Privacy policy

This page explains what information Celestial Themes collects when you visit this site, download or buy our products, and the choices you have. The short version: no cookies for visitors, no advertising, no tracking across other sites, and we never sell your data. If anything is unclear, email us at moc.semehtlaitselec@tcatnoc.

Who we are

Celestial Themes is an independent design studio that publishes templates and resources for the web, run from Romania. We decide how the personal data described on this page is used, which makes us its controller under the EU General Data Protection Regulation (GDPR).

This policy applies to celestialthemes.com, to the documentation and resources hosted on our domain, and to purchases made through our site.

For any data protection question, email moc.semehtlaitselec@tcatnoc.

What we collect

We collect only what we need to run the site, count downloads, deliver what you buy and reply to you.

• When you visit the site. Like every web server, ours records basic technical information with each request: your IP address, browser type, the page requested and the time. This is needed to deliver the pages and to protect the site from abuse.
• When you browse the site or a product demo. We count which pages are viewed, on this site and on our live product demos (our subdomains, such as gatefold.celestialthemes.com), the website that sent you here (its domain only), any campaign tags in the address you arrived at, and whether you use a computer, phone or tablet. We keep these only as daily totals, never as a record of your visit. We use no cookies and store no IP address. To count each visitor once a day, we use the daily one-way hash described below, deleted the next day.
• When you download a product or follow certain links. We count downloads and clicks on links such as “View on GitHub”. With each count we record the website that sent you here (its domain only), any campaign tags in the address you arrived at, and which button you used, again only as daily totals. So that the same download is not counted twice, we keep a one-way hash of your IP address, browser and the link, mixed with a random key that changes every day. The key and the hashes are deleted the next day, after which they cannot be linked back to you.
• When you buy a product on our site. Purchases are processed by Freemius, which acts as the merchant of record: it takes the payment, issues the invoice and handles sales tax, under its own privacy policy. We never see your card details. Freemius shares with us what we need to deliver and support your licence: your name, email address, country, the product and licence you bought, and the order date.
• When you bought on ThemeForest and ask for support. Envato is the seller for ThemeForest purchases. If you contact us for support, we check your purchase code with Envato to confirm the purchase, and we receive the item, licence type, purchase date, support period and your Envato username.
• When you subscribe to the newsletter. Your email address, the dates you subscribed and confirmed, and whether you open our emails and click their links. After you sign up we send a single email asking you to confirm; your address joins the list only if you click its link. Brevo, which sends the newsletter, records the opens and clicks; we look at them only as totals, to learn which emails readers find useful, and never use them to build a profile of you. To protect the sign-up form from abuse, we keep a one-way hash of your IP address for one hour and, while a sign-up waits for confirmation, a one-way hash of the email address for up to seven days; neither can be turned back into the original.
• When you email us. Your email address, your name if you include it, and the content of your message.

Comments are closed on this site, so we collect nothing through them.

What we don’t do

• We don’t use analytics cookies, advertising or tracking across other websites. On the site there are no tracking pixels at all.
• We don’t sell, rent or share your personal information with anyone for marketing.
• We don’t show a cookie banner, because there is nothing to consent to: browsing the site sets no cookies.

Cookies

Reading the site, downloading a product or subscribing to the newsletter sets no cookies. The only cookies on this site are the essential ones that keep site administrators logged in.

The checkout opens in a window run by Freemius, which may set its own cookies needed to complete the payment, under its own policy.

Why we use your data

• Purchases and licences: to deliver what you bought and support it (performance of a contract), and to keep the records that tax and accounting law requires (legal obligation).
• Newsletter: your consent. You can withdraw it at any time with the unsubscribe link in every email.
• Replying to your emails: to answer what you asked us, including questions before a purchase (legitimate interest, or steps you asked for before a contract).
• Server logs and page and download counts: our legitimate interest in running a secure website and knowing which products people use, limited to the minimum described above.

Services we use

• Hosting: the site is hosted with a third-party hosting provider that processes basic server logs (IP addresses, timestamps, requested URLs) for security and operations, keeps them for a limited period and then deletes them automatically.
• Email: our mailbox is hosted by a third-party email provider.
• Checkout and licensing: Freemius, as described above.
• Newsletter: Brevo, based in the European Union, stores subscriber email addresses, sends the newsletter and records opens and clicks.
• ThemeForest purchase checks: Envato, only when you send us a purchase code.
• GitHub: our free products are delivered from GitHub (GitHub, Inc., United States). When you download one or follow a link to our repositories, your browser connects to GitHub, which handles that request under its own privacy policy. We pass no information about you to GitHub.

Data outside the European Union

Some of these services are based outside the EU, such as Freemius, Envato and GitHub. Where your data is transferred to them, the transfer relies on the safeguards provided by law, such as the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep your data

• Server logs: a limited period set by our hosting provider, then deleted automatically.
• Page and download counts: the daily totals are kept but contain no personal data. The hashes used to avoid double counting are deleted the next day.
• Purchases: for as long as your licence is active and for the period required by Romanian tax and accounting law.
• Newsletter: until you unsubscribe.
• Emails: as long as the conversation is relevant, typically up to two years, then deleted.

Your rights

Under the GDPR, and similar laws elsewhere, you have the right to:

• ask what personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive a copy of your data in a portable format;
• withdraw your consent at any time, where we rely on it.

To make a request, email moc.semehtlaitselec@tcatnoc. We reply within one month. Some data, such as invoices, must be kept for the period the law requires even if you ask for deletion; we will tell you if that applies.

You can also complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro); you can also contact the authority of the country where you live or work.

How we protect your data

We use reasonable technical and organisational measures: secure HTTPS connections, reputable service providers, and access to personal information limited to what is needed. No system is perfectly secure, but we keep what we hold to a minimum, which is the best protection there is.

Children

This site is not directed at children under 16, and we do not knowingly collect personal information from anyone under that age. If you believe a child has given us personal information, email us and we will delete it.

Changes to this policy

We may update this policy when our practices or the law change, for example when we open customer support accounts. When we do, we update the date at the top of this page. Significant changes are also announced to newsletter subscribers by email.

Contact

For any privacy question or request, email moc.semehtlaitselec@tcatnoc.