1. Who we are and what this policy covers

Fox Themes is a portfolio of Xtendify Technologies (“Xtendify”, “we”, “us”). Through Fox Themes, we design and sell premium WordPress themes for small and mid-size businesses at foxthemes.me. If you have any questions about this policy or your personal information, you can reach us through our support form.

This policy covers personal information we collect through:

  • foxthemes.me, including the store, blog, and checkout
  • our theme demo sites (subdomains such as napoli.foxthemes.me and preview.foxthemes.me)
  • our documentation site, docs.foxthemes.me
  • our support form and any emails you exchange with us

Fox Themes is the data controller for this information.

This policy does not cover:

  • Websites built with our themes. Once you install a theme, you run that website and decide what it collects from your visitors (for example, booking forms, WooCommerce orders, or contact forms). You are responsible for your own site’s privacy policy.
  • Purchases made on ThemeForest. Envato is the seller for those purchases and processes your payment and account details under Envato’s privacy policy. We only receive the details described in section 2.
  • Third-party websites we link to, such as plugin developers or social networks.

2. Information we collect

We collect information you give us, information created when you buy or use our services, and basic technical information from your browser.

When What we collect Source
Buying a theme directly Name, email address, billing details, order history, IP address at checkout You
Payment Confirmation that payment succeeded. We never receive or store your full card number. [Payment processor]
Buying on ThemeForest Your Purchase Code and its licence details when you enter it for support You and Envato
Your account Email address, password (stored encrypted), purchase history, downloads You
Support requests Name, email, theme, website URL, Purchase Code, your message, attachments (screenshots, logs) You
Support access (optional) WordPress admin username and password, FTP/SFTP host, username and password You
Blog comments Name, email, website, comment text, IP address, browser user agent You
Browsing our sites IP address, browser and device type, pages viewed, referring page, cookie identifiers Your browser

We do not ask for sensitive information such as health, financial account, or government ID details. Please do not include it in support tickets or attachments.

3. How we use your information

We use your information only for the purposes described below. Where the EU or UK GDPR applies, we also explain the legal basis we rely on for each purpose.

We use the information you give us to process your order, deliver your theme, and give you access to downloads and updates. We also use it to verify your purchase, provide the support included with it, handle refund requests, and send you receipts, security notices, and important theme update notices. If you ask us to, we use the login details you share to access your site and fix a support issue. We rely on the performance of our contract with you for all of these purposes.

We keep invoices and tax records because the law requires us to. We also use technical information, such as IP addresses, to protect our sites and store from spam, fraud, and abuse. We do this based on our legitimate interest in keeping our services secure.

We use information about how visitors browse our sites to understand what works and improve them. Where the law requires it, we ask for your consent before setting analytics cookies; otherwise, we rely on our legitimate interest in improving our sites. We send news, offers, and new theme announcements only if you have agreed to receive them, and you can withdraw that consent at any time by unsubscribing.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Our themes on your website

Our themes and the plugins bundled with them run on your own WordPress installation. We cannot see your site’s content, your visitors, or the data your site collects.

Some bundled third-party plugins, such as WPBakery Page Builder, Elementor, or The Grid, may check their own developers’ servers for updates or licences. That is governed by each plugin developer’s privacy policy.

Some theme features connect your site to outside services when you enable them, such as Google Maps, YouTube or Vimeo embeds, social media links, or booking and WooCommerce extensions. Those services may collect data from your visitors. If you use them, mention them in your own site’s privacy policy and cookie notice.

5. Cookies

Cookies are small text files that a website stores in your browser. We use them to keep our store, checkout, and your account working, and to remember choices you make on our sites.

Cookie Purpose Type Duration
Cart and checkout session Remembers items in your cart and your checkout session Essential Until your session ends or the purchase is complete
Account login (foxthemes.me) Keeps you signed in to your account Essential 2 days, or 14 days if you choose “Remember Me”
WordPress test cookie Checks that your browser accepts cookies on the login page Essential Until you close your browser
Comment details Saves your name, email, and website if you opt in when commenting Preference 1 year

Essential cookies are needed for checkout and sign-in, so they cannot be switched off on our sites. If we use analytics or other non-essential cookies, we ask for your consent first where the law requires it, and you can change your choice at any time. You can also block or delete cookies in your browser settings, although checkout and sign-in may not work without essential cookies.

Embedded content on our blog and demo sites, such as YouTube videos or Google Maps, may set its own cookies. Those are controlled by the provider of that content.

