Privacy Policy

Last updated: September 27, 2026

StepFox Themes (“we”, “us”) sells WordPress themes and plugins at stepfoxthemes.com and runs the theme demo sites under that domain (for example stepfoxthemes.com/yardline/). This policy explains what personal data we collect on the shop and the demos, why, who we share it with, and the choices you have. It applies to all of them.

1. Who we are

StepFox Themes
75 E 3rd St #7, Sheridan, WY 82801, United States
Email: support@stepfoxthemes.com
Contact form: https://stepfoxthemes.com/contact-us/

We are the data controller for the personal data described here.

2. What we collect and why

2.1 Information you give us

Account and orders. Name, email address, billing address, country and order history when you buy a product or create an account. We need this to deliver your downloads, send order emails, provide updates and support, and keep tax records. (Legal basis: performance of a contract; legal obligation for tax records.)
VAT number. If you are a business in the EU or UK and enter a VAT number at checkout, we send it to the European Commission’s VIES service or the UK HMRC register to confirm it is valid, and we store it with the order together with the registered company name, because tax law requires it for a reverse-charged invoice. (Legal basis: legal obligation.)
Payment. Card and payment details are entered on a form served by our payment processor, Stripe. They never reach our servers. We receive only a confirmation, the last four digits of the card and the Stripe transaction reference. (Legal basis: performance of a contract.)
Support and contact. Your name, email address and the content of your message when you use the contact form, email us, or ask for support, plus any site details you choose to share so we can reproduce a problem. (Legal basis: performance of a contract or our legitimate interest in answering you.)
Newsletter. Your email address if you subscribe to our newsletter. Every email contains an unsubscribe link. (Legal basis: consent, which you can withdraw at any time.)
Account security. When you register we send a confirmation email to verify your address. Sign-up and login forms are protected by Cloudflare Turnstile, and repeated failed logins are rate-limited by IP address. (Legal basis: our legitimate interest in keeping accounts and the site secure.)

2.2 Information collected automatically

Server logs. IP address, browser type, requested page, referrer and timestamp are recorded by our hosting provider for security and troubleshooting and kept for a short period. (Legal basis: legitimate interest.)
Analytics. With your consent, Google Analytics records which pages and demos are visited, for how long, from which country and device, and which products are viewed, added to cart or bought. IP addresses are truncated by Google before storage. (Legal basis: consent.)
Advertising measurement. With your consent, Google Ads conversion measurement tells us whether a click on one of our ads led to a purchase, and WooCommerce order attribution records the source that brought you to the shop (for example “google / cpc”). We do not run remarketing lists or show you ads on other sites. (Legal basis: consent.)
Cookies. See our Cookie Policy for the full list, lifetimes and how to change your choice.

3. How we use your data

To process orders, deliver downloads, provide updates through the built-in updater, and give support.
To send transactional email: order confirmations, download links, account confirmation and password resets.
To send our newsletter, only if you subscribed.
To detect and prevent fraud, abuse and security incidents.
To understand how the shop and demos are used and to measure our advertising, only with your consent.
To comply with tax, accounting and other legal obligations.

We do not sell personal data, and we do not share it with third parties for their own marketing.

4. Who we share data with

We use the following service providers (processors). Each receives only the data it needs to perform its service for us.

Provider	Purpose	Data	Location
Stripe, Inc.	Payment processing and fraud prevention	Payment details, billing name and address, email, IP	United States / EU (privacy policy)
Google LLC (Analytics, Ads, Tag Manager)	Site analytics and advertising measurement, only with consent	Cookie identifiers, pages viewed, truncated IP, device and country	United States (privacy policy)
Cloudflare, Inc. (Turnstile)	Bot protection on sign-up and login forms	IP address, browser signals	United States / global (privacy policy)
Hostinger International Ltd.	Web hosting, transactional email delivery and newsletter delivery	All data stored on the site, server logs, newsletter addresses	EU (Lithuania) with global data centres (privacy policy)
European Commission (VIES) and HM Revenue & Customs	Checking VAT numbers entered at checkout	VAT number and country	EU / UK
jQuery CDN (code.jquery.com)	Serves a JavaScript library the site uses	IP address and browser request headers when the file is fetched	United States / global

We may also disclose data when the law requires it, to enforce our Terms of Service, or as part of a merger or sale of the business, in which case this policy continues to apply.

5. International transfers

We are based in the United States, so your data is processed there. Where data of visitors from the European Economic Area, the United Kingdom or Switzerland is transferred to the US, we rely on the providers’ Standard Contractual Clauses or their certification under the EU-US Data Privacy Framework, as noted in each provider’s privacy policy.

6. How long we keep data

Data	Retention
Orders, invoices and payment references	7 years after the order, for tax and accounting law
Account data	Until you delete your account or ask us to delete it; inactive accounts may be deleted after 3 years
Support and contact messages	2 years after the last message
Newsletter subscription	Until you unsubscribe
Security logs (failed logins, rate limiting)	30 days
Server logs	Up to 30 days
Google Analytics data	Up to 14 months
Consent choice cookie	6 months

7. Your rights

Depending on where you live, you have some or all of the following rights. Under the GDPR and UK GDPR (EEA and UK residents) and the California Consumer Privacy Act (California residents) they include:

Access a copy of the personal data we hold about you.
Correction of inaccurate data. You can edit your own details at any time under My Account.
Deletion of your data, except what we must keep by law (for example order records).
Portability: receive your data in a machine-readable format.
Objection to processing based on legitimate interest, and to direct marketing at any time.
Withdraw consent at any time, for example through the “Cookie settings” link in the footer or the unsubscribe link in any newsletter. Withdrawal does not affect processing that already happened.
No discrimination for exercising any of these rights.
Complain to your local data protection authority. EEA residents can find theirs at edpb.europa.eu; UK residents can contact the ICO at ico.org.uk.

To exercise a right, email support@stepfoxthemes.com from the address on your account, or use the contact form. We answer within 30 days. We do not sell or share personal data as those terms are defined in California law, and we honour the Global Privacy Control browser signal by treating it as a refusal of advertising cookies.

8. Security

The site is served over HTTPS. Passwords are stored as salted hashes. Card data is handled only by Stripe, a PCI DSS Level 1 provider. Administrative access is limited to our staff and protected by login rate limiting and bot protection. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as the law requires.

9. Children

The site is intended for adults and businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

10. Demo sites

The theme demos under stepfoxthemes.com/<theme>/ contain sample articles, sports data and images for demonstration only. They set the same essential and, with your consent, analytics cookies as the shop, and your cookie choice applies to all of them.

11. Changes to this policy

We will post any changes on this page and update the date at the top. For material changes we will also notify account holders by email.

12. Contact