Privacy Policy

Last Update: October 16, 2026

1. Introduction

Your privacy matters to us. This Privacy Policy explains which personal data we collect when you use our Websites and Services, why we collect it, who we share it with, and what rights you have.

The company responsible for your personal data (the “controller”) is Luke Beck Inc., based in Florida, USA. You can reach us about anything related to privacy at privacy@avada.com.

This Privacy Policy applies to Avada One and to everyone who uses our Websites, including Avada Classic customers who use their My Avada account. Please also read our  Terms and Conditions.

2. Definitions

The definitions from our Terms and Conditions apply here as well. For easier reading, the most important ones are:

  • “Avada Team”, “ThemeFusion”, “us”, “we”, or “our” refer to the Luke Beck Inc. and its team members.
  • “Customer”, “buyer”, “user”, or “you” refer to the person or organization entering into this Agreement.
  • “Website”, “websites” or “site” refer to https://avada.com, https://my.avada.com, https://avada.website, and https://avada.studio.
  • “Avada One” refers to our subscription based Website Builder Suite for WordPress, sold through our Websites with payments processed by Freemius.
  • “Plan” refers to the feature level of your Avada One subscription. We currently offer the Essential and Pro plans.

  • “Tier” refers to the number of websites your Avada One subscription covers.

  • “Subscription” refers to your paid, recurring access to Avada One under a specific Plan and Tier.

  • “Services” refer to Avada One, product updates, product support, the prebuilt content platforms, AI features, your My Avada account, and our Websites.
  • “Freemius” refers to our payment and licensing partner, which acts as the merchant of record for Avada One purchases.

  • “Personal data” means any information that relates to an identified or identifiable person, such as your name, email address, or IP address.

3.​ Data We Collect and Why

3.1 My Avada account

When you create an account at my.avada.com, we store your username, email address, and any other details you add to your profile. We use this data to run your account, give you access to downloads and support, and contact you about your Subscription. You can view and edit your details at any time, except your username.

3.2 Purchases and subscriptions

Avada One is sold through Freemius, our merchant of record. When you buy a Subscription, Freemius collects your name, email address, billing address, tax details, and payment information to process the payment, calculate sales tax or VAT, and issue invoices. Payment card details are handled by Freemius and its payment providers. We never see or store your full card number.

Freemius shares with us what we need to provide your Subscription, such as your name, email address, Plan, Tier, billing period, and payment status. Freemius processes your purchase data as an independent controller under its own privacy policy at https://freemius.com/privacy/.

3.3 License and website data

To manage your license, we store the domains of the websites on which you activate Avada One, and whether a domain is registered as a production or staging site.

Additionally, when you activate Avada One on a website, the following data is sent along to verify your license and deliver updates:

  • Site URL
  • WordPress version

  • PHP version

  • Avada One version

3.4 Avada Classic licenses

If you register an Avada Classic purchase code in your My Avada account, we send it to Envato to verify your license and store the result together with your account. We also use your verified license information to determine your eligibility for offers for Avada Classic customers.

3.5 AI features

Avada One Pro includes optional features that use artificial intelligence (AI), such as the AI assistant, page building with AI, the writing assistant, image generation and editing, background removal and the colour palette generator. When you use one of these features, we process the content you submit, such as prompts, selected text, page content and images you upload, so that we can carry out the task you asked for. We also record how many AI credits each licence and website uses, so that we can apply your plan’s usage limits.

To perform these tasks, we use third-party AI providers. Section 4 explains which providers receive your content, where they process it, how long they keep it, and whether they use it to train AI models.

3.6 Support

When you submit a support ticket through your My Avada account, the information you provide is sent to Help Scout, our ticketing system. Only the information you choose to include is sent, such as your message, attachments, and any website access details you share with us.

3.7 Newsletter and marketing

If you sign up for our newsletter or agree to receive marketing messages, we store your email address and the topics you agreed to hear about in Mailchimp. You can unsubscribe at any time through the link in every email.

3.8 Contact form

Messages sent through our contact form go to our company email, hosted by Google. We use them only to reply to you. They are never used for marketing or shared with third parties.

3.9 Comments

When you leave a comment, we collect the data in the comment form, your IP address, and your browser’s user agent string to help prevent spam. A hashed version of your email address may be sent to the Gravatar service to check whether you have a profile picture there. Once your comment is approved, your profile picture is visible to the public next to it.

3.10 Website analytics

With your consent, we use Google Analytics 4, provided by Google LLC (for visitors in the EU: Google Ireland Limited), to understand how visitors use our Websites, for example which pages are viewed, how long visits last, and which features are used. Google Analytics 4 does not log or store full IP addresses. We use this data in aggregated form only.