6. When we share information

We share personal information only in these cases:

  • With the service providers listed in section 5, to run our store and support.
  • With Envato, to check a ThemeForest Purchase Code you give us.
  • When the law requires it, such as a valid court order. Where we are allowed to, we will tell you first.
  • To protect rights and safety, for example, to investigate fraud or abuse of our store.
  • If Xtendify or the Fox Themes brand is sold or merged. The buyer would receive customer information and remain bound by this policy until it notifies you of any change.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use your personal information, support tickets, or website files to train artificial intelligence models.

7. Security and international transfers

We protect your information with HTTPS on all our sites, and provide limited access to staff who need it. No system is completely secure, so we cannot guarantee that data will never be accessed without permission. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

If you share login details for support:

  • We use them only to work on your ticket.
  • We delete them when the ticket is closed.
  • We recommend creating a temporary administrator account for us and deleting it, or changing your passwords, once the issue is fixed.

8. Your rights

You can ask us for the following rights irrespective of your location.

  • access the personal information we hold about you and get a copy
  • correct information that is wrong or incomplete
  • delete your information, unless we must keep it, for example for tax records
  • export information you gave us in a portable format
  • stop marketing emails, using the unsubscribe link in any email or by contacting us
  • withdraw consent you have given, such as for analytics cookies

To make a request, contact us through our support form and choose “General Inquiry”. We may need to confirm your identity first, usually by checking the email address on your order. We will reply within the time limit set by the law that applies to you, as explained below. We will never charge you or treat you differently for using these rights.

European Economic Area and Switzerland (GDPR)

If you are in the EEA or Switzerland, the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection give you the right to access, correct, and erase your personal data, to restrict how we process it, and to receive it in a portable format. You can object at any time to processing based on our legitimate interests, and you can withdraw consent you have given without affecting processing that took place before. We reply within one month, which may be extended by two further months for complex requests, in which case we will tell you why.

United Kingdom (UK GDPR)

If you are in the UK, you have the same rights under the UK GDPR and the Data Protection Act 2018, with the same response times.

California (CCPA/CPRA)

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the past 12 months, we have collected the following categories of personal information: identifiers (such as name, email address, and IP address), commercial information (such as purchase and refund history), internet or network activity (such as pages viewed on our sites), and the content of support requests and comments. We collected this information from you, from your browser, and from Envato when you give us a ThemeForest Purchase Code. We used it for the business purposes described in section 3 and disclosed it only to the service providers to run our store and support.

We have not sold or shared your personal information for cross-context behavioural advertising in the past 12 months, and we do not knowingly sell or share the personal information of anyone under 16. We do not collect sensitive personal information as defined by California law, so we do not offer a right to limit its use.

You have the right to know what personal information we have collected about you, its sources, the purposes for collecting it, and who we disclosed it to. You also have the right to delete and correct your personal information and to receive a copy of it. We will not discriminate against you for exercising these rights. We confirm receipt of a request within 10 business days and respond within 45 days, which may be extended by another 45 days if we tell you. An authorised agent may request you if we can verify their authority and your identity.

Other US states

Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon, have rights to confirm whether we process their personal data, and to access, correct, delete, and obtain a portable copy of it. They also have the right to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We do not do any of these, so there is nothing to opt out of. We respond within 45 days, extendable by another 45 days where reasonably necessary. If we decline your request, you can appeal by replying to our decision. We will answer your appeal within the time your state’s law requires.

Canada (PIPEDA)

Under the Personal Information Protection and Electronic Documents Act, you can access and correct the personal information we hold about you and withdraw your consent, subject to legal or contractual limits. We respond within 30 days.

Brazil (LGPD)

Under the Lei Geral de Proteção de Dados, you can confirm whether we process your data, access and correct it, request its anonymisation, blocking, or deletion where it is unnecessary or processed unlawfully, receive it in a portable format, learn which entities we share it with, and revoke consent.

India (DPDP Act)

Under the Digital Personal Data Protection Act, 2023, you can obtain a summary of the personal data we process and the processing activities involved, request correction, completion, updating, or erasure of your data, and withdraw consent as easily as you gave it. You can nominate another person to exercise your rights if you die or become incapable of doing so.

Australia (Privacy Act 1988)

Under the Australian Privacy Principles, you can access and correct the personal information we hold about you. We respond within 30 days.

Questions or concerns

If you have a question or concern about how we handle your information, please contact us first. We will do our best to resolve it quickly. Depending on where you live, you may also contact your local data protection or privacy authority.

9. Children

Our themes are sold to businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us, and we will delete it.

10. Changes to this policy

When we update this policy, we change the “Last updated” date at the top. If a change materially affects how we use your information, we will email customers before it takes effect.

11. Contact us

Fox Themes is operated by Xtendify Technologies, which also makes Simple Calendar and Woffice. For privacy requests or questions about this policy, use our support form or Xtendify’s contact page.