Draft policy for operator review. This theme is connected to WHMCS: a configured installation can create customer accounts, orders, invoices and support records, and use enabled payment and service modules. Before adopting this policy, the operator must complete its verified identity, contacts, service terms and actual data practices. Installing the theme does not configure those business settings.
- Core platform
- WHMCS sessions & cart state
- Optional tools
- Review configured integrations
- Live deployment
- Audit before launch
What this policy describes
Cookies are one way to store information on a device. Browser local storage and similar technologies can also retain or access information. A policy should describe the technologies actually used, their purposes, duration, recipients and the applicable controls.
This policy model covers a Weeby interface connected to WHMCS. WHMCS, the web server and enabled integrations can use session cookies, cart state and other device technologies. The operator must replace the inventory below with verified names, providers, durations and purposes from its own installation; enabled modules and settings affect the actual technologies used.
WHMCS and integration storage inventory
| Technology or feature | Purpose and installation details to verify |
|---|---|
| WHMCS session cookies | Associate browser requests with the WHMCS session for account access, shopping-cart state and application workflows. Verify the configured cookie names, lifetime, domain, secure flags and session settings. |
| Form and CSRF request-validation tokens | WHMCS forms use server-generated validation data linked to the application session. Tokens can appear in form fields and requests; they are not a substitute for sign-in or permission checks. Verify the deployed session and request-security configuration. |
| Optional remembered sign-in and preferences | Enabled WHMCS features or modules may retain authentication or preference information beyond a single request. Document what is enabled, its duration and how a user can revoke or remove it. |
| Payment, fraud-checking and CAPTCHA integrations | Configured gateways and protection services may use redirects, embedded forms, cookies or device information. Identify the actual providers and disclosures; this model does not assume which integrations the operator has enabled. |
| Optional analytics, chat and marketing tools | Audit administrator-added hooks, modules, embeds and tags. State their providers, purposes, data flows, durations and required user controls before they are used. |
| Optional standalone Design Studio drafts | If the separate Design Studio is installed, its design drafts and uploaded design assets can be stored in that browser and project backups. These design records are separate from WHMCS customer, invoice and ticket records held on the server. |
| Locally served theme assets | Theme fonts, icons, styles and scripts are delivered by the website host. Requests can appear in server logs; an asset request alone is not an advertising identifier. |
Shopping-cart selections, authentication state and submitted account or support information are processed by the configured WHMCS installation. Optional design-editor storage and convenience preferences must be inventoried separately; clearing them does not remove WHMCS database records.
Managing browser and account data
Use your browser’s settings for this site to inspect or remove cookies and other device storage. Removing WHMCS session data can sign you out, discard cart state or interrupt a pending form. It does not cancel a subscription, delete server-held WHMCS account or invoice records, withdraw a domain registration or constitute a privacy request.
Blocking necessary session technologies may prevent sign-in, cart updates, checkout or form validation from working. Optional technologies must follow the choices and controls required for the operator’s actual use and applicable rules. A private browsing session does not prevent the server or configured service provider from receiving a submitted request.
Do not place passwords, access tokens, private keys or confidential customer information in editable theme content, design backups or custom browser-storage code. Use WHMCS authentication and the configured gateway’s designated inputs for their intended purposes.
Requirements for a live deployment
Before adding a technology, document the purpose, information involved, provider, lifespan and whether it is necessary for the user’s requested feature. Assess the applicable legal rule for each category; the label “essential” does not itself establish an exception.
Where consent or another user control is required, implement it before the relevant storage or access begins. Offer understandable choices, record them appropriately, and provide a practical way to change or withdraw them. Do not make unrelated marketing permission a condition of a core paid service.
Rules and exceptions differ by jurisdiction and technology. In particular, do not assume that a general consent banner automatically covers cross-site tracking, advertising, analytics, embedded third-party media and every future integration.
Optional tools and third-party content
A live operator must review payment tools, chat widgets, video embeds, external fonts, analytics, advertising, social integrations and plugins for device access and data flows. Some tools can send information before a user interacts with them.
Publish accurate provider and retention details, maintain the relevant contracts and update the Privacy notice as needed. An external provider may have its own storage and privacy practices; a link to that provider does not make them identical to the operator’s practices.
Updates and questions
Review this policy when technologies, purposes or deployment infrastructure change. Keep the inventory aligned with the actual site and preserve evidence of any consent configuration that is required.
The operator must record its actual review date and publish a monitored privacy channel before adopting this policy. Use the configured WHMCS contact form for general questions, or the privacy contact expressly identified by the operator for a privacy request.
Related primary guidance
These sources inform the model. They do not establish which laws or contractual policies apply to a future operator.
Explore the services and review the terms relevant to your project.
