi/l/email-protection#fc8f898c8c938e88bc8c898e9988949991998fd2929988) ; records required for legal, billing or fraud-prevention purposes may still be retained. ### Sensitive data in Purio Cloud Purio Cloud is not designed to process passwords, payment card details, government identifiers, health or biometric data, or other special-category personal data. Do not submit such data unless the processing has been expressly agreed and appropriate legal and security safeguards are in place. ### Cookies We use cookies for: - Essential site functionality - Analytics (see Analytics section below) - Language preferences ### Embedded third-party content Articles on this site may include embedded content (videos, images, etc.). Embedded content from other websites behaves as if you visited that website directly. These websites may collect data about you, use cookies, and monitor your interaction with the embedded content. ### Analytics We use Google Analytics and Plausible to understand how visitors use our site. This service collects anonymous information including time of visit, pages visited, browser type, and device information. This data cannot be traced back to you personally. ### Order information When you purchase a product, your payment is processed by Dodo Payments, Polar, Paddle, or Envato, depending on the product purchased. We do not store your payment card or bank account details. **In our licensing system, we store:** - Purchase ID - Customer name - Email address - License key We use this information to verify purchases, issue and manage licenses, deliver products, prevent fraud, and provide customer support. Please review the relevant payment provider’s privacy policy for information about how it processes your payment data. **We do not store your complete payment details. Payment processing is handled by third-party providers:** - [Dodo Payments](https://dodopayments.com/privacy-policy) - [Polar.sh](https://polar.sh/) - [Paddle](https://www.paddle.com/legal/privacy) - [Envato Pty Ltd](https://www.envato.com/privacy/) **The processor used depends on the product purchased.**We store only your email address and license key to deliver your purchase and provide support. Please review the respective privacy policies of these providers for information on how they handle your payment data. ### License activation When you activate a premium product with your license key, we collect: - Your website URL - Your license key - Your email address This data is stored to track activation limits according to your license terms. ## Legal Basis for Processing We process your personal data based on the following legal grounds: - **Contract performance**: Processing necessary to fulfill your purchase, deliver products, provide support, manage your license, and provide Purio Cloud account, credit, and payment services - **Legitimate interests**: Processing necessary to improve and secure our services, meter usage, and prevent fraud and abuse (applies to: analytics, service security, and Purio Cloud usage controls) - **Consent**: Processing based on your explicit consent where applicable (applies to: non-essential cookies) - **Legal obligation**: Processing necessary to comply with legal requirements such as tax and accounting regulations (applies to: transaction records) You may withdraw consent at any time by contacting us at [[email protected]](/cdn-cgi/l/email-protection#b3c0c6c3c3dcc1c7f3c3c6c1d6c7dbd6ded6c09dddd6c7) or by adjusting your cookie preferences. ## Who we share your data with We do not sell or give away your personal information. We share information only in these circumstances: - **Payment Processors**: Dodo Payments, Paddle, or Envato process your payments. They receive only the information necessary to complete your transaction. - **Support**: HelpScout stores support tickets and related correspondence. - **Infrastructure and AI providers**: Cloudflare processes Purio Cloud gateway traffic, service state, and technical metadata. OpenRouter and the underlying model provider process the content needed to generate responses or embeddings. See our current [Purio Cloud subprocessors](https://purethemes.net/subprocessors/) . - **Legal Requests**: We may disclose information in response to court orders or governmental requests. - **Business Transfers**: In case of merger or acquisition, user information may be transferred, but this Privacy Policy would continue to apply. ## How long we retain your data - Order details: Retained by payment processors (Dodo, Paddle, Envato) according to their retention policies - Account information (email, license key): As long as necessary for license management and support, unless you request deletion - Support tickets: Retained in HelpScout according to their retention policies - Chatbot conversations: 30 days (auto-deleted) - Analytics data: Aggregated and anonymized data retained for analytical purposes - Tax and accounting records: Retained for the period required by applicable law (typically 5-7 years) - **Payment information:** Retained by Dodo Payments, Paddle, or Envato according to the applicable provider’s retention policy. - **Purchase and licensing information (purchase ID, name, email address, and license key):** Retained for as long as necessary to manage the license, verify the purchase, provide support, and meet applicable legal obligations. You may request deletion, subject to information we are legally required to retain. - **Purio Cloud account, usage, and billing records:** Retained while managed access is active and as needed for billing, fraud prevention, support, and legal obligations. - **Purio Cloud response retry cache:** Retained temporarily to handle safe retries and prevent duplicate charges. Expired entries are removed during subsequent account maintenance. ## Your rights over your data Under GDPR and other applicable