Legal

Privacy Policy

Last updated: October 18, 2026

This policy explains what personal data FULLSTACK EVOLVED LLC ("FullStackEvolved", "FSEVO", "we") collects when you use fullstackevolved.com, buy a template, or hire us, and what we do with it. We are the data controller. Our registered office is in Davenport, Florida, United States, and you can reach us at hello@fullstackevolved.com.

The short version: this is a static website with no accounts and no newsletter. We count visits with Google Analytics and measure our ads with the Meta Pixel, and both run only if you accept them in the cookie bar. Beyond that, we only receive personal data when you send it to us on purpose, by writing to us or buying something.

1. Data we collect and why

  • Contact form: Your name, email address, and message. We use them to reply to you. The form is delivered to our inbox by Web3Forms. Legal basis: taking steps at your request before a contract, and our legitimate interest in answering enquiries.
  • Email: Anything you send to hello@fullstackevolved.com, including support requests. We use it to help you. Legal basis: performance of a contract and legitimate interest.
  • Template purchases: Checkout runs on Stripe (purchases on our website) or Gumroad. Each collects your payment details under its own privacy policy; we never see your card number. We receive your name, email address, order reference, and what you bought. For purchases on our website we keep that order record in our database, hosted by Supabase, so we can issue your download link and send a new one if it expires. Legal basis: performance of a contract, plus our legal duty to keep sales records.
  • Custom projects: Contact details, business details, and any material you share so we can scope and deliver the work. Legal basis: performance of a contract.
  • Server logs: The site is hosted on GitHub Pages. GitHub may log the IP address of visitors for security purposes under the GitHub Privacy Statement. We do not have access to per-visitor logs.
  • Web fonts: The typefaces are served from this site itself, so loading a page sends nothing to a font provider.

Analytics and ad measurement, only with your consent: We use Google Analytics 4 to understand how the site is used (pages viewed, approximate location, device and browser), and the Meta Pixel to measure the results of our ads on Facebook and Instagram, including when a visitor starts a checkout. Neither loads until you choose Accept in the cookie bar; if you choose Decline, nothing is sent to Google Analytics or Meta. When they run, they send your IP address and browser details to Google and Meta under their own privacy policies. If your browser sends a Global Privacy Control signal, we treat it as Decline. Legal basis: your consent, which you can withdraw at any time with Cookie settings at the bottom of every page.

We also use Google Search Console, which shows us aggregate search statistics, sets nothing in your browser, and never identifies individual visitors.

2. Cookies

The site sets exactly one first-party cookie, fsevo_lang, which remembers whether you prefer English or Spanish. It expires after one year, contains no identifier, and is never sent to anyone else; it is strictly necessary for the language switcher to work. Your choice in the cookie bar is saved in your browser as fsevo_consent (local storage, not a cookie; it never leaves your device). Only if you accept, Google Analytics sets its _ga cookies and the Meta Pixel sets _fbp on our domain, and Meta sets its own cookies, such as fr, on facebook.com. Choosing Decline later stops both and deletes _ga and _fbp; cookies on facebook.com can only be removed in your browser settings, where you can also block or delete any of these at any time. Third-party sites you reach from ours, such as Stripe or Gumroad checkout, set their own cookies on their own domains.

3. Who we share data with

We never sell personal data, and apart from the Meta Pixel described above, which runs only with your consent, we do not share it for advertising. We share it only with the service providers that run parts of the site or the business, and only as far as needed:

  • Web3Forms — forwards contact form submissions to our inbox.
  • Stripe — payment processing for purchases on our website.
  • Gumroad — payment processing, delivery, and order records for sales on Gumroad.
  • Supabase — hosts the order records and template files for purchases on our website, and issues the download links.
  • GitHub — hosts the website.
  • Google — runs Google Analytics, only if you accept it, and provides Search Console statistics.
  • Meta — runs the Meta Pixel used to measure our ads, only if you accept it.
  • Our email provider — stores the messages you send us.

We may also disclose data when the law requires it or to protect our rights.

4. How long we keep data

  • Enquiries that do not lead to a purchase or project: up to 24 months, then deleted.
  • Purchase and project records: as long as the customer relationship lasts, plus the period required by US tax and accounting law (generally 7 years).
  • Support correspondence: for the life of your support entitlement plus 12 months, so we can follow up on past issues.

5. International transfers

We are based in the United States, and so are our providers. If you are in the EU, EEA, UK, or Switzerland, your data is transferred to the US when you contact us or buy from us. Our providers rely on the EU-US Data Privacy Framework, standard contractual clauses, or equivalent safeguards. You can ask us for details.

6. Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you and receive a copy of it.
  • Correct inaccurate data or complete incomplete data.
  • Ask us to delete your data, subject to records we must keep by law.
  • Restrict or object to processing based on legitimate interest.
  • Receive your data in a portable format.
  • Withdraw consent at any time, where consent is the legal basis.
  • Lodge a complaint with your local data protection authority.

California residents have similar rights under the CCPA/CPRA. We do not sell personal data. The Meta Pixel described in section 1 may count as "sharing" under California law; it runs only if you accept it, and choosing Decline in Cookie settings, or sending a Global Privacy Control signal, opts you out. To exercise any right, email hello@fullstackevolved.com. We answer within 30 days and never charge for a reasonable request.

7. Security

The site is served over HTTPS. Card details stay inside Stripe's and Gumroad's systems. Download links are unique to each order and expire after a limited time. No method of transmission is perfectly secure, so we cannot guarantee absolute security, but we take reasonable measures to protect your data.

8. Children

The site and our products are not directed at anyone under 16, and we do not knowingly collect data from them. If you believe a child has sent us personal data, email us and we will delete it.

9. Changes to this policy

We will update this page whenever our data practices change, for example if we add a newsletter or a new measurement tool. The date at the top shows the latest version.

10. Contact

For any privacy question or request: hello@fullstackevolved.com. See also our Terms of Service.

We use cookies to see how the site is used and to measure our ads. We never sell your information. Privacy policy