Privacy policy
Last updated: 6 October 2026
This policy explains what we do with your personal data when you buy a licence, when you write to us or when you use the client area. It is written so that it can be understood without being a lawyer, and it complies with the Reglamento General de Protección de Datos (RGPD) — the EU General Data Protection Regulation, GDPR — and the Ley Orgánica de Protección de Datos y Garantía de Derechos Digitales (LOPDGDD) — the Spanish data protection act.
Who is responsible for your data
- Owner: Juan Alberto Blanco Alarcón
- NIF (Spanish tax identification number): 78966098Z
- Address: Carrer dels Cedrers, 6 · 08184 Palau-solità i Plegamans (Barcelona)
- Email: [email protected]
What data we process and what for
| When | What we keep | What for |
|---|---|---|
| When you buy | Your email, your name and your billing details; of the payment, only the confirmation | To issue your licence, send you the key, invoice you and assist you |
| When you write to us | Your email and your message | To reply to you and keep track of the conversation |
| When you use the client area | Your email and the sign-in links (stored as a hash, never the link itself) | So that you can sign in without a password and your session is secure |
| When you install the product | Your site's domain, the installed version and the lookup dates | To count how many sites you use the licence on, give you support and notify you of important versions |
| When you browse | IP address and technical browser data, in the security logs | To detect attacks and abusive use |
| When you download a theme or a plugin | The approximate country, region and city (from the IP address), your browser language and the page you came from. The IP address itself is never stored: what is stored is a fingerprint that lets us count different downloads | To know how our themes and plugins are used |
| When you sign up for the news | Your email address, the site language, the approximate country and city, the page you signed up from and the date of signup and confirmation. The IP address is stored here, because it is part of the proof of consent | To send you news, new versions and catalogue offers, and to be able to show that you asked for it. The legal basis is your consent, and you withdraw it whenever you want with the unsubscribe link in any email |
We only ask for what is necessary. We do not build profiles with your data, we do not sell it and we do not use it for third-party advertising.
Legal bases
- Performance of the contract: to give you the licence, assist you and provide the service.
- Legal obligation: to invoice you and keep the commercial and tax records.
- Legitimate interest: to protect the service (detecting abuse, fraud or intrusion attempts) and to notify you of important changes affecting what you have bought., and to know how our themes and plugins are used (we count downloads)
How long we keep it
- Licence and billing data: while the licence is active and, afterwards, for the period required by law (tax records, up to 6 years).
- Support messages: as long as needed to resolve the matter and keep a record of the assistance.
- Client-area sign-in links: 20 minutes, and they are marked as used as soon as you click them.
- Technical security logs: for the minimum time needed to detect abuse; they are not used to profile you.
- Download log: the detail (what was downloaded and from where, approximately) for 12 months; after that, only the aggregate figure remains.
Who else sees them (processors)
To provide the service we need to rely on suppliers that process data on our behalf:
| Provider | What for | Where |
|---|---|---|
| Stripe Payments Europe, Ltd. | Charging for the licence and receipts. It processes your card details | Ireland (EU) |
| Resend, Inc. | Sending the licence emails, the client-area sign-in emails and the news to those who signed up for it | USA, with GDPR safeguards |
| Cloudflare, Inc. | Site security, firewall and acceleration | USA/EU, with GDPR safeguards |
| Google Ireland Ltd. | The mailbox where we receive your emails and reply from | EU (with GDPR safeguards) |
| The owner's own servers | Licence application, shop and backups | Spain (EU) |
Apart from these cases, we do not share your data unless a legal obligation requires us to.
Transfers outside the European Union
Some of those suppliers are in the United States. In every case the safeguards provided for by the RGPD apply (standard contractual clauses approved by the European Commission and/or the EU-US Data Privacy Framework). The servers where the application and the backups live are in the European Union.
Your rights
You can ask us for access to your data, its rectification, its erasure, the restriction of processing, object to it and ask for its portability to another provider. Write to us at [email protected] from the address you bought with and we will reply within a maximum of one month. If you believe we have not attended to you properly, you can complain to the Agencia Española de Protección de Datos (AEPD) — the Spanish data protection authority — (aepd.es), C/ Jorge Juan 6, 28001 Madrid.
How we protect the data
- All connections to the site are encrypted (HTTPS).
- We do not store passwords: the client area is entered with a single-use link sent to your email.
- We do not see or store your card details: Stripe processes them on its payment page; all we receive is the confirmation of the charge and your email.
- Access to the data is limited to what is strictly necessary, on servers with firewalls and with backups.
Minors
Our products are aimed at adults with a professional activity. We do not knowingly collect data from children under 14.
Changes
If we change this policy, we will update the date shown above and, if the change is important, we will let you know by email.
The Spanish version of this page is the one that legally binds. This English text is a translation for convenience; in case of doubt, the Spanish version prevails and can be read at https://farowp.com/privacidad.
