Privacy Policy

The controller of your personal data is:

Marcin Czaja, conducting business under the name ICHERRY
Address: Zielona 57, 34-471 Ludźmierz, Poland
NIP: PL7352738441
Email: support@rosea.io

Depending on how you interact with the website and services, the controller may collect:

a) Contact and support data

• Name
• Email address
• Message content
• Technical information related to your request

(when you contact the controller via email or https://support.rosea.io/ (opens in new tab))

b) Transaction-related data

For purchases made through Lemon Squeezy or Envato, the controller receives order information needed to identify the purchase and provide the product and support. For Direct Orders invoiced by RoseaThemes, the controller also collects billing information. Depending on the purchase channel, this includes:

• your email address
• product purchased
• transaction ID or order reference
• billing name, company name, billing address, tax identification number, and invoice details where required
• license records and purchase-verification information

This data is used to:

• identify your purchase
• provide access to the product
• deliver customer support
• communicate with you regarding your purchase (e.g. updates, important product information)

Card details are handled by the payment provider, not collected through this website. For direct payments, the controller may receive payment status, transaction references, and bank-transfer information needed to match a payment to an invoice.

c) Newsletter data

If you subscribe to the newsletter, the controller may collect:

• email address
• optional metadata (e.g. subscription time, IP, engagement data)

d) Technical data

• IP address
• browser type
• device information
• pages visited

(collected via cookies or analytics tools)

The controller processes your data based on:

• Art. 6(1)(b) GDPR – steps taken at your request before a contract and performance of a contract, including quotations, direct orders, product delivery, license administration, and contractual support
• Art. 6(1)(c) GDPR – legal obligations, including accounting, tax record-keeping, and handling statutory complaints
• Art. 6(1)(f) GDPR – legitimate interests in responding to general inquiries, securing the website and support system, preventing abuse, and establishing, exercising, or defending legal claims
• Art. 6(1)(a) GDPR – consent for optional analytics and, where offered, newsletters and marketing communications

Providing personal data is voluntary, but it may be necessary to use certain services - for example, the controller cannot respond to a support request without your email address.

Your data may be used to:

• provide customer support
• respond to inquiries
• deliver and manage digital products
• verify purchases
• communicate with you about your purchase
• improve products and services
• ensure security and prevent abuse
• send newsletters and marketing emails (only with your consent)

Lemon Squeezy

Payments and billing may be handled by Lemon Squeezy (merchant of record). They process your payment data independently as a data controller.

Envato (ThemeForest)

If you purchase via Envato, they handle transactions and may share limited data necessary for support.

Google Analytics

With your consent, the controller uses Google Analytics 4 to measure site traffic. Google processes this data on the controller’s behalf; see the Cookie Policy for the cookies involved and how to withdraw consent.

Google Search Console

The controller uses Google Search Console to monitor indexing and search performance, including reports of impressions, clicks, search queries, and referring pages. Search Console itself does not require an additional visitor-tracking script or cookie on this website. Its reports are provided by Google and do not give the controller a list of individually identified search users.

Stripe and direct payments

For Direct Orders, card payments may be processed through Stripe, and bank transfers through the banks involved in the payment. These providers receive the information needed to process the payment and may process data for their own legal, security, and fraud-prevention obligations. RoseaThemes receives the transaction information needed to confirm payment and manage the order.

Support system

Support requests submitted via https://support.rosea.io/ (opens in new tab) are handled through a custom support system operated by RoseaThemes and hosted on Hostinger. Ticket messages, contact information, troubleshooting details, and attachments are processed to handle your request. Please do not submit passwords, payment-card details, or unnecessary learner or other third-party personal data.

Hosting and infrastructure

Hostinger provides hosting for the website and custom support system. Hosting involves storage and technical processing of website and support data, including server logs, for service operation and security. Kylos.pl provides email hosting and processes message content, attachments, email addresses, and delivery metadata to store and transmit correspondence on the controller’s behalf.

If you subscribe to the newsletter, the controller will process your email address to send you updates, product news, and marketing communications.

The legal basis for this processing is your consent (Art. 6(1)(a) GDPR).

You can withdraw your consent at any time by:

• clicking the unsubscribe link in any email
• contacting the controller at support@rosea.io

The controller retains personal data only as long as necessary:

• closed support tickets: deleted 12 months after the last contact concerning the ticket
• support-ticket attachments: deleted 30 days after the ticket is resolved
• transaction-related data: as required for accounting and legal obligations
• where newsletter subscriptions are offered, subscription data is retained while the subscription is active; limited consent and opt-out records may be retained as necessary to demonstrate compliance and prevent further unwanted marketing
• technical logs: only for the period needed for service operation, security, and investigation of incidents; retention depends on the relevant system and provider
• GA4 user-level and event-level data: according to the retention setting of the Analytics property; standard properties support 2 or 14 months. This setting does not apply to standard aggregated reports, and user-identifier retention may restart on new activity if that option is enabled

Records needed to handle an ongoing complaint or dispute, comply with a legal obligation, or establish, exercise, or defend legal claims may be retained longer, only for as long as necessary for that purpose. These exceptions are assessed separately from routine support-ticket retention.

Under the GDPR, you have the right to:

• access your data
• correct your data
• delete your data
• restrict processing
• object to processing
• data portability
• withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)

To exercise your rights, contact: support@rosea.io

You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl (opens in new tab)); you may also complain to the authority in your EU country of residence.

The controller does not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

The website may use cookies and similar technologies.

Types of cookies used

• Necessary cookies – required for website functionality
• Analytics cookies – help understand how visitors use the site
• Marketing cookies – campaign measurement or advertising features, where used

Analytics and marketing cookies are used only with your consent where required.

You can set or change optional cookies using the banner on your first visit and anytime via the cookie icon in the site footer (opens cookie preferences). Your choices are stored in your browser via localStorage and a first-party cookie (rt_cookie_consent_v1, kept for up to 400 days).

For the full list of cookies, durations, and third-party tools, see the Cookie Policy (English).

Some of the controller’s service providers (e.g. Google, payment providers, or hosting providers) may be located outside the European Economic Area (EEA), including in the United States.

In such cases, data transfers are based on:

• an adequacy decision, such as the EU-U.S. Data Privacy Framework (for certified providers like Google)
• Standard Contractual Clauses (SCCs), or
• other transfer mechanisms permitted by the GDPR where their conditions are met

You may contact support@rosea.io to request information about the safeguards applicable to a relevant transfer and how to obtain a copy, subject to appropriate redaction of confidential information.

The controller takes appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, or misuse.

The controller may update this Privacy Policy from time to time. The “Last updated” date will be revised accordingly.