Privacy policy.
Last updated: 14 September 2026
Velox Themes (“Velox,” “we,” “us,” or “our”) is an independently operated business based in Indonesia. We provide website templates, components, and the Velox Library.
This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our websites, use the Library, purchase products, connect an AI assistant, or contact us.
For privacy questions or requests, contact info@veloxthemes.com.
1. Information We Collect
Account information
When you create or use an account, we collect information such as your email address, name, account identifier, and profile information you provide.
If you sign in with Google, we receive information made available through the sign-in process, such as your name, email address, profile image, and Google account identifier. We do not receive your Google password.
Purchase and access information
We process information about your purchases, subscriptions, licenses, payment status, refunds, and access to Library content.
When you request purchase syncing, we use information associated with your authenticated account to locate and verify relevant purchases through our payment provider.
Payment details are collected through our payment provider’s checkout. We do not store your full payment-card number or card security code.
Library activity
We may record which resources you access, copy, remix, or download, together with relevant account identifiers, timestamps, and usage information.
These records help us deliver content, apply plan limits where applicable, maintain access rights, investigate problems, and prevent misuse.
Technical and security information
We process technical information such as IP addresses, browser and device information, request timestamps, authentication events, and diagnostic data.
This information helps us operate the service, detect errors, prevent automated abuse, and protect accounts and content.
Communications
When you contact us, submit feedback, or subscribe to updates, we collect the information you provide, including your contact details and message content.
Please do not send passwords, payment-card details, API secrets, or other unnecessary sensitive information.
2. How We Use Information
We use personal information to:
Create and manage accounts.
Authenticate users and maintain sessions.
Process purchases and provide purchased or subscribed content.
Verify licenses, subscriptions, and existing purchases.
Provide Library features and authorized AI integrations.
Respond to support requests and feedback.
Send essential account, security, and transaction messages.
Send marketing communications where permitted.
Understand usage and improve performance.
Measure marketing effectiveness.
Detect fraud, automated abuse, and unauthorized access.
Meet applicable legal obligations and resolve disputes.
3. Grounds for Processing
Depending on the purpose and applicable law, we process personal information because it is necessary to provide services you request, comply with legal obligations, pursue legitimate interests such as service security and improvement, or act on your consent.
Where processing relies on consent, you may withdraw it. Withdrawal does not affect processing carried out lawfully before withdrawal.
We handle personal information with regard to applicable privacy laws, including Indonesia’s Law No. 27 of 2022 on Personal Data Protection. Additional rights may apply depending on your location.
4. Payments and Polar
We use Polar for checkout and related payment services. Polar processes information needed to handle transactions, billing, subscriptions, tax requirements, fraud prevention, and related services.
We receive information needed to recognize your purchase and provide access, such as transaction identifiers, product information, customer contact information, and payment or subscription status.
Polar may process information for its own legal and operational purposes, as explained in Polar’s Privacy Policy.
5. Cookies, Analytics, and Advertising
Essential functionality
We use cookies and similar technologies where needed for authentication, session management, security, and service preferences.
Blocking essential technologies may prevent sign-in or other requested features from working.
Library analytics and diagnostics
The Library uses PostHog for page-usage analytics and Sentry for error and performance diagnostics.
The Library’s current PostHog configuration disables session recordings, heatmaps, and automatic interaction capture. It uses in-memory analytics storage rather than persistent analytics storage. This configuration applies to the Library, not necessarily to our separate public website.
We apply filtering intended to reduce sensitive information in diagnostic and analytics events. Technical identifiers and diagnostic information may still constitute personal information; we do not describe all such data as anonymous.
DataFast analytics
We use DataFast to understand website traffic, referral sources, visitor activity, and the effectiveness of our marketing. Depending on the features enabled, this may include connecting visits with conversion or revenue events.
DataFast may process technical and usage information, including IP addresses and cookie-based identifiers. Where required by applicable law, optional analytics tracking requires consent.
More information is available in DataFast’s Privacy Policy.
Public website analytics and advertising
Our public website includes Google Analytics, Google Tag Manager, PostHog, and Meta Pixel integrations.
These technologies may process information about visits, devices, referrals, and interactions for analytics, campaign measurement, and advertising purposes. Advertising providers may associate information with other information they hold, subject to their own policies and your settings.
Where consent is required, optional tracking requires your consent. Visiting the website alone does not constitute consent to optional tracking.
