Privacy policy

Last updated: 3 October 2026

Who is responsible

The controller of your personal data is BlueStork, Andromeda 7, 3225 VA Hellevoetsluis, the Netherlands(KvK 83369988). Questions about your data: support@maxitemplates.com.

In short

  • This site sets no cookies and has no analytics, no tracking and no advertising. That is why there is no cookie banner.
  • Our own pages store nothing in your browser.
  • Fonts and images load from this domain only.
  • The same applies to our services site, services.maxitemplates.com: it sets no cookies and has no form.

One exception applies to this shop, not to the template: our contact form runs a bot check from Cloudflare, so that page loads one script from them. It sets no cookie. Everything else here, and everything in the template you buy, loads only from this domain.

Visiting the site

The site is hosted by Cloudflare. To deliver pages and protect them against attacks, Cloudflare processes technical data of each request, such as your IP address, the address requested, and your browser’s User-Agent. Cloudflare acts as our processor. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

The configurator’s version check

A configurator you bought asks once, when you open it, whether a newer version exists: it fetches the file maxitemplates.com/verzia.json. The request contains nothing about you — no cookie, no licence key, no information about your site. But, as with any visit to a web page, our server sees your IP address when the request arrives. We don’t use it for anything else. You can turn the check off in the configurator; see configurator updates.

The support form

When you send the support form, we receive what you entered: your email address, optionally your name, the template and its version, your order number, your browser, the address of your site and your message. It is passed on by a small program at Cloudflare (a Worker) as an email to support@maxitemplates.com and is not stored in any database. You receive one automatic confirmation at the address you entered, and nothing else is ever sent to it from the form.

To stop abuse, the form also counts messages per IP address for one hour; the count is then deleted. The form has a hidden field and a check of how fast it was sent. Neither collects any data about you — they only tell a robot from a person.

Moreover, the form is protected by Cloudflare Turnstile — a check that the form is being filled in by a person and not by an automated script. It is loaded from the server challenges.cloudflare.com when you open the Support page. In doing so Cloudflare processes your IP address, information about your browser (the User-Agent header and the fingerprint of the encrypted TLS connection) and the page on which the check runs. Without a successful check the message is not sent.

Cloudflare acts as our processor. According to its own policy it also uses the same data to improve its detection of robots — to that extent it is a controller itself. The legal basis is our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).

Turnstile sets no cookie. It does store one technical record in your browser’s storage (localStorage) under the domain challenges.cloudflare.com. It is set by Cloudflare, not by us, serves only to protect the form — a purpose for which no consent is required — and stays there until you clear your browser’s storage.

We use your message to answer you. Legal basis: your request (Art. 6(1)(b) GDPR, or our legitimate interest in answering questions). We keep the correspondence as long as it is needed for your question and any follow-up.

Buying a template

Purchases are handled by Paddle, our reseller and merchant of record. Paddle collects and processes your payment and billing details as an independent controller, under its own privacy policy; we never see your card details. From Paddle we receive what we need to deliver the product, support you and provide updates: your name, email address, country, the licence you bought and the order number. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Records that the law requires us to keep for accounting are kept for seven years.

Your rights

You can ask us for access to your data, its correction or deletion, restriction of processing, or a copy of it, and you can object to processing based on our legitimate interest. Write to support@maxitemplates.com. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.