Privacy Policy

1. Who We Are

The Thol application ("Thol", "our Service") is provided by Black Goblin Audio Limited. We are the data controller for your personal data. If you have any questions about this policy or your data, please contact us at privacy@thol.app.

2. The Data We Collect

• Account Data: Your name and email address. If you subscribe to a paid package, we will also collect billing information and transaction history.
• Professional Information: We collect your profession to help us understand our user base. Optionally, you may provide links to your LinkedIn or IMDB profiles to verify your professional status.
• User Content: Video files you upload for analysis. We store this in your private account space to provide you with access after analysis.
• Technical Metadata: To manage your files efficiently, we generate a "video hash" (a unique digital fingerprint) of your uploaded content. We also generate a visual thumbnail of your video to display in your private dashboard.
• Generated Files: The MIDI files and associated data created by the Service.
• Usage Data: With your consent, we use analytics tools (Microsoft Clarity and Posthog) to collect data about your interactions (such as clicks, navigation patterns, and session recordings). This data is processed in an anonymised or pseudonymised format.
• Communications: Any emails or feedback you send to us, including marketing preferences managed via Mailerlite.

3. Our Lawful Basis for Processing (UK GDPR)

• Performance of a Contract: We process your Account Data, User Content, Technical Metadata, and Generated Files to provide the Thol service. This also includes processing necessary for billing and managing paid "pay-as-you-go" or subscription packages.
• Consent: We rely on your explicit consent for non-essential analytics cookies (Microsoft Clarity and Posthog) and for sending marketing communications via Mailerlite.
• Legitimate Interests: We process Communications for support and service improvement.

4. How We Use Your Data

• To create and manage your account and any associated payments.
• To validate our Ideal Customer Profile (ICP) and ensure the Service is meeting the needs of sound design professionals.
• To provide and operate the Thol service, including displaying your files via thumbnails in your dashboard.
• To prevent redundant processing of files through the use of file hashes.
• To analyse and improve the user experience (subject to consent).
• To send transactional emails (via MailerSend) and marketing updates (via Mailerlite, where you have opted in).

5. Third-Party Data Processors (Sub-processors)

We share your data with the following essential service providers:

• Supabase (EU): Database, authentication, and cloud storage of files and thumbnails.
• Google Cloud Platform (EU/UK/US): AI processing and primary cloud infrastructure.
• Cloudflare: Performance, security, and content delivery.
• Microsoft Clarity (US) & Posthog (EU/US): Product analytics (subject to consent).
• MailerSend & Mailerlite: Automated transactional and marketing emails.

6. International Data Transfers

When data is transferred outside the UK/EEA (e.g., to the US for certain Google or Microsoft services), we ensure protection via the UK Extension to the EU-U.S. Data Privacy Framework or the UK’s International Data Transfer Agreement (IDTA).

7. Data Retention & Deletion

• Active Accounts: We retain your data for as long as your account is active.
• Financial Records: If you purchase a paid package, we are legally required to retain transaction and billing data for 6 years plus the current tax year for UK accounting and tax purposes.
• User Content & Metadata: Your video files, thumbnails, and hashes are linked to your account. They are permanently deleted when you delete your account, when the account becomes inactive (24 months), or upon a valid request for erasure.
• Manual Deletion: You can trigger the irreversible deletion of your account and all associated data at any time from your 'Account' page.

8. AI and Automated Processing

Thol uses AI to generate spotting data. This is a technical tool for your professional use and does not involve automated decision-making with legal effects on you. Under the EU AI Act principles, we classify Thol as a "Limited Risk" AI tool focused on professional productivity.

9. Your Data Protection Rights

Under UK GDPR/DPA 2018, you have the right to access, rectify, erase, or restrict processing. Contact privacy@thol.app. You may also complain to the ICO.

10. Cookies and Tracking Technologies

Please see our updated Cookie Policy for details on how we use tracking technologies, including Posthog and Microsoft Clarity.