Last updated: 1 August 2026
This notice explains what personal data ThemeStack collects, why we collect it, and what you can do about it. ThemeStack is a trading name of Terabold Ltd, and Terabold Ltd is the data controller for the information described here.
Who we are
ThemeStack is a theme studio operating in the United Kingdom. It is a trading name of Terabold Ltd, a company registered in England and Wales under number 16687390, with its registered office at 34-40, High Street Wanstead, London, England, E11 2RJ. You can reach us at hey@terabold.com for anything in this notice, including data requests.
What we collect
We collect three categories of data and nothing else.
Account data. Your email address, your name if you give it, and the sign-in records needed to keep you logged in. We create your account automatically when you buy, because you need somewhere to download from.
Purchase data. What you bought, when, the amount, the currency and the licence keys issued to you. Card details never reach our servers; our payment processor handles them and returns only a reference and the last four digits.
Technical data. Server logs containing IP address, browser user agent, requested URL and timestamp. Download records showing which licence downloaded which file and when, which is how we detect licence abuse.
We do not collect special category data, we do not buy data from brokers, and we do not run advertising trackers on this site.
Why we are allowed to use it
We rely on three lawful bases under the UK General Data Protection Regulation.
Contract: account data and purchase data are necessary to sell you a licence and let you download it. Without them there is no transaction.
Legitimate interests: server logs and download records, used to keep the service secure and to enforce licence terms. We have balanced this against your interests and kept the retention short.
Consent: marketing email, and analytics that are not strictly necessary. You opt in, and you can withdraw at any time without affecting anything you have already bought.
How long we keep it
Account data is kept while your account is open and for twelve months after you ask us to close it. Purchase records are kept for seven years because tax law in the United Kingdom requires it. Server logs are kept for ninety days. Download records are kept for twenty-four months. Marketing consent records are kept for three years after you unsubscribe, so we can prove the consent existed.
Who else sees it
Our payment processor sees your email address and billing details in order to take payment. Our email provider sees your email address and the content of the messages we send you. Our hosting provider stores the database and files. Each of them is bound by a data processing agreement and none of them may use your data for their own purposes.
We do not sell personal data and we never will.
International transfers
Our servers are in the United Kingdom. Where a processor operates outside the UK, transfers are covered by an adequacy decision or by the International Data Transfer Addendum to the standard contractual clauses.
Cookies
We set one strictly necessary cookie to keep you signed in. It is HTTP-only, restricted to this site, and it expires after thirty days. Analytics cookies, if enabled, are set only after you agree, and you can change your mind from the footer at any time.
Your rights
You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive a portable copy. The GDPR page explains how to exercise each of them and how quickly we respond.
If you are unhappy with how we handle a request, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.
Changes to this notice
If we change anything material, we will update the date at the top and email account holders before the change takes effect.
ThemeStack is an independent theme studio and is not affiliated with Shopify Inc.