Privacy Policy

Theme FullStack Ltd -Version 2.1 — August 2026

This Privacy Policy describes how Theme FullStack Ltd collects, uses and protects the personal data of users of its website, of FullStack Hub, of the FullStack MCP service and of its other services, in accordance with Regulation (EU) 2016/679 (GDPR) and the Maltese Data Protection Act.

1. Data controller

The controller of personal data is:

Theme FullStack Ltd

‍203 Triq Tal-Franciz, Apartment 2, IS-SWIEQI, SWQ 2132, Malta

Registration: Malta — No. C114160

Contact: contact@themefullstack.com

For any question regarding your personal data or the exercise of your rights, you may write to contact@themefullstack.com.

2. Personal data collected

Depending on your use of our services, we may collect the following categories of data:

Identity and contact: first name, last name, email address, phone number, country.
Billing data: billing address, VAT number, payment information and history (banking data is processed by Stripe and never stored by us).
Account and licence data: FullStack Hub credentials, Shopify store admin URL, data related to the licence and its activation.
FullStack MCP usage data: connected sessions and devices (OAuth authentication), service usage logs (account concerned, timestamp, tool called, theme version, error codes). These logs do not contain the content of the files processed (see section 5).
Support data: exchanges with customer support, screenshots or information you provide in that context.
Usage and browsing data: audience measurement, navigation, session and consent data, where the relevant trackers are accepted.
Affiliate data: information needed to manage the affiliate programme, where applicable.

3. Purposes and legal bases for processing

We process your data for the following purposes, each based on the legal basis indicated:

Managing orders, payments and invoicing — Performance of the contract (art. 6(1)(b)).
Managing the account, FullStack Hub and the licence manager — Performance of the contract (art. 6(1)(b)).
Verifying and managing licences; fraud and piracy prevention — Legitimate interest (art. 6(1)(f)).
Providing the FullStack MCP service (authentication, access, on-the-fly processing of submitted files) — Performance of the contract (art. 6(1)(b)).
Security of FullStack MCP (session and device management, prevention of misuse and mass extraction) — Legitimate interest (art. 6(1)(f)).
Improving the FullStack MCP service and aggregated usage statistics — Legitimate interest (art. 6(1)(f)).
Managing customer support — Performance of the contract / legitimate interest.
Sending emails related to the purchase and customer relationship — Performance of the contract / legitimate interest.
Sending marketing communications — Consent (art. 6(1)(a)) or legitimate interest, as applicable.
Managing the affiliate programme — Performance of the contract.
Complying with legal, accounting and tax obligations — Legal obligation (art. 6(1)(c)).
Audience measurement, analytics, session replay, advertising and retargeting — Consent (art. 6(1)(a)).
Handling data subject requests — Legal obligation.

4. Recipients and processors

Data is accessible to authorised staff within Theme FullStack Ltd, within the limits of their duties. It may be shared with the providers and processors involved in operating the service, in particular:

Stripe — Payments, invoicing, subscription management.
Supabase — Database (accounts, licences); hosting of FullStack Hub.
Vercel — Application hosting of FullStack Hub.
Webflow — Hosting of the website themefullstack.com.
Shopify — Platform on which the Theme is installed by the Customer.
Brevo — Email sending (transactional and marketing).
Google (Workspace / Gmail) — Business email.
PostHog — Audience measurement and navigation analysis.
Tracklution — Conversion tracking.
Google Ads / Meta Ads — Advertising and retargeting.
n8n — Internal automations.

Billing data may also be accessible to Theme FullStack Ltd's accountants in Malta.

FullStack Hub is Theme FullStack Ltd's proprietary platform; it relies technically on Supabase and Vercel, listed above.

Data is never sold to third parties.

