Privacy Notice

Version 1 — effective 20 October 2026

1. Who we are

ENVATY is the trade name of a sole proprietorship registered with the Netherlands Chamber of Commerce (KvK) under number 62358952. We decide why and how the personal data described here is processed, so we are the "controller" under the GDPR.

Name	ENVATY
Address	Prins Bernhardplein 143, 1097 BK Amsterdam, the Netherlands
KvK number	62358952
Privacy questions and requests	privacy@envaty.com

We have not appointed a data protection officer.

This notice covers envaty.com: visiting the website, creating an account and profile, creator profiles and listings, our site statistics and the early list. Bookings and payments are not open yet. We will update this notice before they open.

2. What we process

Visiting the website. The site runs on Cloudflare. To deliver each page, Cloudflare processes your IP address, the page you ask for and technical details of your browser. Our hosting logs keep these request details for 3 days. Pages that show listings, profiles or the sign-in screen also fetch data directly from our database provider, Supabase. Supabase logs those requests, including your IP address, for 1 day.

Your account. To create an account you give your name, email address and a password. The password is stored only in scrambled form, so we cannot read it. Before your account is created, your browser checks whether the password has appeared in known data leaks. To do so, it sends only the first 5 characters of a hash of the password to the free service Have I Been Pwned (pwnedpasswords.com). Your password itself and your email address are not sent. Supabase sends the emails that confirm your address and reset your password. Your name and profile photo, if you add one, are visible to other visitors.

Your profile and activity. If you fill in a member profile, we store what you enter: a username, display name, short statement, city, interests and photo. You choose who can see it: only you, signed-in members, or everyone. The default is signed-in members, and search engines are kept out unless you allow them. We also store:

the journal entries and photos you add;
who you follow, follow requests, and the people you block;
reports you send us about other members.

Items you save are stored only in your own browser, not in your account.

Creators. If you create a creator profile, we store what you enter: your name, bio, city, location, website, social media links and photos. Once you publish your profile or a listing, it is public, including its photos. Published listings and creator profiles can also be read by AI assistants through our public catalogue interface. A video you add from YouTube, Vimeo or another website loads from that source only when a visitor opens it.

Site statistics. We run our own statistics, without third-party trackers and without advertising. Your browser keeps three items for this: a random visitor code, a session code that expires after 30 minutes of inactivity, and the domain of the website you first came from. We record:

which pages and listings are viewed, what is saved and followed, and how far a sign-up gets;
for searches: only the filters, the number of results and words that exactly match our own categories, never the text you type;
course progress, shares and campaign tags in the link (UTM source, medium and campaign);
your device type (mobile, tablet or desktop), derived from your browser details without storing them.

When you are signed in, these events are linked to your account. We never store your IP address, your full browser details, search text, or your name or email address in the statistics. If your browser sends a Global Privacy Control or Do Not Track signal, no statistics are sent at all.

Other browser storage. To make the site work, your browser also stores your sign-in session, your language, your saved items, your basket and where to continue after signing in. These stay on your device.

The early list. If you join, we store your email address, your first name if you give it, and whether you are interested as a member, a creator or both. We also store the consent text you agreed to, the version of this notice, the dates you signed up, confirmed or unsubscribed, and your current status. Joining does not create an account. The links in our emails contain a random code. We store only a hash of that code: a one-way fingerprint that lets us recognise the link, from which the code itself cannot be worked out.

Emails to privacy@envaty.com. We receive your email address and message, and use them only to handle your question or request. Cloudflare forwards these emails to our mailbox without storing their content; it keeps delivery details such as sender, recipient, subject and time.

3. Why we process it, and on what legal basis

Purpose	Legal basis (GDPR art. 6(1))	Why this basis fits
Delivering the website and keeping it secure	(f) legitimate interest	A site cannot work or be protected without handling requests. The logs are kept for only 1 to 3 days.
Your account, profile, journal, follows and creator profile	(b) contract	This is the service you sign up for. Without it we cannot provide your account.
Showing your name, photo, published profile and listings to others	(b) contract	Publishing is what these features are for, and you choose what to publish and who sees your member profile.
Checking your password against known leaks	(f) legitimate interest	It protects your account. Only part of a hash leaves your browser, never the password or your email address.
Handling reports and blocks between members	(f) legitimate interest	It keeps members safe.
Site statistics	(f) legitimate interest	We need to know which parts of ENVATY are used, to improve them and to see whether there is demand. We keep the impact small: no third parties, no IP addresses, no search text, a 30-minute session, and Global Privacy Control and Do Not Track are respected. You can object at any time (section 6).
Launch updates and your invitation from the early list	(a) consent	You give it by confirming your email address (double opt-in), and you can withdraw it at any time.
Recording your consent	(c) legal obligation	The GDPR requires us to be able to show that you consented (art. 7(1)).
Keeping a record after you unsubscribe	(f) legitimate interest	It lets us respect your choice and show that you opted out.
Answering privacy questions and requests	(c) legal obligation	The GDPR requires us to handle your requests (art. 12–22).