You can withdraw your consent at any time in the consent settings in section 6.

Consent Choices

4.​ AI Features and Third-Party AI Providers

This section describes how your content is handled when you use the AI features in Avada One Pro.

4.1​​​ How your content is processed

Your content is sent only when you use an AI feature. Your website sends the request to our AI service, which is hosted by Cloudflare. Our AI service then forwards the request to the provider that performs the task and returns the result to your website. Avada does not contact AI providers directly from your website.

The content we send depends on the feature you use. It may include:

  • the prompt or instruction you type

  • text you select to rewrite or improve
  • content of the page you are editing and basic information about your website, when the assistant needs it to complete your request

  • images you upload

  • search terms you enter in the stock image search

We do not store your prompts, texts or images in our own systems. We keep only usage totals (the number of AI credits used per licence, website and month) for billing and to apply usage limits.

None of the AI providers listed in sections 4.2 to 4.5 uses your content to train or improve their AI models.

4.2​​​ OpenAI

  • Provider: OpenAI (United States).

  • Used for: the AI assistant, page building with AI, the writing assistant, the colour palette generator and chat titles.
  • Data received: prompts, chat history, selected text, page and website context, and images you upload to the assistant or writing assistant.
  • Location: the United States and other countries where OpenAI or its sub-processors operate.

  • Retention: up to 30 days. OpenAI keeps requests for up to 30 days to monitor for abuse, unless the law requires longer. Chat responses are stored for 30 days so that a conversation can continue.

  • Training: OpenAI does not use your content to train its models.

4.3​​​​ Google Cloud (Vertex AI)

  • Provider: Google Cloud, Google’s AI platform Vertex AI (United States).

  • Used for: image generation at the High and Ultra quality levels, and image editing.
  • Data received: image prompts and, for image editing, the images you upload.
  • Location: The corresponding Google Cloud region worldwide, e.g. the United States, the European Union.

  • Retention: up to 24 hours in a temporary cache. Requests that Google’s systems flag as possible abuse may be kept for up to 90 days.

  • Training: Google does not use your content to train its models.

4.4​​​​​ Cloudflare

  • Provider: Cloudflare, Inc. (United States).

  • Used for: hosting our AI service, through which every AI request passes. Cloudflare also performs image generation at the Lite and Standard quality levels, background removal, content moderation, documentation search and website screenshots. The AI models for these tasks, including models made by Black Forest Labs and Meta, run on Cloudflare’s own infrastructure; their makers receive no data.
  • Data received: all content sent to and returned by the AI features.
  • Location: Cloudflare’s global network, in data centres worldwide.

  • Retention: Cloudflare keeps a log of each AI request, including the prompt and the response, for up to 30 days. We use these logs to fix problems, investigate misuse and monitor costs. After 30 days the logs are deleted automatically. Images you upload for background removal are deleted within about one hour. Pages captured for screenshots are not kept after the screenshot is taken.

  • Training: Cloudflare does not use your content to train AI models.

4.5​​​​​​ Recraft

  • Provider: Recraft Inc. (United States), reached through Cloudflare.

  • Used for: Vector (SVG) image generation.
  • Data received: Image prompts.
  • Location: The United States.

  • Retention: Recraft does not store images or prompts sent through its API by default. The link to a generated image expires after about 24 hours.

  • Training: Recraft does not use your content to train its models.

4.6​​​​​​​ Pixabay

  • Provider: Pixabay, a brand of Canva Germany GmbH (Germany).

  • Used for: Stock image search. This is not an AI feature.
  • Data received: The search terms you enter. They are sent from our AI service, not from your website.
  • Location: Germany. Pixabay also processes data in the United States, the United Kingdom, the European Union, Australia, Singapore, the Philippines and New Zealand.

  • Retention: As described in Pixabay’s privacy policy. Pixabay uses search terms to improve its search.

  • More information: Privacy Policy · Terms

4.7​​​​​​​​ International data transfers

Some providers process your content outside your country, including in the United States. Where data is transferred out of the European Economic Area, the United Kingdom or Switzerland, the transfer is protected by the provider’s data processing agreement, including the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.

4.8​​​​​​​​​ AI tools you connect yourself

You can connect your own AI tool, such as an AI assistant or code editor, to your website through the Avada Builder connection. Content shared with that tool is handled by the tool’s provider under its own terms and privacy policy. That provider is your choice and is not one of our providers.

4.8​​​​​​​​​​ Changes to this list

We may add, replace or remove AI providers as our features develop. We will update this section before a new provider receives your content.

5.​ Pro Sales and Marketing Features

Data collected through the sales and marketing features of the Pro plan, such as contacts, campaign data, and email subscribers, is stored in your own WordPress database. We do not receive or have access to it. You are the controller of that data and responsible for informing your website visitors about it.