data protection laws, you have the right to: - **Access**: Request an export of personal data we hold about you - **Rectification**: Correct inaccurate personal data - **Erasure**: Request deletion of your personal data (except data we must retain for legal/accounting purposes) - **Portability**: Receive your data in a portable format - **Object**: Object to processing of your personal data based on legitimate interests - **Withdraw consent**: Withdraw previously given consent at any time - **Lodge a complaint**: File a complaint with your local data protection authority. In Poland, this is the President of the Personal Data Protection Office (UODO) at [uodo.gov.pl](https://uodo.gov.pl) To exercise these rights, contact us at [[email protected]](/cdn-cgi/l/email-protection#a5d6d0d5d5cad7d1e5d5d0d7c0d1cdc0c8c0d68bcbc0d1) . We will respond to your request within 30 days. ## Cookie Management You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified before a cookie is stored. Please note that disabling cookies may affect website functionality. To manage your cookie preferences on this site, you can adjust settings in your browser or use our cookie consent banner when available. For detailed instructions on managing cookies, refer to your browser’s help documentation. ## Where your data is sent - Payment information: Processed by Dodo Payments, Paddle, or Envato (depending on product) - Support tickets: Stored in HelpScout (USA) - AI content: Processed by Cloudflare, OpenRouter, and the underlying model provider. Processing locations depend on the provider and may be outside the EEA. - Analytics: Google Analytics (USA), Plausible (EU) For transfers outside the EEA, where required, we use or rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses. ## Children’s Privacy Our products and services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you are under 18, please do not provide any personal information through our website. If we learn that we have collected personal data from a child under 18, we will delete that information promptly. ## Third-Party Links Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit. ## Changes to This Policy We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by posting a notice on our website and updating the “Last Updated” date at the top of this policy. We encourage you to review this page periodically. Your continued use of our services after changes constitutes acceptance of the updated policy. ## Contact information For privacy-related questions or to exercise your data protection rights, contact us at [[email protected]](/cdn-cgi/l/email-protection#e4979194948b9690a494919681908c81898197ca8a8190) . ## Listeo Cloud Version 1.1. Effective from 2 October 2026. This chapter applies to Listeo Cloud. It supplements the rest of this Privacy Policy and does not replace it. For Listeo Cloud the provider is Łukasz Girek Purethemes.net, a sole proprietorship registered in the Polish Central Register and Information on Economic Activity (CEIDG), ul. Marszałka Rydza Śmigłego 5B/44, 41-219 Sosnowiec, Poland, tax ID (NIP) 6292371225, trading as PureThemes. Data protection contact: [[email protected]](/cdn-cgi/l/email-protection#6616140f1007051f2616131403120e030b031548080312) . ### 1. Listeo Cloud: what we process as controller Listeo Cloud is managed WordPress hosting with the Listeo theme, offered as one annual plan. For the data below we are the controller. 1.1. Account and login to the Panel (the Listeo Cloud customer panel): e-mail, name or company name, hashed password, account creation date, time and IP address of logins (in logs, section 1.5). 1.2. Temporary address and custom domain: the random address in listeo.pro we assign to you, and your own domain if you connect one. DNS records (CNAME, TXT) are used to issue the TLS certificate. 1.3. Purchase reference: subscription identifier, trial and payment status, and the annual renewal date, which we receive from the Merchant of Record. We do not receive your card number or bank account details. 1.4. Support tickets: message content, attachments, e-mail, correspondence history. We handle them in Help Scout. 1.5. Technical logs: IP addresses, HTTP requests, error codes, timestamps, installation identifier, logins. They serve diagnosis, security and abuse prevention. 1.6. Cookies in the Panel and wp-admin: only those strictly necessary to log in and keep the session ([section 9](#listeo-cloud-9) ). 1.7. Service notices: e-mails about the end of the trial, annual renewal, failed payment, site suspension, changes to the terms, incidents and maintenance. These are not marketing. 1.8. Trial: the 7-day trial requires a payment card registered with the Merchant of Record. We then process the data in sections 1.1 to 1.3 and whether the trial was cancelled or converted into a paid subscription. There is one trial per customer; to check this, for a new order we look up the order history kept by the Merchant of Record (Dodo Payments) to see whether this e-mail address or payment method was already used for a trial. We do not keep our own data for this purpose after account deletion. Retention periods are in [section 6](#listeo-cloud-6) . ### 2. Listeo Cloud: what we process as processor 2.1. Everything you and the users of your site place in your WordPress installation (accounts, listings, bookings, messages, comments, photos and files) is processed on your behalf. You are the controller of that data, we are the processor. The same applies to the data of your existing site that we move into Listeo Cloud on your instruction (migration). 2.2. We do not inspect the content of your site and do not use it for our own purposes. 2.3. The rules for this processing, including the sub-processor list, security measures, migration and breach notification, are set out in the [Data Processing Agreement (DPA)](https://purethemes.net/listeo/listeo-cloud/policies/#dpa) you accept at signup. 