The browser storage for the statistics falls under the exception in the Dutch Telecommunications Act (art. 11.7a(3)(b)) for measuring the quality and effectiveness of our service with little or no impact on your privacy. The other items in your browser are needed for the features you use.

To create an account you must give a name, email address and password; without them we cannot create one. Everything else is optional. We do not sell your data, use it for advertising or profiling, or make automated decisions about you.

4. How long we keep it

Data	How long
Hosting logs (Cloudflare)	3 days
Database request logs (Supabase)	1 day
Your account, profile, journal and follows	As long as you have your account. Ask us to delete your account at privacy@envaty.com and we will do so within one month.
A published creator profile or listing	Until you unpublish it or your account is deleted
Site statistics	13 months, then deleted. When your account is deleted, the link between your account and your statistics is removed.
Early-list sign-up you did not confirm	30 days, then deleted
Confirmed early-list sign-up	Until you unsubscribe, and at most 12 months after ENVATY opens
After you unsubscribe	Your email address and the date stay on a block list for 2 years, so our launch emails skip you. Your first name is removed straight away. After 2 years the record is deleted; if you join again later, you confirm your email again.
Sent-email logs at Resend	30 days
Emails to privacy@envaty.com	As long as needed to handle your request, and at most 2 years after it is closed
Items in your browser	On your device until you clear them; the session code expires after 30 minutes of inactivity

5. Who receives it, and international transfers

These service providers process data for us ("processors"), under a data processing agreement that is part of their terms:

Provider	What they do for us	Where the data is
Cloudflare, Inc. (USA)	Hosting, hosting logs, forwarding email to privacy@envaty.com	Cloudflare's worldwide network, including outside the EU
Supabase Pte. Ltd. (Singapore)	Database, accounts, file storage and account emails	Stored and mainly processed in the EU (Ireland)
Resend, Inc. (USA)	Sending early-list emails	Sent from the EU (Ireland); account data, email details and logs are stored in the United States

Where data goes outside the European Economic Area, the transfer is protected by the European Commission's standard contractual clauses. Cloudflare and Resend are also certified under the EU–US Data Privacy Framework. You can ask us for a copy of these safeguards.

Others who receive data:

Our mailbox for privacy@envaty.com is hosted by Google (Gmail).
YouTube, Vimeo or the website a video comes from, when you open a video a creator has added. That source then receives your IP address and browser details under its own privacy policy.
Have I Been Pwned receives only the part of a password hash described in section 2.
Authorities, but only when the law requires us to share data.

We do not sell data or share it for advertising.

6. Your rights

You have the right to:

see which personal data we hold about you (access);
have it corrected, or deleted;
have its use restricted;
object to processing based on legitimate interest;
receive the data you gave us in a common format (portability);
withdraw your consent at any time, without affecting what happened before.

Email privacy@envaty.com with your request. We answer within one month. To make sure a request really comes from you, we may ask you to send it from the email address it is about.

Unsubscribing. Every early-list email has an unsubscribe link. One click on the page it opens takes you off the list.

Switching off site statistics. Use the switch on this page to turn statistics off in your browser. Turning on Global Privacy Control or Do Not Track in your browser has the same effect.

7. Complaints

You have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. We would also like to hear from you first at privacy@envaty.com, so we can try to put things right.

8. Minimum age

The early list and ENVATY accounts are for people aged 18 and over.

9. Changes to this notice

When we change this notice, we publish the new version here with a new date. If a change affects how we use the data you gave us, we tell you by email before it applies. If a change needs your consent, we ask for it separately; a notification email does not count as consent.

This notice is available in English and Dutch. If the two versions differ, the Dutch version applies.