Diwali sale 30% Code: Diwali30 Ends in 2 days from now Shop Now →

Privacy Policy

Last updated: 23 October 2026

This policy explains how Milesgator ("we", "us"), 1/5505 Balbir nagar extension shahdara delhi-32, collects, uses and protects personal data when you use ThemeHarvest (https://themeharvest.com). We are the data fiduciary / controller for this data. It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the IT Act, 2000 and its rules, and — for users in the EU/UK — the GDPR.

1. Data we collect

  • Account data: name, username, email, password (stored only as a secure hash), country, language, optional phone number and profile details.
  • Social sign-in data: if you use Google, Facebook, GitHub or LinkedIn, we receive your account ID, name and email from that provider. We do not receive your password there.
  • Billing and order data: billing name, company, address, city, state, postal code, country, GSTIN/VAT number (if given), items bought, prices, taxes, fees, invoices and payment status.
  • Payment data: processed by our payment partners (for example Razorpay, Stripe, PayPal, Cashfree, PhonePe). We receive a payment reference and status — never your full card number, CVV or UPI PIN.
  • Author and affiliate data: payout details (bank account, IFSC, UPI ID, PayPal email, SWIFT/IBAN), identity and tax documents for KYC (PAN/tax ID), earnings and tax deducted (TDS).
  • Content you send: support tickets, messages to authors, reviews, comments, forum posts, contest entries and contact-form messages.
  • Technical data: IP address, approximate location (country), device and browser, pages visited, referral links used, and security logs (sign-ins, failed attempts).
  • Cookies: see our Cookie policy.

2. Why we use it (purposes and legal basis)

  • To create your account, sell and deliver items, issue invoices and licenses, give support and process refunds — to perform our contract with you.
  • To pay authors and affiliates, verify identity (KYC) and meet tax, accounting and anti-fraud duties — legal obligation and legitimate uses permitted by law.
  • To keep the site secure, prevent fraud, abuse, self-referrals and chargeback fraud — legitimate interest / legitimate use.
  • To send service emails (receipts, password resets, important changes) — contract.
  • To send newsletters and offers — only with your consent, which you can withdraw any time in Account → Settings or via the unsubscribe link.
  • To measure and improve the site with analytics — consent where required (see the cookie banner).

3. Who we share it with

  • The author of an item you buy: your username, the item and license, and support messages — so they can support you. Authors do not get your payment details.
  • Service providers that work for us under contract: payment gateways and banks, hosting and storage, email delivery, backups, analytics, fraud prevention and customer support tools.
  • Authorities when required by law, a court order or to protect rights and safety (for example tax authorities for TDS/GST returns).
  • A buyer of our business, if ThemeHarvest is sold or merged, under the same protections.

We do not sell your personal data.

4. International transfers

Some of our providers process data outside India (for example email or payment providers). We use providers with strong security and contractual safeguards, and transfer data only as permitted by Indian law and, for EU/UK users, with appropriate safeguards such as standard contractual clauses.

5. How long we keep it

  • Account data: while your account is active.
  • Invoices, orders, payouts and tax records: as long as tax and accounting laws require (generally up to 8 years).
  • KYC documents: while you are an author and for the period required by law afterwards.
  • Security logs: up to 12 months. Contact-form messages: up to 24 months.

When you close your account we delete or anonymise data we no longer need, except records we must keep by law.

6. Your rights

Depending on where you live, you can: access the data we hold about you; correct or update it (most of it in Account → Settings); ask us to erase it; withdraw consent; object to or restrict certain uses; receive a copy in a portable format; nominate a person to exercise your rights in case of death or incapacity (DPDP Act); and complain to a supervisory authority — in India the Data Protection Board of India, in the EU/UK your local data protection authority. Write to [email protected]; we answer within 30 days.

7. Security

HTTPS everywhere, hashed passwords, optional two-factor authentication, encrypted storage of payment keys and sensitive settings, rate limits against password guessing, role-based staff access, activity logs and encrypted backups. No system is perfectly secure; if a breach affecting you happens, we will notify you and the authorities as the law requires.

8. Children

The site is not meant for children under 18. We do not knowingly collect data from children without verifiable parental consent; if you believe we have, contact us and we will delete it.

9. Changes

We will post updates here and, for important changes, notify you by email or on the site.

10. Contact and grievance officer

Milesgator, 1/5505 Balbir nagar extension shahdara delhi-32. Email: [email protected].
Grievance officer: Milesgator — [email protected] (see Grievance redressal).