You can also use browser controls and relevant provider settings to limit tracking. These controls may not affect information already collected.
6. Cloudflare Turnstile and Security
We use Cloudflare Turnstile to help distinguish legitimate visitors from automated traffic and protect features such as email authentication.
Turnstile processes technical browser, device, and network signals for verification and security purposes.
Cloudflare’s processing is described in its Privacy Policy and Turnstile Privacy Addendum.
7. AI Assistants and MCP Connections
You may choose to copy Library content into an AI assistant or connect a compatible assistant through our Model Context Protocol (“MCP”) integration.
When you authorize a connection, the assistant may request information and content available through that connection, subject to your account permissions. We process relevant authorization information, tool requests, and usage records to provide and secure this functionality.
Information returned to your chosen assistant is handled under that provider’s privacy policy and your agreement with them.
Connecting an assistant does not give Velox general access to your unrelated conversations or files. However, information you include in requests sent to Velox may be processed as part of those requests.
Do not include confidential client information or personal information in requests unless necessary and you have permission to share it. Contact us if you need help disconnecting an integration.
8. Who Receives Information
We disclose information where necessary to operate our services, including to providers supporting:
Hosting and website delivery, including Framer and Vercel.
Database and authentication services, including Supabase and Google sign-in.
Payments and subscriptions, including Polar.
Security and content delivery, including Cloudflare.
Transactional email delivery, including Resend.
Analytics and diagnostics, including PostHog, DataFast, Sentry, and Google.
Advertising measurement, including Meta.
AI services you choose to connect.
Providers receive information relevant to the services they perform. Some providers also act independently for purposes described in their own privacy policies.
We may also disclose information when legally required, to protect rights or safety, or in connection with a business transfer subject to appropriate protections.
We do not sell customer account or purchase records for money. Advertising-related disclosures may be treated as “sharing” or a “sale” under certain privacy laws, and applicable rights remain available.
9. International Processing
We operate from Indonesia, but our service providers may process or store information in other countries, including the United States.
Where required by applicable law, we take steps to establish an appropriate basis and safeguards for international transfers. These may include contractual protections and other legally recognized mechanisms.
You may contact us for information about the safeguards relevant to your data.
10. How Long We Retain Information
We retain information for as long as reasonably necessary for the purposes described in this policy.
For example:
Account information is retained while needed to maintain your account.
Purchase and entitlement records may be retained to preserve ongoing access, including permanent or Lifetime access, and meet legal obligations.
Security and diagnostic records are retained according to operational needs and provider retention settings.
Support correspondence is retained while needed to resolve requests and maintain relevant records.
Marketing information is retained until you unsubscribe or it is no longer needed. We may retain a minimal suppression record to respect your choice not to receive marketing.
Account deletion does not necessarily require immediate deletion of records we must retain for legal, tax, fraud-prevention, or dispute-resolution purposes. Residual backup copies may remain until they expire through the applicable backup lifecycle.
11. Your Rights and Choices
Depending on applicable law, you may have rights to:
Obtain information about how your data is processed.
Access and receive a copy of your personal information.
Correct inaccurate or incomplete information.
Request deletion or termination of processing.
Withdraw consent.
Object to or restrict certain processing.
Request data portability where applicable.
Raise a complaint with the relevant authority or pursue other available remedies.
Contact info@veloxthemes.com to make a request. We may need to verify your identity before acting. We will respond within the time required by applicable law and explain any lawful limitations.
You may unsubscribe from marketing emails using the unsubscribe link. Essential service messages may still be sent where needed to operate your account or complete transactions.
12. Security
We use technical and organizational safeguards intended to protect personal information, including access controls, authentication, restricted access to protected content, and security monitoring.
No service can guarantee absolute security. If a personal-data incident occurs, we will take appropriate action and provide notifications where required by applicable law.
13. Children’s Information
Velox is intended for adults using design products and related services. It is not directed at children, and we do not knowingly seek personal information from children.
If you believe a child has provided personal information to us, contact info@veloxthemes.com so we can investigate and take appropriate action.
14. External Services
Our products may include links to external services, including Framer, Figma, payment pages, and AI tools.
When you use those services, their privacy policies apply to their processing. This policy does not govern independently operated third-party services.
15. Changes to This Policy
We may update this policy as our services or practices change. We will update the date above and provide additional notice where required.
Where a change requires new consent, we will request it rather than treating continued use as consent.
