Privacy Policy
Last Updated: 21.11.2025
CROapps Oy ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your personal information when you visit crotheme.com (the "Site"), purchase our products, or use our services.
For GDPR purposes, the Data Controller is CROapps Oy (Business ID: 3550932-5), registered in Finland.
1. What Data We Collect
We collect only the data necessary to provide our services, process payments, and enforce our license terms.
1.1. Information You Provide
- Account Information: Email address and encrypted password.
- License Data: The
myshopify.comdomain used to activate your license. - Communication: Email history and support inquiries.
1.2. Information Collected Automatically
- Usage Data (PostHog): We use PostHog EU Cloud to analyze site interactions. This includes anonymized IPs, browser type, and session duration.
- Traffic & Security (Cloudflare): Cloudflare logs IP addresses to prevent attacks and improve performance.
- License Verification ("Call Home"): The installed Theme periodically sends your Store URL and IP address to verify license validity.
1.3. Payment Information
We do not store credit card numbers. All payments are processed by Stripe. We only store the Transaction ID, payment status, and last 4 digits of the card provided by Stripe.
2. How We Use Your Data
We process your data on the following legal bases:
- Contractual Necessity: Delivering the product, creating accounts, and managing licenses.
- Legal Obligation: Finnish accounting and VAT compliance.
- Legitimate Interest: Fraud prevention, enforcing Terms of Service, and cybersecurity.
3. Cookies and Tracking
We use essential and limited tracking cookies:
- Session Cookie: Keeps you logged into the Dashboard.
- Cloudflare Cookies: Used for threat detection and ensuring site security.
4. Data Sharing and Processors
We never sell your data. We only share data with essential service providers:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Web Hosting & Database (VPS) | USA (Ashburn, VA) |
| Cloudflare, Inc. | CDN, DNS, DDoS Protection | Global / USA |
| Stripe, Inc. | Payment Processing | USA |
| PostHog Inc. | Product Analytics | EU Cloud (Germany) |
5. International Transfers
Our primary servers (Hetzner) are located in the United States, meaning your personal data (email, license data) may be processed outside the EU.
By using our services, you acknowledge and agree to this transfer. These transfers are made lawful through:
- Contractual Necessity — required to provide the service.
- Standard Contractual Clauses (SCCs) with US-based processors.
6. Data Retention & Deletion
- Transaction Data: Retained 6–10 years (Finnish accounting law).
- Account Data: Retained while your account remains active.
6.1. Account Deletion & Consequences
You may delete your account at any time. However, please read carefully:
WARNING: Effects of Account Deletion
- License Termination: All licenses are permanently removed.
- Storefront Lock: Your installed Shopify theme will fail verification and may disable itself or show a copyright warning.
- No Refunds: Voluntary deletion does not entitle you to a refund.
- Irreversible Action: Deleted data cannot be restored.
7. Your Rights (GDPR)
If you are in the EU/EEA, you have the right to:
- Access your personal data.
- Correct inaccurate information.
- Request account deletion (with consequences noted above).
- Receive your data in a portable format.
To exercise these rights, email us at legal@croapps.com.
8. Security
We employ industry-standard security practices:
- HTTPS/TLS encryption (Cloudflare)
- Salted and hashed passwords
- Firewall-protected servers with strict access controls
9. Contact
CROapps Oy (Business ID 3550932-5, VAT FI35509325)
Pohjoinen Rautatiekatu 29 B, 00100 Helsinki, Finland
Contact: crotheme.com/dashboard/contact