Privacy Policy

Last updated: 26 August 2026

This Privacy Policy explains how Getastrothemes handles personal data when you visit getastrothemes.com, create or use an account, buy or download a theme, request support, join a mailing list, or otherwise interact with our services (the “Site”).

It also explains the choices and rights available to you. Some rights apply only in particular countries. We apply the rights required by the law that governs your request.

Who Is Responsible for Your Data

Getastrothemes, the operator of this Site, is the data controller for the processing described in this policy unless we say otherwise.

Privacy contact: support@getastrothemes.com. Use the subject Privacy Request so the message can be routed correctly. You may also use our contact form and select “Others.”

Paddle is our merchant of record and acts as an independent controller for much of the buyer, billing, tax, fraud-prevention, and payment data it processes at checkout. Paddle explains that processing in its Privacy Policy.

Data We Process

The data we process depends on how you use the Site.

Data You Provide

• Account and access data: email address, verification status, account identifiers, authentication records, and session information.
• Order and entitlement data: purchased products, transaction and customer identifiers, price and currency, discounts, license or download entitlement, refund status, and limited billing information returned by Paddle. We do not receive or store your full payment-card number.
• Support and contact data: name, email address, profession, website, department, message, theme name, purchase-verification details, and any other information you choose to provide.
• GitHub connection data: GitHub account identifiers and repository-access status when you choose to connect GitHub for a product that provides repository access.
• Marketing data: email address and subscription preferences if you opt in to product news or offers.

Please do not send passwords, full payment-card details, government identifiers, health information, or other sensitive information through our contact form.

Data Collected From Your Device or Use of the Site

• IP address and approximate location derived from it
• browser, operating system, device type, user agent, language, timezone, viewport, and screen size
• requested pages, referring page, landing page, timestamps, campaign parameters, and outbound-link activity
• product, cart, checkout, download, and support-form interactions
• security, authentication, diagnostic, and server logs
• pseudonymous visitor, session, and affiliate-attribution identifiers when the relevant tools run

We receive some order, refund, tax, and payment-status information from Paddle. We may receive account and authorization data from GitHub when you initiate a GitHub connection.

Why We Process Data and Our Legal Grounds

Where the EU GDPR or UK GDPR applies, we rely on the following legal grounds. The same processing may be permitted under equivalent grounds in other privacy laws.

Purpose	Data involved	Legal ground
Create and secure an account, verify an email address, provide downloads, licenses, updates, and customer support	Account, authentication, order, entitlement, and support data	Performance of a contract or steps you ask us to take before entering a contract, Article 6(1)(b)
Process purchases, refunds, taxes, accounting, and required business records	Order, billing, transaction, refund, and tax data	Performance of a contract, Article 6(1)(b), and compliance with legal obligations, Article 6(1)(c)
Answer contact, support, and pre-sales requests	Contact details, message content, technical context, and purchase-verification data	Steps before or performance of a contract, Article 6(1)(b), or our legitimate interest in responding and keeping an appropriate support record, Article 6(1)(f)
Protect the Site, accounts, customers, and transactions; prevent fraud and abuse; diagnose failures	IP address, device and request data, security logs, account and transaction signals	Our legitimate interests in service and network security, fraud prevention, and legal-claim protection, Article 6(1)(f), and legal obligations where applicable, Article 6(1)(c)
Measure traffic, journeys, product use, and checkout performance through DataFast and PostHog	Pseudonymous identifiers, device and usage data, page activity, and masked session recordings	Our legitimate interests in understanding and improving the Site, Article 6(1)(f), subject to applicable cookie and similar-technology requirements
Attribute a qualifying visit or purchase to an affiliate through Affonso	Referral identifier, visit, device, and conversion data	Our legitimate interests in operating and measuring the affiliate program, Article 6(1)(f), subject to applicable cookie and similar-technology requirements
Provide the Tawk.to live-chat widget	Chat connection, device, usage, and message data you provide	Our legitimate interests in offering support, Article 6(1)(f), and steps taken at your request or contract where the chat becomes a support request, Article 6(1)(b)
Send optional product news and offers	Email address, subscription status, and engagement data	Your consent, Article 6(1)(a). You may unsubscribe at any time
Establish, exercise, or defend legal claims and enforce our terms	Relevant account, order, communication, and log data	Our legitimate interests in protecting legal rights, Article 6(1)(f), or a legal obligation, Article 6(1)(c)

Our legitimate interests do not automatically override your rights. We consider the purpose, necessity, expected impact, and safeguards before relying on Article 6(1)(f). You may object to this processing as described below.

