template.fyi

Legal

Privacy policy

This policy explains which personal data template.fyi processes, why, which providers are involved and which rights you have.

Last updated: 25 September 2026

1. Controller

Neptox Management SL, a company established under Spanish law, operates template.fyi and is the controller of the personal data processed through it. Contact: info@neptox.com or +34 644 28 04 37. Our company registration details and address are stated on every invoice.

2. Data we process and why

  • Sign-in and account. Your email address, used to send you a one-time sign-in link. The link works once and expires after 10 minutes. To find your account we store a keyed hash of your email address, and we store sign-in and session tokens only as hashes. Purpose: giving you access to your account and purchases. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • Orders and subscriptions. The email address given at checkout, the product or plan, the billing period, amounts, payment and subscription status, the period in which you have access, and payment provider references. We also record the consents you give at checkout, with the version of the text and the time. Purpose: performing the contract, showing what you agreed to, and accounting. Legal basis: performance of a contract and legal obligations (Article 6(1)(b) and (c) GDPR).
  • Payments. Stripe collects your card and billing details on its checkout page and in its customer portal. We do not receive or store your full card details. Stripe also processes payment data under its own terms and privacy policy.
  • Downloads. Product files are kept in private storage and delivered only for verified individual purchases or eligible subscription accounts. Individual purchases use the payment-result page and a browser-bound, short-lived download link. Subscription downloads require account access.
  • Security and abuse prevention. Your IP address, or a hash derived from your IP address or email address, is used as a key for rate limits on sign-in, checkout and downloads. Legal basis: our legitimate interest in protecting the service and your account (Article 6(1)(f) GDPR).
  • Delivering the website. When you visit template.fyi, our hosting providers process technical request data such as your IP address, the requested address, the time and browser information to deliver the pages and protect the service. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

You need to provide an email address to buy and to sign in. Without it we cannot deliver your purchase.

3. Cookies and browser storage

We only set cookies that are strictly necessary for sign-in, your session and a checkout in progress. They are HttpOnly and secure. A session ends after 30 minutes without activity and at the latest after 12 hours. Your preferred language is kept in your browser’s session storage. template.fyi does not load third-party analytics or advertising scripts.

4. Providers that process data for us

  • Stripe: payments, checkout and subscription management in the customer portal.
  • Cloudflare: hosting of the website and the store service (Workers), the database (D1), private file storage (R2), sending of sign-in emails, and rate limiting.
  • Vercel: the public entry point of template.fyi, which forwards requests to our Cloudflare service.

We do not sell personal data. Our internal order administration receives order events without your email address, IP address or payment provider references.

5. Transfers outside the EEA

Stripe, Cloudflare and Vercel may process data outside the European Economic Area. Such transfers rely on the safeguards in their data processing terms.

6. How long we keep data

  • The email address on a paid order record receives a removal date based on a fixed retention period that we configure. After that date it is due for removal from the order record.
  • Records we must keep for tax and accounting purposes, such as invoices, are kept for as long as Spanish law requires.
  • Sign-in links expire after 10 minutes. Sessions end after at most 12 hours.
  • Rate limit keys are only used within a short counting window.

7. Your rights

You can ask for access to your data, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interest. Send your request to info@neptox.com. We may ask you to confirm your identity and we answer within one month.

You can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with the data protection authority in your country.

8. Contact

Neptox Management SL, info@neptox.com, +34 644 28 04 37. The terms for purchases are in our terms of sale.