Privacy policy
Controller: Cactus Deck, Quito, Ecuador · support@cactusdeck.com · +593 96 886 8157
Effective: 19 October 2026
This policy covers the website cactusdeck.com, the live demos, the contact and "notify me" forms, WhatsApp and email support. It follows Ecuador's Ley Orgánica de Protección de Datos Personales (LOPDP) and its regulation and, for buyers in the European Union and the United Kingdom, the GDPR and UK GDPR.
What we collect and why
| Data | Source | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| Name, email, billing country, order details | Polar.sh, when you buy a template | Deliver the product and license key, provide updates and support, keep accounting records | Contract; legal obligation | 7 years (tax records) |
| Name, email, company, what you need, budget, message | You, through the contact form | Answer you and, if you ask, prepare an estimate | Your request before a contract; legitimate interest | 12 months if no project follows; for the life of the project and 7 years after if one does |
| Email, template and license you're interested in | You, through "notify me" | Tell you when that template goes on sale | Your consent | Until launch, then deleted unless you buy |
| Your phone number, name and messages | You, when you write to us on WhatsApp | Answer you | Your request; legitimate interest | 12 months if no project follows |
| Messages and the email you write from | You, when you email support@ or hello@ | Answer you | Contract; legitimate interest | 24 months |
| Technical logs (IP address, browser, pages requested) | Our hosting provider (Netlify) | Keep the site and demos running and secure | Legitimate interest | As set by the provider |
- Payments: Polar is the merchant of record. Card details and checkout data go directly to Polar and its payment processors; we never see or store card details. Polar processes checkout data to provide its service, as described in its privacy policy, and we receive only what we need to deliver and support the product (first row).
- Live demos: the demos run entirely in your browser with sample data. What you type in them (sign-in details, settings) stays in your browser's local storage, is strictly functional and is never sent to us.
- Cookies: the site uses no advertising or tracking cookies. It remembers your theme in your browser's local storage and your language choice in a functional cookie.
- We don't make automated decisions about you and we don't sell personal data.
Who we share it with
Only these providers, each under its own data-protection terms, and the authorities when the law requires it:
| Provider | What for | Where |
|---|---|---|
| Polar Software, Inc. (and its payment processors) | Checkout, invoicing, tax, license keys, downloads | United States |
| Netlify, Inc. | Hosting the site and the demos; receiving contact and "notify me" forms | United States / global CDN |
| Cloudflare, Inc. | Domain DNS | United States / global |
| Zoho Corporation | Email (support@, hello@) | United States |
| Meta Platforms (WhatsApp) | WhatsApp conversations | United States |
International transfers
These providers process data outside Ecuador. We rely on their standard data processing terms, including Standard Contractual Clauses where they offer them, as the safeguard required by the LOPDP and, for EU and UK residents, by the GDPR.
Your rights
You can ask us, free of charge, to:
- access your data and know how we use it;
- correct or update it;
- delete it;
- object to its processing or ask us to suspend it;
- receive it in a portable format;
- not be subject to decisions based only on automated processing.
Write to support@cactusdeck.com from the address we have for you, or tell us how to verify who you are. We answer within 10 business days, and access requests within 15 days.
If you are not satisfied, you can complain to Ecuador's Superintendencia de Protección de Datos Personales. EU and UK residents can also complain to their own data-protection authority.
Security and breaches
We use providers with encryption in transit and two-factor access to our accounts, and give access only to the people who need it. If a breach affects your data and creates a risk for you, we notify the Superintendencia within 5 days and tell you without undue delay.
Changes
We'll post any changes on this page with a new effective date.