Privacy policy

Who we are

RVT.ai is a marketplace for digital products (templates, themes, code and UI kits), operated from the United Arab Emirates. We are the controller of the personal data described here. The postal address we use for privacy matters is printed at the foot of every marketing email, and you can reach us at any time through the contact page.

What we collect

Account details you give us: your name, email address and an optional company and country. Passwords are never stored in readable form, only as a salted one-way hash.

Order records: the items, licenses, prices and license keys of each purchase, plus the billing name, email and country you entered at checkout, and the reference the payment provider gives the payment.

Messages and content: contact form messages, support tickets, newsletter sign-ups (with the time you confirmed), questions you post and reviews you write.

Technical data: your IP address is used briefly for rate limiting and security logs. Product view statistics are anonymous daily counters per product, with no cookie, IP address or account attached. We do not use third-party analytics, advertising pixels or session recording.

Cookies: see the cookie policy. A first-party rvt_consent cookie remembers your cookie and "do not sell or share" choices; each choice is logged with a timestamp and a hash of a random id so we can show consent was given.

Payment details

We never see or store card numbers, expiry dates or security codes. You pay on a page hosted by the payment provider, and the server rejects any request that contains card-like fields.

Purposes and legal bases

To create and run your account, fulfil orders, deliver downloads and license keys, and answer support requests. Legal basis: performance of a contract with you.

To keep invoices and order records. Legal basis: legal obligation (tax and accounting rules).

To keep the store secure, prevent fraud and abuse, and moderate reviews and questions. Legal basis: our legitimate interests in a safe marketplace.

To send the newsletter and wishlist price-drop alerts. Legal basis: your consent, given by confirming your email address or turning the option on in Account settings. You can withdraw it at any time with the one-click link in every email.

To count anonymous product views for store statistics. Legal basis: legitimate interests; no personal data is involved.

Who processes data for us

Payment providers: Paddle (merchant of record for card payments), Lemon Squeezy and PayPal. When you pay, the provider you choose receives your name, email, country and the order amount, and processes the payment under its own privacy policy. Paddle and Lemon Squeezy act as reseller of record and handle sales tax.

Email delivery: transactional and marketing emails are sent through an email delivery provider that only processes your address and the message on our behalf.

Hosting: the store and its database run on servers we control. We do not use third-party font, image or analytics services on the storefront.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. You can also record an opt-out on the Do not sell or share my personal information page linked in the footer. Reviews and questions are shown publicly with the name on your account.

How long we keep it

Account data: while your account is open, and deleted within 30 days after you ask us to close it.

Order records and invoices: for as long as your licenses are valid and as tax rules require (generally up to 5 years in the UAE and up to 10 years in some EU countries).

Newsletter: until you unsubscribe. Unconfirmed sign-ups are removed after 30 days. We keep a minimal record of unsubscribed addresses so we never email them again.

Contact and support messages: up to 2 years after the conversation ends. Security logs: up to 90 days.

Your rights

You can see and correct your details in your account. You can also ask us for a copy of your data, to correct or delete it, to restrict or object to processing, or to move it to another service. You can withdraw consent at any time without affecting earlier processing.

Send requests through the contact page. We answer within one month (45 days for California requests) and may ask you to confirm your identity. We will not treat you differently for using these rights.

United Arab Emirates (PDPL)

If you are in the UAE, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data gives you the right to information, access, correction, erasure, restriction, portability and to object to automated processing and direct marketing. You can complain to the UAE Data Office.

European Economic Area and United Kingdom (GDPR)

If you are in the EEA or the UK, the legal bases above apply under Article 6 GDPR (UK GDPR). When data moves outside the EEA or UK, for example to a payment provider, we rely on adequacy decisions or standard contractual clauses. You may complain to the data protection authority where you live or work.

The store is not intended for children under 16, and we do not knowingly collect their data.

California (CCPA / CPRA)

In the last 12 months we collected identifiers (name, email, IP address), commercial information (orders) and limited internet activity (security logs), for the purposes listed above. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics.

California residents may ask to know, delete or correct their personal information and may opt out of sale or sharing. Requests can come from you or an authorised agent through the contact page.

Security

We validate every request on the server, use parameterised database queries, show user content as inert text and require a matching token on every state-changing request. Repeated failed log-ins are rate limited.

