Who we are
Thaum is part of Thaum Labs, which is the data controller for the personal data described here. If you want to reach a person about anything on this page, write to [email protected] - it reaches us directly, not a ticket queue.
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Your name, email and what you wrote, when you use the contact form | To reply to you | Legitimate interests - answering someone who contacted us |
| Email addresses of the people at a client we work with | To give them access to their project space and to send them a one-time sign-in code | Contract |
| What clients write in their project space - requirement answers, comments, uploaded files | To design and build the system they have asked for | Contract |
| Signature details on an engagement letter or retainer: the typed name, the date, the IP address and browser used | To evidence who signed what, and when | Contract, and legal obligation for keeping records |
| For the sales decks and quotes we send to named people: who we sent it to, whether they opened it, when, how many times, and how far down they read | To know whether a deck or quote we sent was read, so we follow up usefully rather than blindly | Legitimate interests - business-to-business outreach |
| Visits to thaum.dev: the pages viewed and for how long, the referring site, approximate location, the organisation that runs the network connection, and device type (see “Website visitors” below) | To see which pages are useful and how visitors find us | Legitimate interests - understanding which parts of our website work |
| Invoices and payment records | To bill for work and keep our accounts | Contract, and legal obligation |
We do not use advertising or profiling cookies, we do not use an advertising or analytics company’s tracking on this site (the visit measurement below is our own, run for us on Cloudflare), and we do not sell or share personal data for anyone else’s marketing.
Website visitors
We measure how people use thaum.dev, including the sales decks and quotes we share with prospective clients, so we can see which pages are useful and how visitors find us. We do this without cookies and without storing anything on your device. When a page loads, a small script records:
- the page you viewed (its address only, never anything after a “?” in it) and the website that sent you there;
- any campaign tags in the link you followed (for example “utm_source=linkedin”);
- your approximate location (country, region and city) and the name of the organisation that runs your network connection - usually your broadband or mobile provider, or your employer if it runs its own network;
- your general device type, browser and operating system;
- how long the page was open and how far down you scrolled.
Pages you view on the same day are linked by a code made from your IP address and browser details mixed with a secret that changes every day and is then deleted, so we can see one visit as a journey through the site but cannot recognise you on a later day. Your IP address itself is never stored.
If you open a personal deck or quote link that we sent you, we know who we sent it to: we are told when it is first opened and how much of it was read, and we can see the other pages of thaum.dev viewed from that browser on the same day.
We do not use this information for advertising, we do not share or sell it, and we do not combine it with information from other sources. Visit records are kept for 90 days, then only as daily totals (by page, referring site, country, device type and network) that do not identify anyone. We rely on our legitimate interest in understanding which parts of our website work for the businesses we are trying to reach.
Opting out. Visit thaum.dev/?wp_ignore=1 and nothing further will be recorded from that browser on any thaum.dev address. Your choice is remembered in a small cookie called wp_ignore (see Cookies below); thaum.dev/?wp_ignore=0 undoes it. We also record nothing from browsers that send a Global Privacy Control signal.
Cookies
Every cookie we set is needed to make something work. There are no advertising or tracking cookies, and visits are measured without cookies, so there is no consent banner to dismiss.
- Access cookies - set when you unlock a private area or sign in to a client space, so you are not asked again on every page. They hold a signed value, never your password.
- Personal link cookies - set when you open a deck or quote from your own link, so we can tell who read it. Described above.
- Opt-out cookie (
wp_ignore) - set on every thaum.dev address only if you ask us not to measure your visits, so we remember your choice. It lasts two years, and thaum.dev/?wp_ignore=0 removes it.
Who else processes it
We keep this list specific rather than vague, because “trusted third parties” tells you nothing. Each of these handles data on our instructions:
| Who | What they do for us |
|---|---|
| DigitalOcean | Hosts the site and the client portal, and the database behind it. Our application runs in their London region. |
| Cloudflare | Hosts our website visit measurement (described above). It runs on Cloudflare’s global network, and the visit records are stored in Western Europe. |
| Resend | Delivers our email - sign-in codes, notifications and the documents we send you. |
| SheetDB | Receives contact form submissions from this website and passes them to a spreadsheet we read. |
| Anthropic | Drafts follow-up question rounds and change plans inside the client portal from the answers a client has given. Content sent for this purpose is not used to train their models. |
| GitHub | Stores the source code for our software and runs our deployments. |
Some of these operate outside the UK. Where that happens, transfers are covered by the safeguards those providers offer, such as the UK addendum to the standard contractual clauses.
How long we keep it
- Contact form enquiries - up to two years, unless you become a client or ask us to delete them sooner.
- Client project spaces - for the life of the engagement and for six years afterwards, because signed agreements and the answers they were based on may be needed in a dispute.
- Invoices and accounting records - six years, as UK tax rules require.
- Partner deck records - up to two years from the last time the deck was opened.
- Website visit records - 90 days, then kept only as daily totals (by page, referring site, country, device type and network) that do not identify individuals.
Your rights
Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to processing we do on the basis of legitimate interests - including the deck, quote and website visit measurement described above.
Ask at [email protected] and we will respond within one month. If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.
When we work as a processor
When we build or support a system for a client, that client is the controller of the data inside it and we act as their processor, under the terms of our agreement with them. If your data is in a system we built for someone else, please contact that organisation - and if you are not sure who that is, ask us and we will point you to them.
Changes
If we change how we handle personal data, we update this page and the date at the top. Material changes affecting existing clients are emailed rather than left here to be discovered.