Privacy Policy
Last updated: 15 August 2026
This Privacy Policy explains how Threadsovereign Ltd (“Threadsovereign”, “we”, “us”, “our”) collects, uses, stores and protects your personal data when you use the Threadsovereign platform (“Platform”). It applies to all portal users including Principal Designers, Contractors, Clients, Residents and Platform Administrators.
This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Roles depend on whose data it is. That split matches the Data Processing Agreement.
- Threadsovereign is the controller for account, billing, security, cookie-consent evidence, and support data we decide how to process.
- The Customer is the controller for personal data it uploads or generates about residents, contractors, clients, and other third parties — including PEEPs, complaints, safety concerns, and golden-thread documents.
- Threadsovereign is the processor for that Customer-controlled data, on the Customer's documented instructions.
Company details
Threadsovereign Ltd
Registered in England and Wales
Company Registration Number: 17178521
VAT Number: GB 522 6434 10
Registered Office: 1 St. Peters Mews, Poole, England, BH14 0DN
ICO Registration Number: ZC132889
Data Protection contact: privacy@threadsovereign.io
2. Data We Collect
We collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account data | Full name, email address, job title, phone number, password (hashed) | Provided by you at registration |
| Organisation data | Company name, Companies House registration number, VAT number, registered address | Provided by your organisation admin |
| Profile data | Role within the platform (e.g. Principal Designer), user preferences, notification settings | Provided by you or your admin |
| Project & building data | Building addresses, project names, building height, number of storeys and units, Gateway submission records, document metadata | Provided by you in the course of using the Platform |
| Resident data | Flat/unit number, floor, resident name and contact details (for Resident Portal users) | Provided by the Accountable Person or BSM, or directly by residents |
| PEEP / evacuation-plan data | Personal emergency evacuation plans, including mobility or health information needed to plan evacuation (special category / Art.9) | Entered by the Accountable Person or BSM as controller; resident may confirm or update |
| Usage data | Login timestamps, IP address at login, pages visited, features used | Collected automatically |
| Audit log data | Record of actions taken on the Platform (document uploads, approvals, Gateway submissions) | Generated automatically |
| Communications | Messages sent through the Platform's messaging feature, RFI content | Provided by you |
| Cookie data | Session identifiers, analytics data (with consent) | See Section 9 |
The Platform does process special category personal data where the Customer records a personal emergency evacuation plan (PEEP). Mobility and health information in a PEEP is special category data under UK GDPR Article 9. The Customer is the controller and must have both an Article 6 lawful basis and an Article 9 condition. The Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 require explicit consent before prescribed information is shared with the fire and rescue authority — that sharing consent is not automatically the Article 6 basis for storing the PEEP. Counsel should confirm the Customer's Article 6 / 9 pair before go-live. The Platform can record two optional timestamps on a PEEP — Art.9 processing consent and FRA-sharing consent — and does not require either tick to save. Do not upload other special category data (for example racial or ethnic origin, or biometric templates) unless the DPA records a written instruction. If you believe special category data has been uploaded in error, contact privacy@threadsovereign.io.
3. Lawful Basis for Processing
UK GDPR requires that every processing activity has a lawful basis. Below we set out the basis for each type of processing we carry out:
| Processing Activity | Lawful Basis | Detail |
|---|---|---|
| Creating and managing your account | Contract (Article 6(1)(b)) | Processing is necessary to perform the contract between you (or your organisation) and Threadsovereign |
| Providing all Platform features | Contract (Article 6(1)(b)) | Core service delivery |
| Storing building safety records, Gateway submissions, Golden Thread documents (as processor) | Customer's instruction + Customer's Article 6 basis (often legal obligation Article 6(1)(c) — BSA s.88 / SI 2023/907) | We process as processor. The Customer decides the basis. We do not delete records still inside a statutory keep window or legal hold — see Section 5. |
| PEEP / evacuation-plan records (as processor) | Customer's Article 6 basis + Article 9 condition (counsel to confirm pair) | Health / mobility data. Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 consent is for sharing prescribed information with the FRA, not a substitute for the Article 6/9 analysis. |
| Maintaining activity logs | Legitimate interests (Article 6(1)(f)) as controller of security logs; Customer's legal obligation / instruction as processor of golden-thread change records | SI 2023/907 reg.7(1)(f) requires changes to prescribed information to be recorded. Application users cannot edit those entries in the product UI. |
| Sending transactional emails (password reset, notifications) | Contract (Article 6(1)(b)) | Part of service delivery |
| Session management and security monitoring | Legitimate interests (Article 6(1)(f)) | Our legitimate interest in platform security and preventing unauthorised access. We have conducted a balancing test and concluded this processing does not override your interests. |
| Analytics cookies (Vercel Analytics and PostHog) | Consent (Article 6(1)(a)) | Only fires after you grant analytics consent via the cookie banner. You may withdraw at any time. |
| Marketing communications (not currently active) | Consent (Article 6(1)(a)) | We will only send marketing communications with your explicit consent |
4. How We Use Your Data
We use your personal data to:
- Create and manage your Platform account
- Provide the building safety compliance features of the Platform
- Enable collaboration between Principal Designers, Contractors, Clients, Residents and Regulators
- Generate, store and maintain Gateway submission records required by the Building Safety Regulator (BSR)
- Maintain the Golden Thread of building information as required by the Building Safety Act 2022
- Send you notifications about tasks, deadlines, approvals and system alerts
- Provide customer support
- Detect and prevent fraud, abuse and security incidents
- Comply with our legal obligations
- Improve the Platform (with your consent for analytics)