6.​​ Legal Bases for Processing

If you are in the European Union, the United Kingdom, or another region with similar laws, we process your personal data on the following legal bases:

  • Contract (Art. 6(1)(b) GDPR): to run your account, provide your Subscription, licenses, updates, support, and AI features.
  • Consent (Art. 6(1)(a) GDPR): for analytics, marketing cookies, embedded content, and newsletters. You can withdraw your consent at any time.
  • Legitimate interests (Art. 6(1)(f) GDPR): to keep our Websites secure, prevent fraud and spam, and verify Avada Classic licenses for offers.
  • Legal obligation (Art. 6(1)(c) GDPR): to keep records required by tax and accounting laws, and to respond to lawful requests from authorities.

7.​ Cookies and Consent

Our Websites use cookies, small text files stored in your browser. Necessary cookies keep the Websites working and are always active. All other cookies and embeds are only loaded after you give your consent, and you can change your choices at any time below.

Necessary

Functional Cookies / Embeds

Analytics / Statistics

Marketing

8. Embedded Content

Some pages include content from other services, such as videos or maps. This content is blocked and replaced with a placeholder until you give your consent. Once loaded, these services may collect data about you, set their own cookies, and track your interaction with the content, especially if you are logged in to them.

9.​ Service Providers

We do not sell your personal data. We only share it with service providers who help us run our Services, and only as much as they need for their task:

10.​ International Data Processing

We are a US company, and our Websites are hosted in the USA. If you use our Services from outside the USA, your personal data is processed in the USA, where data protection laws may differ from those in your country. If you are in the EU, the GDPR still applies to how we handle your data.

Where our service providers receive personal data from the European Economic Area, the United Kingdom, or Switzerland, they rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or on Standard Contractual Clauses approved by the European Commission.

11.​​ Who Has Access to Your Data

  • Our system administrators.
  • Our support team, when they need information about your account, Subscription, or website to help you.

12.​ How Long We Keep Your Data

We keep personal data only as long as we need it for the purposes described above:

  • Account data: while your account is active, and [X months] after you close it.
  • Purchase and invoice records: as long as tax and accounting laws require, usually 7 years. Freemius keeps its own records under its privacy policy.

  • Support tickets: Same as your account data, because we retain your support history for your easy online-review.

  • Newsletter data: until you unsubscribe.

  • Comments: until you or we delete them.
  • Analytics data: 14 months.

  • AI prompts and content: see section 4 of this policy.

13.​ Security

We use encrypted connections (HTTPS) on all our Websites, limit access to personal data to the people who need it, and work with service providers that maintain recognized security standards.

If a data breach occurs that affects your personal data, we will take immediate steps to secure our systems. Where the law requires it, we will notify the responsible data protection authority within 72 hours and inform affected users without undue delay.

14.​ Your Rights

Your rights under GDPR

If you are in the EU, the UK, or a region with similar laws, you have the right to:

  • Access the personal data we hold about you and receive a copy of it.

  • Correct personal data that is inaccurate or incomplete.

  • Have your personal data deleted, unless we must keep it for legal reasons.

  • Restrict or object to certain processing, including processing based on legitimate interests.

  • Receive your data in a portable format.

  • Withdraw your consent at any time, without affecting processing that happened before.

  • Lodge a complaint with the data protection authority in your country.

To exercise any of these rights, please email privacy@avada.com. We will respond within one month. Please note that if you ask us to delete all of your data, we can no longer provide your Subscription, support, or other Services.

California Privacy Rights

If you are a California resident, you can ask us what personal data we have collected about you and request that we delete it. We do not sell or share your personal data for cross context behavioral advertising. Our Websites do not respond to “Do Not Track” signals, but you can control cookies through the consent settings in section 7.

15.​ Children

Our Services are intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at privacy@avada.com and we will delete it.

16.​ Disclosure for Legal Reasons

We may disclose personal data if we are legally required to do so, for example in response to a court order or a lawful request from a government authority, or where it is necessary to protect our rights, prevent fraud, or ensure the security of our Services. Where the law allows, we will inform you before disclosing your data.

17.​ Links to Other Websites

Our Websites may link to websites run by others. Their privacy practices are not covered by this Privacy Policy, so please review their policies when you visit them. Social media links and icons only connect you to those services when you click them.

18.​​ Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the date at the top. For significant changes, we will also notify you by email or in your My Avada account.

19.​​​ Contact Us

If you have any questions about the Privacy Policy or our products, please get in touch:

Email: support@avada.com
Website: https://avada.com

Notice for California Users and Residents
If you are a California resident and have a question, complaint, or concern about our Services, you can contact us at the address above. You may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

Go to Top