Where processing is based on consent, you can refuse or withdraw consent without losing access to the Site’s necessary functions. Withdrawal does not make earlier consent-based processing unlawful.

Cookies and Similar Storage

We use cookies, local storage, and session storage. Necessary storage supports security, account sessions, cart or checkout functions, and delivery of a service you request. Other storage supports analytics, affiliate attribution, and live chat.

The short notice shown on the Site is informational and can be dismissed with Got it. Dismissing it does not change browser settings or create a record of consent. The dismissal is stored in local storage as gats-cookie-notice until you clear browser data or we change the notice version. It is classified as Necessary.

You can block or delete cookies and browser storage through your browser settings. Blocking account, cart, or checkout storage may prevent those features from working. Where applicable law requires prior consent for a non-essential cookie or similar technology, that requirement applies independently of the informational notice.

DataFast Storage Register

DataFast provides first-party website and purchase-attribution analytics. These items are all classified as Analytics.

Name and type	Purpose	Duration	Classification
datafast_visitor_id cookie	Recognizes a pseudonymous returning visitor and connects visits with journey and revenue attribution	365 days	Analytics
datafast_visitor_first_seen_at cookie	Stores the first-visit time for first-seen, cohort, and new-versus-returning measurement	365 days	Analytics
datafast_session_id cookie	Groups page views and goals into a session and supports purchase attribution	30 minutes, renewed on tracked activity	Analytics
datafast_visitor_session_count cookie	Stores the pseudonymous visit number used for new-versus-returning and visit-count analysis	365 days	Analytics
datafast_pageview_state session storage	Stores the current page URL and time to suppress a duplicate page view within 60 seconds	Current browser-tab session	Analytics

DataFast also receives the page URL, referrer, campaign and ad-click parameters when present, viewport and screen size, language, timezone, device and browser information, IP address, country derived from the IP address, and configured site events. When you are signed in and the Site has confirmed your profile, we may send an internal account identifier to connect the pseudonymous journey with the same account across sessions. We do not intentionally send contact-form messages, names, email addresses, license keys, or full payment details to DataFast. For purchase attribution, the pseudonymous DataFast visitor and session identifiers may be included in Paddle transaction metadata.

Other Tools

• PostHog analytics: may use ph_*_posthog cookies or browser storage for a pseudonymous visitor and session, page and interaction analytics, and session recording. Form inputs are configured to be masked and console-log recording is disabled.
• Affonso affiliate attribution: may set the affonso_referral cookie for 30 days when a visitor arrives through an affiliate link so a qualifying purchase can be attributed to the referring partner.
• Tawk.to live chat: may use cookies and local storage such as tawk_uuid_*, twk_idm_key, twk_token_*, and TawkConnectionTime to maintain the chat connection and recognize a returning chat visitor.
• Paddle checkout: may use cookies or similar technologies needed to open and secure checkout, prevent fraud, remember the checkout session, and process a transaction you request. Paddle controls its own storage and describes it in its privacy and cookie notices.

Browser controls can also block or delete storage. Blocking necessary account or checkout storage may prevent those features from working.

Service Providers and Other Recipients

We disclose only the data reasonably needed for a provider to perform its role or where the law permits or requires disclosure. Recipients may include:

• Cloudflare for hosting, content delivery, network security, request handling, and server logs
• Paddle as merchant of record for checkout, payment, tax, refunds, fraud prevention, receipts, and buyer support
• DataFast for site, funnel, and revenue-attribution analytics
• PostHog for product analytics and masked session recording
• Affonso for affiliate attribution
• Tawk.to for live chat when enabled
• Resend and other email-delivery infrastructure for verification, order, access, and support emails
• GitHub when you choose to connect an account or obtain repository access
• professional advisers, auditors, insurers, courts, regulators, law enforcement, or a buyer of the business when disclosure is lawful and necessary

We do not sell or rent personal data. We do not disclose contact-form contents to analytics providers for advertising.

