Zevnixa is a marketplace for website themes. This policy explains what personal data we collect when you use Zevnixa, why, who we share it with, and the rights you have under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”). Zevnixa is the data fiduciary responsible for your data.
What we collect
- Account details: your name, email address and password when you sign up. Passwords are stored only as a secure hash by our authentication provider; we can never see them. If you sign in with Google, we receive your name, email address and profile picture from Google.
- Phone number: if you add one, along with whether you verified it with a one-time SMS code.
- Purchases: which themes you bought, the price, order numbers, payment status and your downloads. Payments are handled by Razorpay; we receive the payment reference and status, not your card, UPI or bank details.
- Client accounts: if your organisation has a client account, the account you belong to and your role in it.
- How you use the site: the pages you visit, the links and buttons you click, which themes you view or preview, logins, sign-ups, logouts and downloads, with the time of each. When you are signed in, this is linked to your account. If you browse before signing in, those visits are linked to your account when you sign in on the same browser.
- Device and approximate location: device type (mobile, tablet or desktop), browser, operating system, screen size, the website that referred you, and your country and city as estimated by our hosting provider.
- Waitlists: your email address if you ask to be notified about an upcoming feature.
- Messages: anything you send us when you contact support.
What we don't collect
- We do not record what you type into forms in our activity records, including passwords, emails and phone numbers.
- We do not store your IP address in our activity records; only the country and city derived from it. Our hosting and security providers may process IP addresses briefly to deliver the site and prevent abuse.
- We do not store card numbers, UPI PINs or bank details.
- We do not sell your personal data or use it for third-party advertising.
Why we use it
We process your data with your consent, which you give when you create an account or use the site, and where it is needed to provide what you asked for:
- To create and secure your account, including email and phone verification.
- To process purchases and deliver your theme files through private, time-limited download links.
- To run client accounts and let client admins see their own team's orders and downloads.
- To understand which pages and themes are useful, fix problems and improve the site.
- To detect fraud and misuse, and keep the service secure.
- To send service emails (verification, password resets, receipts) and, if you joined a waitlist, a launch notice.
- To meet legal obligations, such as keeping tax and payment records.
Cookies
- Sign-in cookies keep you logged in. Without them, accounts don't work.
- zx_vid: a random visitor ID, kept for up to 1 year, so visits from the same browser can be counted together.
- zx_sid: a random session ID that expires after 30 minutes without activity.
We don't use advertising or cross-site tracking cookies. You can clear cookies in your browser at any time; you'll be signed out.
Who we share it with
We share personal data only with service providers who process it for us under contract, and only what they need:
- Supabase: database, sign-in and file storage.
- Vercel: website hosting.
- Razorpay: payment processing.
- Google: only if you choose “Continue with Google”.
- Twilio: to send SMS verification codes, if you verify a phone number.
- Your client admin: if you belong to a client account, its admin can see your name, email, and that account's orders and downloads.
We may also disclose data when required by law, a court or a government authority.
Where it's stored and for how long
- Our database and files are hosted in Mumbai, India. Some providers may process data in other countries where the law allows it.
- Activity records (page views, clicks and similar) are deleted automatically after 12 months.
- Account data is kept while your account is open, and deleted within 30 days after you ask us to close it.
- Order and payment records are kept for as long as Indian tax and accounting law requires, even after an account is closed.
Your rights
Under the DPDP Act you can:
- Ask for a summary of the personal data we hold about you and how we use it.
- Ask us to correct, complete or update it.
- Ask us to erase it, unless we must keep it by law.
- Withdraw your consent at any time. This doesn't affect processing that already happened, and some features may stop working.
- Nominate another person to exercise these rights if you die or become unable to.
- Raise a grievance with us, and if you're not satisfied, complain to the Data Protection Board of India.
To use any of these rights, email zevnixasite@gmail.com from the address on your account. We reply within 30 days.
Children
Zevnixa is meant for people aged 18 or over. If you're under 18, you may only use it with the verifiable consent of a parent or legal guardian. We don't knowingly track children or target advertising at them.
Security
We use encrypted connections (HTTPS), row-level security in our database so each person can only read their own data, private storage for theme files with links that expire after two minutes, and restricted admin access. No system is perfectly secure; if a breach affects your data, we will notify you and the Data Protection Board as the law requires.
Contact and grievances
Grievance officer: The Zevnixa founder, Zevnixa, India.
Email: zevnixasite@gmail.com
Changes to this policy
If we change this policy, we'll update the date at the top. For significant changes we'll tell you by email or on the site before they take effect.
Questions? Email zevnixasite@gmail.com, or go back to the marketplace.