Privacy Notice

01Who we are

THOTH and THOTH Labs are brand names. The organisation responsible for your personal information as controller is THOTH LABS LTD, whose details are below.

Registered name

THOTH LABS LTD

Company number

16994360

Registered office

Third Floor, Prospect House, Riverside Drive, Liverpool, Merseyside, England, L3 4DB

Place of registration

England and Wales

Company status

Active — private limited company

VAT Registration No.

520 8388 90

This notice covers the public website and related enquiries. Processing within licensed THOTH products is addressed separately in customer agreements and product privacy documentation.

02Information we collect

When you request a demo, you provide your name, work email, organisation, role and primary use case. You may also provide an optional message. If we correspond about your enquiry, we process that correspondence.

Our service receives connection IP addresses and request metadata, including the request origin and route. It uses a temporary, salted representation of the connection IP for abuse prevention. Basic application logs record the time and outcome of a submission, rather than its contents. Cloudflare Turnstile processes the browser and security signals described below when verification is enabled.

03How we use your information

• Respond to enquiries, arrange demonstrations and assess relevant business requirements.
• Manage prospective customer relationships and related correspondence.
• Operate the website, troubleshoot delivery and prevent spam or automated abuse.
• Meet legal obligations where they apply, such as responding to a valid legal requirement.

The demo form does not subscribe you to a newsletter or marketing mailing list.

04Lawful bases

We rely on legitimate interests for responding to business enquiries, managing prospective customer relationships, and operating and protecting the website. Processing must be necessary for those purposes and balanced against your interests, rights and reasonable expectations. We limit the information requested, restrict its use to these purposes and provide a way to object.

Where a specific legal requirement obliges us to process or disclose information, the relevant basis is legal obligation. Submitting the form is not treated as consent to unrelated uses of your information.

05Request Demo submissions

Required fields help us understand and respond to your enquiry; without them we cannot process a demo request through the form. The message is optional. Please do not include passwords, confidential case evidence, sensitive personal information or information about investigation subjects.

When delivery is enabled, the submission is sent to the THOTH team through Resend. The website application does not maintain a demo-request database. Information may remain in the receiving mailbox, subsequent correspondence and the email provider’s systems, subject to the retention approach below.

06Anti-spam and website security

Cloudflare Turnstile is used on the demo form when verification is enabled to distinguish human visitors from bots. Its signals include IP address, user-agent, TLS and browser security signals, and the site key and associated origin. Turnstile does not read or transmit your form entries. Our server checks its verification result before accepting a protected submission.

We also limit repeated requests using short-lived connection information. These controls protect the website and enquiry service; they do not make decisions about you with legal or similarly significant effects.

07Service providers

Resend, operated by Plus Five Five, Inc., acts as a processor to deliver enquiries internally. It processes email addresses and message content for delivery. See its data processing terms.

Cloudflare acts as a processor when providing Turnstile security to us. It also acts as a separate controller when using security signals to improve its bot detection, as explained in its Turnstile Privacy Addendum.

Website infrastructure and business email providers may handle information as needed to host the site and receive or respond to enquiries. Access is limited to the team and providers who need it for these purposes. We may disclose information where required by law.

08International transfers

Providers may process personal information outside the UK, including in the United States. Where UK law requires safeguards for a transfer, these must be in place, such as applicable UK-approved contractual safeguards or a relevant adequacy arrangement. The mechanism depends on the provider, destination and service.

You can contact us for information about the safeguards applicable to your information and how to obtain a copy. Provider processing agreements and the safeguards for the selected production services must be confirmed before live collection begins.

09How long we retain information

Demo and prospective-customer enquiry information may be retained for up to 12 months from the last meaningful interaction, unless a longer period is required because the enquiry develops into an active customer or contractual relationship, or retention is otherwise required by law.

For successful customer relationships, separate customer and commercial retention arrangements may apply. This website-enquiry retention rule does not govern customer investigation or product data.

Operational and security logs are retained only for as long as reasonably necessary for security and troubleshooting, taking account of any legal requirements. Provider retention and deletion arrangements are managed consistently with these purposes.

The application’s in-memory rate limit uses a 15-minute activity window. Expired entries are removed as further requests are processed, and the information is cleared when the process restarts.

10Your rights

Depending on the circumstances, you may have the right to access your personal information, correct it, ask for its erasure, restrict processing or object to processing based on legitimate interests. Data portability applies only where its legal conditions are met; it does not generally apply to processing based on legitimate interests.

Contact us to exercise a right. We may need proportionate information to verify your identity, and will respond within the applicable statutory period. Rights are subject to legal conditions and exemptions. You also have the right to complain to the ICO.

11Cookies and similar technologies

The current website does not use analytics or marketing cookies, advertising trackers, or browser storage to save demo form entries. Fonts are served with the site.

Turnstile runs browser security checks when enabled. We have not configured its optional pre-clearance cookie feature in the website integration. Any security storage introduced by the production hosting or Turnstile configuration must be checked and described before launch. If we introduce non-essential analytics or similar technologies, we will update this notice and obtain consent where required before using them.

12Security

We use measures designed to reduce unauthorised access and misuse, including server-side input validation, request limits and bot verification when configured. Application logs do not deliberately record demo message content, email addresses or verification tokens. No method of transmission or storage can be guaranteed completely secure.

13Links to other websites

External websites have their own privacy practices. This notice does not cover those websites; please read their notices before providing information.

14Changes to this notice

We may update this notice as the website or our processing changes. The date above identifies the latest revision. We will draw significant changes to your attention where appropriate.

15Contact us

For privacy questions or rights requests, contact privacy@thothlabs.io or write to the registered office listed above, marking your correspondence “Privacy”.

16Complaints / ICO

We welcome the opportunity to address a concern, but you can complain directly to the Information Commissioner’s Office, the UK data protection supervisory authority, at ico.org.uk/make-a-complaint. You do not have to contact us first.