5. FullStack MCP: specific data flows

FullStack MCP is a service that connects the artificial intelligence assistant chosen by the customer ("third-party AI": for example Claude by Anthropic, or Cursor) to Theme FullStack Ltd's documentation and processing tools. Its operation involves the following data flows:

No access to your Shopify store. The FullStack MCP server never connects to your store and holds no credentials or access token relating to it. Operations on your store are carried out by you, from your machine, via the official Shopify tool (Shopify CLI).
Volatile file processing. The theme configuration files that your third-party AI sends to the server (for validation, audit or migration) are processed on the fly and then immediately discarded: they are neither retained nor used for any other purpose — in particular not for training artificial intelligence models. Usage logs do not contain the content of these files. We recommend that you do not include personal data in the theme files you submit.
Transit through your third-party AI. Your instructions and files pass through the third-party AI you have chosen, within the framework of the contract between you and its provider (for example Anthropic) and in accordance with that provider's privacy policy. Theme FullStack Ltd is neither the controller nor the processor of the processing carried out by your AI provider, over which it has no control. We invite you to read your AI provider's privacy policy.
Sessions and devices. Access to FullStack MCP is authenticated via your FullStack Hub account (OAuth). You can view and revoke connected sessions and devices at any time from FullStack Hub.

6. Hosting

The website themefullstack.com is hosted by Webflow, Inc. (398 11th Street, 2nd Floor, San Francisco, CA 94103, USA).
The FullStack Hub platform (app.themefullstack.com) is hosted by Vercel Inc. (USA) and Supabase (database).
The FullStack MCP server (mcp.themefullstack.com) is hosted by Vercel Inc. (USA), with a Supabase database.

7. Transfers of data outside the European Union

Some providers (in particular Stripe, Vercel, Webflow, Google, Meta) are located outside the European Union or may transfer certain data there. In such cases, Theme FullStack Ltd ensures that these transfers are governed in accordance with the applicable regulations, in particular on the basis of an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework) or appropriate safeguards such as Standard Contractual Clauses (SCCs).

8. Retention periods

Data is kept for as long as necessary for the purposes pursued, then deleted or anonymised. The periods applied, aligned with the longest legal obligations where they exist, are as follows:

Billing, accounting and tax data: 10 years, in accordance with Maltese legal obligations to keep accounting records (the legal period prevails over any other).
Account, licence and support data: for the duration of the contractual relationship, then until the expiry of the applicable limitation period (for evidentiary purposes), unless a longer legal retention obligation applies.
Data of prospects and persons without an active contractual relationship: up to 3 years from the last contact.
FullStack MCP usage logs: 12 months, then deleted or aggregated into anonymous statistics.
Sessions and devices connected to FullStack MCP (OAuth): for the duration of the session's validity, and at the latest until revoked from FullStack Hub.
Files processed by FullStack MCP: not retained (on-the-fly processing only).
Data from consent-based trackers: in accordance with the settings of the relevant tool and your choices, not exceeding the periods recommended by the competent authorities.

9. Security

Theme FullStack Ltd implements appropriate technical and organisational measures to protect personal data against loss, unauthorised access, disclosure or alteration. Payment data is processed exclusively by Stripe, PCI-DSS Level 1 certified, and is never stored by Theme FullStack Ltd.

10. Your rights

In accordance with the GDPR, you have, as applicable, the following rights:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to object;
right to data portability;
right to withdraw your consent at any time, where processing is based on it;
right to give directions regarding the fate of your data after your death.

You may exercise these rights by writing to contact@themefullstack.com. A response will be provided within the time limits set by the regulations.

You also have the right to lodge a complaint with a supervisory authority:

Malta: Information and Data Protection Commissioner (IDPC) — idpc.org.mt
France: Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr
or the supervisory authority of your country of residence.

11. Cookies and trackers

The website uses cookies and other trackers. Some are strictly necessary for the website to function; others are only placed or read with your consent, where required. Consent management is handled via Axeptio.

The trackers used may enable, in particular: audience measurement, navigation analysis, session replay and heatmaps, advertising and retargeting, and conversion tracking with consent management.

You may change your choices at any time via the cookie management module available on the website.

12. Amendments to this policy

Theme FullStack Ltd may amend this Privacy Policy to reflect changes in its services or in the regulations. The applicable version is the one published on the website at the date you consult it. In the event of a substantial amendment, information will be provided by appropriate means.

13. Contact

For any question regarding this Privacy Policy or your personal data: contact@themefullstack.com.

203 Triq Tal-Franciz, Apartment 2, IS-SWIEQI, SWQ 2132, Malta

‍