Privacy Policy

1. Who We Are and the Scope of This Policy

TakeTheme is a SaaS platform for building online stores.

This policy applies to:

• Direct users of the Platform.
• Data of the Merchant's customers on stores built through the Platform (in which case the Merchant is the data controller and TakeTheme is a processor acting on their behalf).

2. Data We Collect

• Identity and contact: name, email address, phone, address.
• Account data: login details, settings, permissions.
• Payment and billing: processed through certified payment providers; we keep a transaction reference, not full card details.
• Usage and technical: IP address, browser/device type, log files, in-product events, cookie/SDK identifiers.
• Support and communications: support messages, reports, call/ticket records.

3. How We Collect Data

• Directly from you through forms and the dashboard.
• Automatically from your device/browser through cookies and similar technologies.
• From third parties when you use integrations (payments/support/analytics), subject to their terms.

4. Why We Process Data

• Operating, providing, and maintaining the Services.
• Managing subscriptions and billing, preventing fraud, and managing risk.
• Security, system protection, and improving performance and user experience.
• Operational communication (updates/maintenance) and permitted marketing communication, with the option to unsubscribe at any time.
• Compliance with legal obligations and requests from competent authorities.

5. Data Sharing (Categories of Recipients)

• Hosting and cloud infrastructure providers.
• Licensed payment gateway providers.
• Support, messaging, and ticketing service providers.
• Analytics, performance, and security tools.
• Official authorities where a legal obligation exists.

Sharing happens under appropriate contracts and suitable security and confidentiality standards. We do not sell your personal data.

6. Cross-Border Transfers

We may store or process your data outside your country for hosting or operational purposes.

We comply with local requirements in the countries where we operate, including Egypt and the Middle East, and apply appropriate safeguards for secure transfers.

7. Data Retention

We retain data for as long as necessary to fulfill the stated purposes, or as required for legal, tax, and dispute-resolution reasons, then delete or anonymize it according to our internal policies.

8. Security

We apply appropriate technical and organizational controls (encryption where needed, access control, audit logs, backups).

That said, no method of transfer or storage is 100% secure.

9. Services Marketplace

The Services Marketplace lets merchants hire vetted developers for work on their stores. It is governed by the Developer Terms, the Services Refund Policy and the Dispute Policy. This section adds to the rest of this policy for the marketplace.

• Roles: for a store's data and its customers' data, the merchant is the controller and TakeTheme processes it on the merchant's behalf. A developer the merchant gives store access to acts only on the merchant's instructions, under a data-processing clause that both accept. For developer accounts, identity verification (KYC), payouts and marketplace orders, TakeTheme is the controller.
• What we collect from developers: account and profile data, portfolio, services, payout details, and identity verification: the front and back of an ID document and a selfie.
• KYC and the selfie: ID images and the selfie are sensitive data; the selfie is a facial image used to check that you match your ID. We use them only to verify identity, prevent fraud, process payouts and meet legal obligations. They are stored privately and only authorised staff can see them. They are currently kept for up to 5 years after your last activity on the platform (record-keeping obligations), then deleted.
• Store-access logs: every request a developer makes with store access (time, address, browser and action) is logged, is visible to the merchant and our staff, and is kept for 1 year.
• Order chats: deleted 2 years after the order closes, unless a dispute or a bank chargeback is still open.
• Payments and invoices: marketplace payments are processed by Kashier, a licensed payment provider in Egypt; we do not store full card details. Orders, invoices, payouts and accounting records are kept for as long as tax and accounting law requires, even after an account is deleted. Records of your acceptance of the marketplace policies (version, date, IP address and browser) are kept as evidence.
• Your rights: developers can download their data and ask for their account to be deleted from the Privacy & data page of the developer dashboard (dev.taketheme.com). Merchant dashboard users can do the same from Profile → Privacy & data. Anyone can also email Main@taketheme.com. We answer within 30 days. A deletion waits until open orders, payouts, disputes and balances are settled; records the law requires us to keep stay, without your name where possible.
• Where the data is processed: the platform, its databases and our own mail server run on Hetzner Online GmbH's cloud in Falkenstein, Germany, and files, including KYC documents, are stored in Hetzner object storage in the same region. Error reports from our apps go to Sentry's EU region (Germany). Card payments go to Kashier in Egypt. Data of users in Egypt and Saudi Arabia may therefore be processed outside their country, with the safeguards described in section 6.

10. Your Rights

• Access and obtain a copy of your data.
• Correct and update your data.
• Object within the limits of applicable law.
• Request erasure/destruction when the data is no longer needed or a violation exists.

Merchant dashboard users can also download their own data or ask for their account to be deleted from Profile → Privacy & data, and developers from the Privacy & data page of the developer dashboard. We answer deletion requests within 30 days.

To exercise your rights, email Main@taketheme.com with identity verification details and the type of request, and we will respond within a reasonable timeframe.

11. Children

We do not target anyone under 18. If we learn of unintentional collection, we take steps to delete the data.

12. Changes to This Policy

We may update this policy and indicate the new effective date, with clear notice of material changes.