Introducing Flatsome Site Builder. A new beginning for Flatsome. Read more

Account Join early access

Legal

Privacy policy

We collect what we need to sell you Flatsome, deliver updates and help you. The Flatsome plugin on your site sends us your licence key and site address when it checks for updates, and nothing about your content or visitors.

Last updated: 30 September 2026

Who is responsible

UX THEMES AS (org. nr. 915 128 920), Haugerudveien 61B, 1434 Ås, Norway, is the controller. Contact [email protected] for anything about your data.

What we collect and why

  • Name, email, password (hashed). When: you create an account. Why: your account and licences. Legal basis: contract. Kept: until you delete your account, then 30 more days before it is permanently deleted.
  • Envato username, email and Classic purchase details. When: you sign in with Envato. Why: verifying Classic licences for early access. Legal basis: contract. Kept: until you delete your account, then 30 more days before it is permanently deleted.
  • Order details: name, email, country, tax ID, amount. When: you buy or renew. Why: delivering your order, accounting. Legal basis: contract, legal duty. Kept: 5 years (bokføringsloven).
  • Licence key, activated site addresses, environment (production, staging or local), activation dates. When: you activate Flatsome. Why: enforcing site limits, updates. Legal basis: contract. Kept: until you delete your account, then 30 more days before it is permanently deleted.
  • Site address, WordPress and Flatsome versions, update channel, server IP address. When: your site checks for updates, about twice a day. Why: delivering the right updates, preventing licence abuse. Legal basis: legitimate interest. Kept: for a limited time, for security and troubleshooting.
  • Your browser’s IP address and search terms. When: you browse the pattern library, icon picker or demo sites in the plugin. Why: serving patterns and icons. Legal basis: legitimate interest. Kept: for a limited time, for security and troubleshooting.
  • Support messages. When: you contact us. Why: answering you. Legal basis: contract, legitimate interest. Kept: 5 years after the last message.
  • Email address for news. When: you opt in. Why: product news and offers. Legal basis: consent. Kept: until you unsubscribe.

Card details go straight to Stripe. We never see or store them.

What we don’t collect

The Flatsome plugin sends no usage tracking, no analytics and no content from your site. Your site’s visitors, form entries, orders and customers stay in your own WordPress database. If you connect an AI assistant through Flatsome’s MCP server, your content goes to that assistant’s provider under your own agreement with them, not to us.

Who we share it with

  • Stripe and Link, LLC process payments. Link is the reseller of your order and a separate controller for payment data (Link privacy policy).
  • Service providers acting for us for hosting, email delivery, customer support and feedback. Each works under a data processing agreement.
  • Envato, if you choose to sign in with Envato (Envato privacy policy).
  • Authorities, when the law requires it.

We don’t sell your data.

Transfers outside the EEA

Some providers are in the United States. We rely on the EU-US Data Privacy Framework where the provider is certified, and on the EU standard contractual clauses otherwise.

Your rights

You can ask for a copy of your data, and ask us to correct it, delete it, restrict its use or move it to another service. You can object to use based on legitimate interest, and withdraw consent at any time. Email [email protected]; we reply within one month. You can also complain to Datatilsynet, the Norwegian Data Protection Authority, or to the authority where you live.

Your site’s own privacy policy

When you build a site with Flatsome, you are responsible for your visitors’ data. Flatsome blocks that embed YouTube, Vimeo, Google Maps or Instagram connect visitors to those services, and some Flatsome blocks set first-party cookies when a visitor dismisses a notice or passes an age gate. Mention these in your own privacy policy.

Cookies

flatsome.com and my.flatsome.com only use cookies that the sites need to work, so we don’t ask for consent or show a cookie banner. If we ever add analytics or marketing cookies, we’ll ask first and update this page.

  • Sign-in cookies (my.flatsome.com). Keep you signed in to your account. Necessary.
  • Security cookies (my.flatsome.com). Protect forms against misuse. Necessary.
  • __stripe_mid, __stripe_sid (Stripe). Fraud prevention at checkout. Necessary. Lasts 1 year and 30 minutes.

Changes

We’ll post changes here and email account holders about significant ones.