Changes and contact

We will update the date at the top when this policy changes and tell account holders by email about important changes. Questions or requests: use the contact page.

Creators: profile and payout data

If you become a creator we process your public profile (handle, display name, picture, bio, links), your uploads (files, screenshots, demos, reels), the time and version of the Creator agreement you accepted, and your sales ledger. Your profile, reels and products are public; the ledger is visible only to you and our team.

Payout details (bank account or PayPal email) are encrypted at rest with AES-256-GCM using a key stored separately from the database, are shown to you only in masked form, and are used only to send your payouts. We keep them while you are a creator and for as long as tax and accounting laws require after your last payout.

Uploaded files are scanned for malware by a ClamAV service that runs on our own infrastructure, and package lockfiles may be checked against the public OSV vulnerability database (only package names and versions are sent). We do not share creator files with third parties.

Follows, likes and reel views

When you follow a creator or like a reel we store that link to your account so we can show your Following feed and real like counts. A creator's public Followers list shows members by first name and last initial only (creators by their @handle); emails are never shown. Reel view counts are aggregate numbers: to count a view only once per day we keep a salted, one-way hash for up to 24 hours and then delete it. We do not use it to track you across pages or sites.

Reports you send are stored with your account so we can act on them and prevent abuse; the reported creator is not told who reported them.

Social app: profile, posts, comments and follows

If you use the social app we process your username, display name, bio, profile picture, skills, "Open to work" choice, posts (images and captions), comments, likes, saves, follows and blocks. Your profile, posts, comments, likes counts and follower lists are public to signed-in members and visitors of your profile; saves and blocks are private. The person you block is not told.

Images you upload are checked for malware on our own servers and re-encoded before they are shown, which removes camera data such as location (EXIF/GPS). We do not use your content to train AI models and we do not sell it.

Suggestions ("Suggested for you", Rising, New on RVT) are computed on our servers from follows, products you bought or saved, likes and shared skills. You can leave them at any time with "Suggest my account to others" in Profile and discovery; people can then still find you by name.

Messages

Messages are stored so they can be delivered and shown to the two people in the conversation. Our staff cannot read your conversations. The only exception is a report: when someone reports messages, the report contains a copy of the reported person's recent messages in that conversation (up to 20), which our team reads to decide on the report. Nothing else in the inbox is shared.

We do not scan message content beyond automatic checks for spam and links in message requests, and the malware scan of images. "Seen" receipts show the other person when you have read their messages (not for message requests you have not accepted). "Delete chat" removes the conversation for you only; "Unsend" removes a message for both people.

Notifications and email summaries

We keep in-app notifications about activity on your account (likes, comments, mentions, follows, message requests, sales, payouts, check results and moderation decisions) so you can see them later; you can switch each type off. Email summaries are off unless you turn them on in Notification settings and are sent through our normal mail system.

Your own AI key (Customize with AI)

Describing a look in words in Customize uses your own API key from the AI provider you choose (OpenAI, Anthropic, Google Gemini, DeepSeek or xAI). RVT.ai has no AI key of its own and never uses one for you.

When you use it, your description, the name of the template and your current theme settings are sent with your key to that provider, under that provider's terms and privacy policy. The provider bills the usage to your account with them. Set a spending limit with your provider.

"This device only" keeps the key in your browser; it is sent to us with each AI request over HTTPS, used for that single call and never stored or logged. "Save to my account" stores it encrypted (AES-256-GCM) so it works on your other devices; we show only its last four characters, and you can delete it at any time in Account → Settings → AI key (it is also deleted with your account). Keys are never written to logs, error messages or analytics.

We keep a count of AI requests per day (time, provider, outcome, your account and a one-way hash of your IP address) to prevent abuse. We do not store what you typed.

Hosting partner links

The Deploy guide in "Use this template" links to hosting providers. Some links, marked "Partner", are affiliate links: if you sign up through them the provider may pay RVT.ai a commission, at no extra cost to you. We send the provider nothing about you; the provider sees only that you arrived from our link, under its own privacy policy and cookies.

Open in StackBlitz or CodeSandbox sends the template files from your browser directly to that service under its terms; CodeSandbox sandboxes can be opened by anyone who has the link.