2.4. This policy does not describe how you process your users’ data. You need your own privacy policy on your site. ### 3. Legal bases 3.1. Performance of a contract (Article 6(1)(b) GDPR): account, trial, login, domain, purchase reference, support, service notices. 3.2. Legal obligation (Article 6(1)(c) GDPR): accounting records, responding to requests from authorities, obligations under the DSA. 3.3. Legitimate interest (Article 6(1)(f) GDPR): technical logs, platform security, abuse prevention (including repeated use of the trial), establishing and defending legal claims. You can object ([section 7](#listeo-cloud-7) ). 3.4. We do not use Listeo Cloud account data for marketing without separate consent (Article 6(1)(a) GDPR). You can withdraw consent at any time. ### 4. Recipients of data 4.1. Sub-processors that process data on our behalf: | Recipient | Purpose | Location | | --- | --- | --- | | Netcup GmbH | Servers for customer sites (WordPress, MariaDB, Redis, PHP) | Germany | | Cloudflare, Inc. | Network, DNS, TLS certificates, CDN and cache, attack protection; R2 media storage | Global network (cache); R2 media: as determined by Cloudflare | | Hetzner Online GmbH | Backups (Storage Box) | Germany | | Help Scout Inc. | Support ticket handling | USA | The Panel and licensing run on our own servers in Germany. Current list: [Data and security](https://purethemes.net/listeo/listeo-cloud/policies/#data-and-security) . 4.2. Merchant of Record: Dodo Payments sells you the subscription and collects payment. Paddle and Polar are planned as possible additional Merchants of Record and are not used today; we will announce a change before it takes effect. The Merchant of Record is an independent controller of your payment and billing data. From it we receive only the data in sections 1.3 and 1.8. 4.3. Public authorities: we disclose data where the law requires it, for example on a request from a court or the Polish Data Protection Office. We do not sell data. ### 5. Transfers outside the EEA 5.1. Account data, site databases and files, and backups are stored in Germany. Site media is in Cloudflare R2; its storage location is determined by Cloudflare. The Cloudflare network operates globally as a traffic and cache layer. 5.2. Cloudflare, Inc. and Help Scout Inc. are US companies. The transfer basis is the European Commission’s Standard Contractual Clauses (Decision 2021/914) and, for a certified provider, the EU-US Data Privacy Framework. You can request a copy of the clauses at [[email protected]](/cdn-cgi/l/email-protection#cbbbb9a2bdaaa8b28bbbbeb9aebfa3aea6aeb8e5a5aebf) . ### 6. Retention periods | Data | Period | | --- | --- | | Account | Term of the agreement (including the trial) plus 30 days | | Your WordPress installation (site data) | 30 days after the agreement ends, with the option to download an export; then deleted. Backups are deleted no later than 90 days after those 30 days | | Account and site after suspension for non-payment of a renewal or after a cancelled trial | Deleted 30 days after the site is suspended; backups no later than 90 days after that. A cancelled trial runs until the end of the 7 days, then the site is suspended | | Record of trial use | Not kept after account deletion; the order history is kept by the Merchant of Record as an independent controller | | Purchase reference and accounting records | 5 years from the end of the tax year (tax law) | | Support tickets | 24 months from closing the ticket | | Abuse, DSA and DMCA cases (notices, decisions, appeals, correspondence) | 3 years from closing the case | | Incident log and requests from authorities | 5 years | | Logs (technical, login, security) | 30 days; longer only during an ongoing incident or dispute | ### 7. Your rights 7.1. You have the right to: access your data, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest. 7.2. Send requests to [[email protected]](/cdn-cgi/l/email-protection#1363617a6572706a5363666176677b767e76603d7d7667) . We respond within one month. We may ask you to confirm your identity. 7.3. You request an export of your site data as described in [Data and security](https://purethemes.net/listeo/listeo-cloud/policies/#data-and-security) . You delete your account by writing to [[email protected]](/cdn-cgi/l/email-protection#abd8dedbdbc4d9dfebdbded9cedfc3cec6ced885c5cedf) . 7.4. If you are a user of a site run by one of our customers, contact the owner of that site. They are the controller of your data. A request that reaches us is forwarded to them. ### 8. Complaint to a supervisory authority 8.1. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the authority in the EEA country where you live or work. ### 9. Cookies in the Panel and wp-admin 9.1. The Panel and your site’s wp-admin use only strictly necessary cookies: login session, form security tokens (CSRF, WordPress nonces) and remembered interface settings. 9.2. Such cookies do not require consent under Article 399(1)(2) of the Polish Electronic Communications Law. That is why there is no cookie banner in the Panel or wp-admin. 9.3. We do not use analytics, advertising or tracking cookies there. You are responsible for cookies set by plugins you install on your own site. 9.4. The purethemes.net marketing site is covered by the cookie management chapter of this Privacy Policy and by a banner where needed. ### 10. Children 10.1. Listeo Cloud is intended for adults running a business and for adult consumers. We do not open accounts for people under 18 without a guardian’s consent. 10.2. If we learn that an account was opened by a minor without consent, we delete it. Reports: [[email protected]](/cdn-cgi/l/email-protection#ef9f9d86998e8c96af9f9a9d8a9b878a828a9cc1818a9b) . The age of users of our customer’s site is that customer’s responsibility.