Privacy policy

1. Who holds your data

Nxlogy Solutions Private Limited, at D31, 3rd Floor, Sector 10, Noida 201301, Uttar Pradesh, India, is the data fiduciary and controller for the personal data described here. Write to us about anything on this page at [email protected].

2. What we collect, why, and for how long

We rely on performance of a contract for anything needed to sell and run your licence, on legal obligation for invoices and tax records, and on our legitimate interest in preventing fraud and unlicensed distribution for activation and download records. Where we rely on consent — marketing email — you can withdraw it at any time and it changes nothing else.

3. What the software sends us

Our plugins, themes and applications contact AiryThemes for two purposes: to check the licence and look for updates, and to tell licensed installations from unlicensed ones.

• What is sent: the licence key where one is present, the address of the site or server the software is installed on, version numbers for our software and for the platform it runs on, and an identifier unique to the download we issued to you. Nothing else.
• When: when a licence is activated, and periodically while the software is running — including where no valid licence key is present, which is what lets us identify unlicensed installations.
• Where more than one of our products is installed on the same site, a check may report that our other product is present and which version it is. It looks only at our own products; nothing about any other plugin, theme or application on your site is read or sent.

We do not receive any information about you beyond this, about anyone using your site, or about anyone visiting it. The software does not read your site's content, your database, or your visitors' data. Where a check runs inside an administration screen it never runs on your public-facing site, so your visitors never contact us. No cookies are set and nothing is stored in anybody's browser.

We use this to run the licence, to deliver updates, and to identify installations running without a valid licence, which is a breach of our licence terms. Our lawful basis is our legitimate interest in providing the software and enforcing those terms. Records of unlicensed installations are kept for 24 months and then deleted. Entering a valid licence key ends that reporting; to stop all of it, uninstall the software.

Because none of your site's own data reaches us, we are not a processor of it. You remain the controller of whatever your site collects, and our software does not send it anywhere.

4. Payments

Card details are handled entirely by our payment processors and never reach our servers. We receive a transaction reference, the amount, the result, and the billing details needed for the invoice. Our processors are independent controllers of the data they collect and apply their own privacy policies.

5. Who else sees your data

We share personal data only with the providers below, who process it on our instructions and are bound to protect it, with our professional advisers, and with any authority where the law requires it.

We do not sell your data, we do not rent it, and we do not use it to advertise to you elsewhere. If the business is sold, data transfers with it, and this policy continues to apply until you are told otherwise.

6. Where your data is held

Our website, the application behind it and its database are hosted on servers operated by IONOS in the United States. Cloudflare provides content delivery, file storage and abuse protection from its global network. The other providers named in section 5 may process data in the countries shown there.

We remain responsible for your data wherever it is processed. Where it moves between countries we rely on the transfer terms agreed with each provider and on the mechanisms the applicable law provides. If you want to know where a particular piece of your data sits, ask us and we will tell you.

7. Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete your account, object to processing based on legitimate interest, or withdraw consent to marketing. Write to the address in section 1. We act within 30 days, and identify you first — we will not hand your data to someone who merely knows your email address.

Deletion has one limit worth stating plainly: records we are legally required to keep survive the deletion of your account. Invoices, in particular — we are not permitted to destroy them, and no request can make us. Everything not held for that reason goes, and what remains is not used for anything else.

If you think we have handled your data badly, tell us first — we would rather fix it. You can also complain to your data protection authority.

8. Cookies

We use cookies to keep you signed in, remember your cart and your currency, and protect forms against forgery. These are necessary for the site to work and cannot be turned off while you use it. We do not use advertising or cross-site tracking cookies.

9. Security and children

We protect your data with measures appropriate to its sensitivity, including encryption in transit, access control, and two-factor authentication on staff accounts. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authority as the law requires.

This service is not for children under 18, and we do not knowingly collect their data.

10. Changes

We update this policy when what we do changes. The date at the top is the last change. Material changes are emailed to account holders.