themeforest
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Envato collects account, device, prompts and partner data, shares with ads and AI vendors, and deletion is by request only.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Names, emails, IPs, location, photos, payments, prompts, cookies, and data from ad and login partners.
Read the exact line
Privacy policy
“The most common types of information we collect include names, usernames, addresses, email addresses, IP addresses, phone numbers, location, country of residence, other contact details, date of birth”
Training
They use it to run the sites, market, personalize ads, fight fraud, and send uploads to third-party AI tools.
Read the exact line
Privacy policy
“We share your uploaded images with our AI technology service providers only to enable the requested functionality.”
Sharing
Staff vendors, group companies, ad partners, AI providers, and sometimes the public see author details.
Read the exact line
Privacy policy
“subcontractors and service providers who assist us in connection with the ways we use personal information (as set out above), in particular: website hosting providers; artificial intelligence (AI) service providers”
Kept
They keep it as long as they say they need it; deletion is a request, and some data can stay.
Read the exact line
Privacy policy
“We retain your personal information for as long as is necessary for the purposes outlined in this policy.”
Controls
You can use a Do Not Sell or Share link, unsubscribe from marketing, and email them to delete data.
Read the exact line
Privacy policy
“to opt out of the sale or sharing of personal information or the processing and sharing of personal information for targeted advertising.”
Fine print
Material policy changes may be emailed, but keeping using the site means you accept the new rules.
Read the exact line
Privacy policy
“By continuing to use the Envato Sites after the effective date of any changes, you will be deemed to have been made aware of, and will be subject to the updated version of this policy.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Click Do Not Sell or Share My Personal Information
Footer link on the Envato website
of personal information
Help centre form at https://www.envato.com/contact/ or email the Data Protection Officer
Unsubscribe from marketing emails
Unsubscribe link in the email, or contact them as at the end of the privacy policy
Opt out of Google Analytics
Browser plug-in at https://tools.google.com/dlpage/gaoptout
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Ad networks can send them extra information about what you do on other sites, not just ThemeForest.
Read the exact line
Privacy policy
“We also receive information about you and your activities, experiences and interactions on and off the Envato Sites through partnerships with our partner ad networks.”
For example, visiting another site after ThemeForest could add to a profile used to show you Envato ads.
Other companies can show you ads later because you visited Envato.
Read the exact line
Privacy policy
“Occasionally, we will use third party advertising companies to serve ads based on prior visits to Envato Sites.”
For example, after browsing themes you might see Envato ads on a news site.
If you sell as an author, a third party can scan your face against your ID.
Read the exact line
Privacy policy
“With your explicit consent, such a third party identity verification service may require you to upload a government-issued photo ID document or, if applicable, business registration documents, as well as a “selfie” image that the identity verification service will compare to your government-issued photo ID using biometric facial recognition technology.”
For example, becoming a ThemeForest author can mean Jumio or Veriff taking a selfie and matching it to your passport photo.
Pictures you upload for AI edit or search go to outside AI companies.
Read the exact line
Privacy policy
“We share your uploaded images with our AI technology service providers only to enable the requested functionality.”
For example, uploading a photo to find similar stock images sends that photo to their AI vendor.
They collect the prompts and choices you type into tools, not only your account form.
Read the exact line
Privacy policy
“your actions on the Envato Sites (including any selections or inputs into items, or text or image prompts)”
For example, an image-generation prompt you type can be stored as personal information.
Even after you ask to delete, they can keep some records.
Read the exact line
Privacy policy
“Please note that if you request the deletion of your personal information, we may retain information from deleted accounts as necessary for our , to comply with the law, prevent fraud, collect fees, resolve disputes”
For example, closing your account may still leave transaction and fraud logs on file.
If they change the privacy rules, using the site later counts as agreeing.
Read the exact line
Privacy policy
“By continuing to use the Envato Sites after the effective date of any changes, you will be deemed to have been made aware of, and will be subject to the updated version of this policy.”
For example, you might miss an email and still be bound by a new sharing rule.
There is a footer link to opt out of sale, sharing, and targeted ads.
Read the exact line
Privacy policy
“To exercise this right, you can click the “Do Not Sell or Share My Personal Information” link on the footer of our website.”
For example, you can click that footer link to try to stop ad-partner sharing.
They have a program for people to report security bugs.
Read the exact line
Privacy policy
“If you’re looking to report a security vulnerability in an Envato Site please visit our Helpful Hacker Program page.”
For example, a researcher can report a leak through that program instead of staying silent.
If you break the item license, you must stop using that theme until you strip it out.
Read the exact line
Terms of service
“This license can be terminated if you breach it. If that happens, you must stop making copies of or distributing the End Product until you remove the Item from it.”
For example, selling a site built from a Regular License theme could force you to rebuild without it.
Words to know
Legal words from the lines above, in plain English.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
- prompt
- What you type or say to an AI to get a response. For example, asking a chatbot to write a birthday message is a prompt, and it may be stored.
- legitimate interest
- A legal reason that lets a company use your data without asking, when it decides its own need outweighs your privacy. For example, an app may analyse how you use it to improve the product, without ever asking you.
How we got here · grade F · score 33/100 · 15 of 15 policy answers backed by a verified quote · 8 not stated
What does the app collect beyond what it needs to work?
They collect account data plus location, photos, device and cookie data, prompts, and extra data from ad partners and login platforms.
Does it record your voice, face or body, and what happens to that?
Authors who consent send a selfie and ID to Jumio or Veriff for facial recognition; Envato may receive the ID and selfie. Everyday AI image tools are said not to identify people.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use third-party ad companies, partner ad networks, Google Analytics, and targeted advertising, with a footer opt-out.
Do they sell or share your data, and can you opt out?
They share with service providers, group companies, and marketing partners, and offer a Do Not Sell or Share opt-out.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You delete by contacting them or a help-center form. They keep data as long as needed and may keep some after deletion.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe commercially reasonable security and point people to a Helpful Hacker Program to report bugs.
Is there a real age gate, and are teens protected?
Not stated in the documents.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated. They may notify of material changes, but continued use means you accept, and retention periods are not specific.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 4,851 words at a professional or legal expert level (Flesch reading ease 19.5); the terms are 1,696 words at a plain English level.