5. How Long We Keep Data
We retain personal data only as long as necessary for the purposes set out in this policy, and no longer than required by applicable law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Mandatory occurrence reports and related MOR documents | 7 years from the day the AP created or received the report | SI 2024/41 Sched.1 paras 12 and 28 |
| Relevant complaints to the PAP (summary) and recurring-complaint logs | 7 years from receipt (recurring log: from the most recent complaint) | SI 2024/41 Sched.1 paras 14 and 30 |
| Maintenance / inspection records described in Sched.1 | 7 years (where the paragraph states that window) | SI 2024/41 Sched.1 paras 10 and 26(b) |
| Contravention notices given by an AP (BSA s.96) | 5 years from the day the notice was given | SI 2024/41 Sched.1 para 31 |
| Other golden-thread documents (default product policy) | 7 years from creation (configurable 7–25 on Enterprise); legal hold blocks purge | Product policy supporting BSA s.88 / SI 2023/907 reg.7 — not a 15-year statutory floor. BSA ss.79–82 are BAC, not a keep-everything clock. |
| Activity log entries | Aligned with the related record's keep window or legal hold | SI 2023/907 reg.7(1)(f) — record who changed prescribed information and when |
| User account data (name, email, job title, phone) | Duration of active subscription + 6 months after termination | Operational necessity; soft-anonymised after 6 months where legally permissible |
| Auth sessions | Until sign-out or token expiry (Supabase Auth refresh as configured) | Keep you signed in. Not a 24-hour rolling wipe. |
| Marketing consent records | Until withdrawn + 3 years | ICO guidance on evidencing consent |
| Cookie consent records | 3 years or until withdrawn | ICO / PECR evidence of consent |
| Billing records and invoices | 6 years from invoice date | UK tax law (HMRC requirement) |
| Failed login / rate-limit signals | Short-lived (typically days, not a fixed 90-day lockout store) | Security monitoring. The Platform rate-limits auth; it does not implement a published '5 failures / 30 minutes' account lockout. |
7. International Data Transfers
The UK has not yet made an adequacy decision in respect of all countries where our sub-processors operate. Where data is transferred outside the UK we rely on:
- UK–US Data Bridge and/or the UK International Data Transfer Agreement (IDTA) / SCCs — for transfers to US-hosted services (billing, email, SMS, and other US-hosted vendors on the sub-processor list)
- UK adequacy — for EU-hosted services (production and staging Supabase in eu-west-2, Vercel functions in London, and PostHog EU cloud when that host is used)
Application functions run in London (Vercel eu-west-2) and query the production database in the UK/EU (Supabase eu-west-2). Production document bytes are in the London Vercel Blob store (lhr1). Those hops are not UK–US transfers. Other sub-processors may still process data in the US (see the list in this policy and the DPA). Do not treat this as “EU hosted, no international transfer.”
You can request a copy of the relevant transfer safeguards by contacting privacy@threadsovereign.io.
8. Your Rights Under UK GDPR
You have the following rights in relation to your personal data. To exercise any right, contact privacy@threadsovereign.io. We will respond within 30 calendar days.
| Right | What It Means | Limitations |
|---|---|---|
| Right of access (DSAR) | Request a copy of all personal data we hold about you, in a portable format | We may verify your identity before releasing data |
| Right to rectification | Ask us to correct inaccurate or incomplete data | Golden-thread records must stay accurate (BSA s.88). Corrections are made by a new version or a logged change, not by silent rewrite. |
| Right to erasure ('right to be forgotten') | Ask us to delete your personal data | We cannot erase records still inside a SI 2024/41 keep window, legal hold, or configured retention period. We will tell you exactly what cannot be erased and why. |
| Right to data portability | Receive your personal data in a machine-readable format (JSON) | Applies to data you provided to us and that we process on the basis of consent or contract |
| Right to restriction | Ask us to stop actively processing your data (while retaining it) | Available while an objection or rectification request is pending |
| Right to object | Object to processing based on legitimate interests | We will stop unless we can demonstrate compelling legitimate grounds |
| Rights related to automated decision-making | We do not make solely automated decisions that produce significant effects on individuals | — |
10. Security
We take the security of your data seriously and implement the following technical and organisational measures:
- All data encrypted in transit via TLS 1.2+
- All data encrypted at rest (Supabase AES-256)
- Role-based access control (RBAC) with Row Level Security (RLS) on all database tables
- Multi-factor authentication available to all users; enforced for platform_admin (AAL2) outside listed exception paths
- Auth rate limiting and session controls (not a published “5 failures / 30 minutes” lockout)
- Activity logs that application users cannot edit in the product UI
- Private file storage — all uploaded documents are stored with access controls
- Regular security assessments. Cyber Essentials and an external penetration test have been applied for; we do not claim certification or a completed pen-test report until those instruments exist. We do not hold a SOC 2 report.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Article 33.
11. Children
Platform accounts are for adults (18+). We do not offer accounts to children. A Customer may still record a child's evacuation needs in a PEEP as controller. That is the Customer's processing, not Threadsovereign creating a children's service. If you believe a child has been given an account in error, contact privacy@threadsovereign.io.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law or our practices. We will notify you of material changes by email or by a prominent notice in the Platform. The “Last updated” date at the top of this page indicates when the policy was last revised.
Your continued use of the Platform after any change constitutes acceptance of the updated policy. Where changes require fresh consent, we will obtain it explicitly.
13. Contact Us
For any data protection queries, requests or complaints:
Data Protection Contact
Threadsovereign Ltd
1 St. Peters Mews, Poole, England, BH14 0DN
Email: privacy@threadsovereign.io
We aim to acknowledge all requests within 5 working days and respond in full within 30 calendar days. Where a request is complex, we may extend this by a further 2 months — we will notify you if this applies.