Third-party sites and services have their own privacy notices. Their independent processing is governed by those notices, not this policy.

International Data Transfers

Our providers may process data in countries other than the country where you live, including the United States and Singapore. Those countries may have different data-protection laws.

Where EU, EEA, or UK transfer rules apply to data for which we are responsible, a transfer must use a permitted mechanism, such as an adequacy decision, approved standard contractual clauses with any required supplementary measures, or another lawful exception. Provider privacy notices and data-processing terms describe their locations and transfer arrangements. Contact our Privacy Contact if you want information about safeguards relevant to your data.

How Long We Keep Data

We keep personal data only for as long as necessary for the purpose for which it was collected, including legal, accounting, security, support, dispute, and enforcement needs.

• Account and entitlement records are kept while an account or download entitlement remains active and for a reasonable period afterward to handle restoration, disputes, fraud, and legal claims.
• Order, payment, refund, and tax records are kept for the period required by applicable accounting, tax, consumer-protection, and anti-fraud laws. Paddle separately applies its own retention periods.
• Contact and support records are kept while a request is open and afterward only as reasonably needed to document the resolution, provide follow-up support, prevent abuse, or handle a dispute.
• Security and diagnostic logs are kept for the shortest period reasonably needed to investigate incidents, maintain service integrity, and meet legal requirements, subject to provider settings.
• Marketing data is kept until you unsubscribe or the list is retired, unless a minimal suppression record is needed to honor your opt-out.
• The cookie-notice dismissal remains in browser storage until you clear it or we change the notice version. The browser-storage lifetimes for DataFast are listed above. Browser expiry does not necessarily equal the retention period of analytics records held by a provider, which is controlled through provider settings and deletion requests.

When data is no longer needed, we delete or anonymize it unless the law requires continued retention. Backup copies may remain for a limited recovery cycle before being overwritten.

Data Security

We use technical and organizational measures appropriate to the nature of the data and the risks involved. These include HTTPS in transit, access controls, limited service credentials, bounded request handling, and separation of full payment-card processing from our systems. No online service can guarantee absolute security.

Your Privacy Rights

Subject to the law that applies and any lawful exceptions, you may have the right to:

• receive clear information about processing
• request access to your personal data and a copy of it
• correct inaccurate or incomplete data
• request deletion of data
• restrict particular processing
• receive data you provided in a structured, commonly used, machine-readable format and ask that it be transferred where technically feasible
• object to processing based on legitimate interests
• object at any time to direct marketing
• withdraw consent at any time
• complain to a data-protection supervisory authority

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects for you.

To exercise a right, email our Privacy Contact. Describe the request and the email address or order involved. We may need to verify your identity before disclosing or changing data. We generally respond within one month where the GDPR or UK GDPR applies, although the law permits an extension for complex or numerous requests. We will explain any extension or lawful refusal.

Some data cannot be deleted immediately when it must be kept for a legal obligation, fraud prevention, transaction record, security investigation, or legal claim. We will explain any applicable limitation.

Complaints and Supervisory Authorities

Please contact us first if you believe we have mishandled personal data so we can investigate.

If you are in the EEA, you may lodge a complaint with the national supervisory authority in the country of your habitual residence, your place of work, or the place of the alleged infringement. The European Data Protection Board directory lists the relevant national authorities and their contact details.

If you are in the United Kingdom, the national supervisory authority is the Information Commissioner’s Office (ICO). You can use the ICO’s complaint service.

If you live elsewhere, you may contact the privacy or data-protection regulator responsible for your location. A complaint does not affect any other administrative or court remedy available to you.

Children

The Site is intended for people who can lawfully enter a contract for digital products. It is not directed to children, and we do not knowingly collect personal data from a child who cannot lawfully provide it. If you believe a child has provided data, contact our Privacy Contact so we can investigate and delete it where required.

Changes to This Policy

We may update this policy when our services, providers, or legal obligations change. We will publish the revised policy here, change the last-updated date, and provide an additional notice or request fresh consent when required. Material changes do not retroactively change the legal basis for earlier processing.

Contact

Privacy questions and requests can be sent to support@getastrothemes.com with the subject Privacy Request, or submitted through our contact form.