Legal
Data processing agreement
This agreement forms part of the terms of service between StarSpun Labs Ltd, a company registered in England and Wales (company number 17372613), registered office Office 9267OC, 182–184 High Street North, Area 1/1, East Ham, London, E6 2JA, United Kingdom ("we", the processor) and the studio ("you", the controller). It covers personal information in the content you collect from your clients through ThreadPull, and meets Article 28 of the UK GDPR.
1. The processing
Subject matter and purpose: collecting, storing, showing and returning website content on your behalf. Duration: while your workspace exists, subject to section 9. Types of information: clients' names and email addresses, written answers, comments, images and documents they or you add. People concerned: your clients, their staff, and anyone named or pictured in their content. Special categories: not intended; see the acceptable use section of the terms.
2. Your instructions
We process the information only on your documented instructions. These terms, your use of the service's features, and the retention schedule in section 9 are your instructions. If we think an instruction breaks data protection law we will tell you. We will not use your content for our own purposes, including product analytics, marketing or AI training.
3. Confidentiality and our people
Only people who need to, and who are bound by confidentiality, can access your content, and only to run, support or secure the service: for example to fix a problem you've reported. The software tools we use to build and run ThreadPull are not given access to live customer content.
4. Security
Each studio's content is kept separate, and every request is checked against the studio and project it belongs to. Connections are encrypted. Sign-in links and client links are stored only as one-way hashes. Uploads are checked by type and size and are never run in the browser. Repeated requests are slowed down. Access to the hosting and email accounts uses two-step sign-in.
5. Other processors
You give general permission for us to use the suppliers below. We will email you at least 30 days before adding or replacing one. If you object, you can close your workspace before the change and we will not charge you for the remaining period. We hold each supplier to data protection terms at least as protective as these.
| Supplier | What they do | Where the information is | Safeguard for anything leaving the UK |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database and file storage | Database and files stored in the EU. Cloudflare is a US company and its network may carry requests through other countries. | EU-US Data Privacy Framework with its UK Extension, and the EU standard contractual clauses with the UK Addendum, under Cloudflare's data processing addendum |
| Resend | Sending the service's emails | United States | EU-US Data Privacy Framework with its UK Extension, under Resend's data processing addendum |
| Stripe | Card payments, once paid plans open | UK, EU and United States | Stripe's own data processing terms and transfer safeguards |
No other supplier receives studios' or clients' content. The optional writing-help feature is switched off, and no AI supplier is used. If one is ever added, it will be listed here first, with the notice set out below.
6. Transfers outside the UK
Your files and database are stored in the EU. Where a supplier handles information in the United States, the safeguard listed above applies.
7. Helping you
You can find, correct, export and delete your clients' information yourself in ThreadPull. If you need more help to answer a request from one of your clients, or with a data protection impact assessment or a consultation with the ICO, we will help as far as reasonably possible. If a client contacts us directly, we will pass the request to you rather than answer it ourselves.
8. Personal data breaches
If we become aware of a breach affecting your content, we will tell you without undue delay, and in any case within 48 hours. We will include what we know about what happened, the information and people likely to be affected, and what we are doing about it, and add details as we learn them.
9. Retention, deletion and return
You instruct us to keep and delete your content on this schedule, which you agree to when you sign up:
- While your trial or plan is running: everything is kept.
- Projects with no activity for about six months are archived automatically. We email you 14 days before.
- Archived projects: their files are deleted 60 days after archiving (we email you 7 days before), and the whole project, including answers, is deleted 365 days after archiving (we email you 14 days before). Restoring a project stops the countdown.
- When a free trial ends, or a paid plan lapses (after 3 days' grace for a missed payment), your workspace becomes read-only and you can still download everything. 30 days later the workspace and everything in it is deleted. We email you when it ends, 14 days before and 3 days before.
- If you close your workspace yourself, it is deleted straight away.
- We never delete on schedule without warning you. If our warning emails can't be delivered, deletion waits until they have been.
- Copies of emails we send are kept for 90 days. Sign-in links are never stored in readable form.
- After a workspace is deleted we keep a small record for 365 days: the studio name, the owner's email address, any invite code, the dates and the terms version agreed. This shows the deletion happened and prevents repeat free trials.
- Backups: our database host keeps a rolling history for up to 30 days, so deleted information disappears from it completely within 30 days. Stored files are deleted immediately.
You can download everything at any time before deletion using the export tools. Deletion is final.
10. Information and audits
On reasonable request we will give you the information you need to show we meet this agreement, and answer reasonable written questions about our security.