Privacy policy

Article 1Data controller

Speed Ecom LLP, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, registered with Companies House under number OC432575. Contact: contact@speedflytheme.com.

Speed Ecom LLP is subject to the UK GDPR for UK residents and to the GDPR for residents of the European Union; French residents also benefit from the French Data Protection Act. It applies the highest level of protection among these regimes.

Article 2Data processed and purposes

2.1 Account, order and billing

First name, last name, email, company name, country, address and VAT number, the store's niche, chosen language, plan, payment history and invoices. Purpose: create your account, manage your trial, subscription or license, issue invoices. Legal basis: performance of the contract (article 6.1.b GDPR) and legal accounting and tax obligations (article 6.1.c).

Card details are entered in Stripe's secure form and processed by Stripe only. Speed Ecom LLP neither receives nor stores them; it only knows the card brand, its last 4 digits and its expiry date.

2.2 Sign-up source

UTM parameters, landing page, referring website, website language and, if you have accepted measurement cookies, affiliate code. Purpose: know where sign-ups come from and attribute affiliate commissions. Legal basis: legitimate interest, and consent for the affiliate cookie.

2.3 License and stores

License key, .myshopify.com domains of activated stores, activation, check and release dates. This data comes from the license checks made by the theme and by SpeedFly One. Purpose: operate the license and check the number of stores. Legal basis: performance of the contract.

2.4 Data sent by SpeedFly One

For a store where your key is pasted into the app: store name, type (production or development), country, live theme and its version, offered version, history of updates, applied templates and files spotted by the shield. The app never sends the store's email, any data about the store's customers, or the content of the theme. Purpose: show this information in your customer area and help support. Legal basis: performance of the contract. This data is deleted when the app is uninstalled (at the latest 30 days after uninstalling).

2.5 Support and AI assistant

Requests, messages, attachments, chat conversations, satisfaction feedback. Purpose: answer your questions and improve support. Legal basis: performance of the contract and legitimate interest. This data is never used for marketing.

Questions asked in the chat are processed by an artificial intelligence model (provided by Anthropic) that answers from the guide, the release notes and the FAQ, and that can read your account information when you are signed in. The same model helps the team summarise and translate requests. Every assistant answer is labelled as AI-generated. No decision with legal effects on you is made automatically.

2.6 Affiliate program

For affiliates: link and code, clicks (code, date, landing page, language, hashed IP address, browser), attributed sign-ups and payments, commissions, payout details (IBAN or PayPal email). Purpose: calculate and pay commissions, prevent fraud. Legal basis: performance of the affiliate contract and legitimate interest.

2.7 Emails

Emails related to your account (welcome, license key, reminders before a charge, invoices, support replies): performance of the contract. New version announcements and the Speed Ecom newsletter: only if you have turned them on, with one-click unsubscribe or from your settings.

2.8 Audience measurement and advertising

Only if you accept them in the cookie banner. Audience measurement: Microsoft Clarity records anonymised browsing on the website (pages viewed, clicks, scrolling) to improve it; form fields are masked. Advertising: the Meta and TikTok pixels measure visits and conversions coming from our ads. When you start a trial or a Speedfly payment succeeds, this information is also sent to Meta from our server (Conversions API): hashed email, first name, last name and country, the browser's advertising identifiers, IP address, browser, plan and amount. Purpose: measure and improve our ads. Legal basis: consent (Article 6.1.a GDPR), which you can withdraw at any time; without your agreement, nothing is sent.

Article 3Retention periods

Article 4Providers (processors)

Speed Ecom LLP uses the following providers, which process data on its behalf and according to its instructions:

Anthropic processes chat messages only to produce the answers; under its commercial terms, it does not use them to train its models.

Shopify, which hosts your store and distributes SpeedFly One, acts as a separate controller under its own policy.

Meta and TikTok also act as separate controllers for their own purposes, under their own policies.

Transfers outside the European Union. Transfers to the United States are covered by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework for certified companies.

Article 5Your rights

You have the right of access, rectification, erasure, portability, restriction and objection (in particular to any marketing). You can change most of your information in your customer area (Settings) and request the deletion of your account there: your subscription is then cancelled, the license ends, data received from SpeedFly One is deleted, support requests are deleted or anonymised, and invoices are kept for the legal period.

For any other request, write to contact@speedflytheme.com stating your identity. You will get a reply within one month, two months for a complex request (you will be told). You can also lodge a complaint with the supervisory authority: the CNIL in France (cnil.fr) or the ICO in the United Kingdom (ico.org.uk).

Article 6Cookies and local storage

Strictly necessary (no consent required): your customer area session, kept in your browser's local storage for 30 days at most; your language and your consent choice; Stripe cookies on the payment page, used to prevent fraud.

Audience measurement (only after your agreement): Microsoft Clarity (_clck and _clsk cookies, 1 year at most).

Advertising (only after your agreement): Meta pixel (_fbp and _fbc cookies, 90 days) and TikTok pixel (_ttp and ttclid cookies, 13 months at most).

Affiliate (only after you agree to one of these categories): the sf_ref cookie, kept for 60 days, which remembers the link you arrived through in order to attribute a commission. Without your agreement, the affiliate code is only kept for the length of your visit.

You can change or withdraw your choice at any time with the "Cookie preferences" link at the bottom of every page of the website. Refusing does not prevent access to the offers.

Article 7Security

Encrypted communications (HTTPS), payments delegated to Stripe (PCI-DSS level 1 certified), sign-in to the customer area with a single-use link, data access limited to authorised people, mandatory two-factor authentication for the team, support files in private storage with time-limited links. In the event of a data breach presenting a high risk, you are informed as soon as possible and the supervisory authority is notified within 72 hours.

Article 8Changes and contact

This policy may change, in particular to follow the law or our services. The version in force is the one published on the website; important changes are announced to customers by email. For any question: contact@speedflytheme.com, or by post to Speed Ecom LLP, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

This policy is translated into English, Spanish, German and Italian; in the event of any difference, the French version prevails.