Who we are
Thaum is part of Thaum Labs, which is the data controller for the personal data described here. If you want to reach a person about anything on this page, write to [email protected] - it reaches us directly, not a ticket queue.
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Your name, email and what you wrote, when you use the contact form | To reply to you | Legitimate interests - answering someone who contacted us |
| Email addresses of the people at a client we work with | To give them access to their project space and to send them a one-time sign-in code | Contract |
| What clients write in their project space - requirement answers, comments, uploaded files | To design and build the system they have asked for | Contract |
| Signature details on an engagement letter or retainer: the typed name, the date, the IP address and browser used | To evidence who signed what, and when | Contract, and legal obligation for keeping records |
| For the partner programme deck: who we sent it to, whether they opened it, when, how many times, and how far down they read | To know whether a deck we sent was read, so we follow up usefully rather than blindly | Legitimate interests - business-to-business outreach |
| Invoices and payment records | To bill for work and keep our accounts | Contract, and legal obligation |
We do not use advertising or profiling cookies, we do not run third-party analytics on this site, and we do not sell or share personal data for anyone else’s marketing.
Cookies
Every cookie we set is needed to make something work. There are no advertising or tracking cookies, so there is no consent banner to dismiss.
- Access cookies - set when you unlock a private area or sign in to a client space, so you are not asked again on every page. They hold a signed value, never your password.
- Partner deck cookie - set when you open the partner deck from your own link, so we can tell who read it. Described above.
Who else processes it
We keep this list specific rather than vague, because “trusted third parties” tells you nothing. Each of these handles data on our instructions:
| Who | What they do for us |
|---|---|
| DigitalOcean | Hosts the site and the client portal, and the database behind it. Our application runs in their London region. |
| Cloudflare | Sits in front of the site for DNS, security and delivery. |
| Resend | Delivers our email - sign-in codes, notifications and the documents we send you. |
| SheetDB | Receives contact form submissions from this website and passes them to a spreadsheet we read. |
| Anthropic | Drafts follow-up question rounds and change plans inside the client portal from the answers a client has given. Content sent for this purpose is not used to train their models. |
| GitHub | Stores the source code for our software and runs our deployments. |
Some of these operate outside the UK. Where that happens, transfers are covered by the safeguards those providers offer, such as the UK addendum to the standard contractual clauses.
How long we keep it
- Contact form enquiries - up to two years, unless you become a client or ask us to delete them sooner.
- Client project spaces - for the life of the engagement and for six years afterwards, because signed agreements and the answers they were based on may be needed in a dispute.
- Invoices and accounting records - six years, as UK tax rules require.
- Partner deck records - up to two years from the last time the deck was opened.
Your rights
Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to processing we do on the basis of legitimate interests - including the partner deck tracking described above.
Ask at [email protected] and we will respond within one month. If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.
When we work as a processor
When we build or support a system for a client, that client is the controller of the data inside it and we act as their processor, under the terms of our agreement with them. If your data is in a system we built for someone else, please contact that organisation - and if you are not sure who that is, ask us and we will point you to them.
Changes
If we change how we handle personal data, we update this page and the date at the top. Material changes affecting existing clients are emailed rather than left here to be discovered.