Envato
- The documents do not say whether your data trains AI.
- Your data is used to target ads at you; you can opt out.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Envato collects a lot of personal data, including ID selfies for authors, and treats ads as sharing you can email to stop.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, IDs, selfies for authors, browsing, location, and inferences, plus data from other sources.
Read the exact line
Privacy policy
“IdentifiersThis includes names, addresses (both physical and email) personal identifiers (including online, internet protocol addresses, or other similar identifiers.”
Training
They use data to run the marketplaces, verify authors, meet legal duties, and advertise on other platforms.
Read the exact line
Privacy policy
“We don’t sell your personal information, but the way that we advertise our products to you on different platforms is considered in some states in the USA, including in California, to amount to sharing or disclosure.”
Sharing
Service providers (including Jumio for ID checks) see data; ads on other platforms can count as sharing.
Read the exact line
Privacy policy
“Envato Verify will be carried out by our service provider Jumio Corporation located at 395 Page Mill Road, Suite 150, Palo Alto, California, United States of America (“USA”).”
Kept
Author ID photos and selfies are deleted after verification; other retention times are not clearly stated.
Read the exact line
Privacy policy
“We will use your Photo ID document and your selfie solely to carry out Envato Verify and delete it after the completion of this process.”
Controls
You can email their privacy team to access, delete, or say do not sell or share my data.
Read the exact line
Privacy policy
“If you don’t want us to do that you can opt out by emailing us at privacy.champion@envato.com.”
Fine print
Not for under-16s; 16–18 need a parent to register. No terms here on suing, refunds, or account closure.
Read the exact line
Privacy policy
“Our Sites and/or Products are not suitable for children under the age of 16 years, so if you are under 16 we ask that you do not use our Sites and/or Products or give us your personal information”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Email Do not sell my data
privacy.champion@envato.com with subject Do not sell my data, your name, account email, and Envato service
Ask to access or delete your data
Data Protection Officer at privacy.champion@envato.com or PO Box 16122 Collins Street West, Victoria 8007 Australia
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Authors must send a face photo and ID so a company can match their face.
Read the exact line
Privacy policy
“As part of Envato Verify, you will be asked to take a selfie which will then be compared against your Photo ID document using facial recognition technology.”
For example, if you sell templates on Envato, you may have to selfie-scan your passport.
Their table says they collect sensitive categories such as race, religion, and medical conditions.
Read the exact line
Privacy policy
“Protected Classification characteristics under Californian or federal law.This includes age, race, colour, ancestry, national origin, citizenship, religion or creed, marital status, medical conditions, physical or mental disability, sex, sexual orientation, veteran or military status, genetic information.”
For example, they list medical conditions as collected even if you only wanted to buy a theme.
They say they do not sell data, but ads on other sites still count as sharing in some places.
Read the exact line
Privacy policy
“We don’t sell your personal information, but the way that we advertise our products to you on different platforms is considered in some states in the USA, including in California, to amount to sharing or disclosure.”
For example, you might see Envato ads on another site based on your Envato use unless you email to opt out.
They say they collect physical location or movements.
Read the exact line
Privacy policy
“Geolocation date Physical location or movements. Yes No”
For example, they may log where you are even if you only needed an account email.
They say the ID photo and selfie are only for the check and then deleted.
Read the exact line
Privacy policy
“We will use your Photo ID document and your selfie solely to carry out Envato Verify and delete it after the completion of this process.”
For example, after Jumio finishes matching your face, they say those files should not stay on file.
Stopping ad sharing is not an in-app switch; you must email them.
Read the exact line
Privacy policy
“If you don’t want us to do that you can opt out by emailing us at privacy.champion@envato.com.”
For example, you write “Do not sell my data” plus your account email to opt out.
They describe passwords, two-factor login, and encryption, but still say they cannot guarantee security.
Read the exact line
Privacy policy
“We use reasonable organizational, technical and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration and destruction of the personal information we process, including username and password authentication, two-factor authentication, and data encryption where appropriate.”
For example, they may encrypt data, yet a leak is still possible.
Under 16 should stay off; teens 16–18 need a parent to register. Age is self-declared.
Read the exact line
Privacy policy
“If you are aged between 16 to 18 years, you can browse the Sites and/or Products but you’ll need the supervision of a parent or guardian to become a registered user.”
For example, a 17-year-old is told to have a parent supervise before making an account.
Californians can ask to see, download, fix, or delete personal information by contacting them.
Read the exact line
Privacy policy
“the provides those residing in California or whose Personal Information has been collected in California with specific rights, including to request information about the collection of your Personal Information by us, to access your Personal Information in a portable format, to correct your Personal Information, to object to the processing of your Personal Information, and to delete Personal Information on legitimate grounds.”
For example, you email the DPO and ask them to delete your account data.
In some countries they say they need your clear yes before using biometrics.
Read the exact line
Privacy policy
“If you are located in Australia, the EEA or the UK or Mexico, we will only process your biometric information or other sensitive personal information with your explicit consent.”
For example, an author in the UK should be asked to consent before the face match.
Words to know
Legal words from the lines above, in plain English.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- precise geolocation
- Your exact position, usually from GPS, often accurate to within a few metres. For example, an app can tell not just your city but which building you are in right now.
- CCPA
- California's privacy law, which gives residents the right to see, delete and stop the sale of their data. For example, a Californian can ask the app to stop selling their data and it must comply.
- sensitive personal information
- Data that could hurt you if exposed, like health, religion, sexuality, race, exact location or bank details. For example, telling a chatbot about a medical condition creates sensitive data that some laws protect more strictly.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
How we got here · grade D · score 34/100 · 15 of 15 policy answers backed by a verified quote · 6 not stated
What does the app collect beyond what it needs to work?
They collect identifiers, IDs, internet activity, geolocation, inferences, and list sensitive CCPA categories, plus data from other sources.
Does it record your voice, face or body, and what happens to that?
Authors take a selfie matched to photo ID with facial recognition; they say those files are deleted after verification.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They advertise on other platforms in a way some states treat as sharing, and you can opt out by email.
Do they sell or share your data, and can you opt out?
They say they do not sell personal information, but ad sharing can be opted out by emailing them.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Deletion is described as a request to their privacy team, not an in-app delete-with-deadline.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They list inferences as collected, but they do not describe viewing, editing, or turning that profile off.
Do they commit to basic security, and have they leaked data?
They describe passwords, two-factor authentication, and encryption, and say they cannot guarantee internet security.
Is there a real age gate, and are teens protected?
They ask people under 16 not to use the sites; 16–18 need parent supervision to register, with no age-proof described.
Will they tell you when the rules change, and is the policy specific?
The policy is dated 2024-06-04 and lists many data types, but how long most data is kept is not specific.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 1,409 words at a college graduate level (Flesch reading ease 39.5).
