Legal
Privacy notice
Who we are
ThreadPull is provided by StarSpun Labs Ltd, a company registered in England and Wales (company number 17372613), registered office Office 9267OC, 182–184 High Street North, Area 1/1, East Ham, London, E6 2JA, United Kingdom. Contact: hello@threadpull.co.uk. ICO registration number: [ICO registration number].
Our two roles
For the information in this notice we are the "controller": we decide how it is used. For the content that studios collect from their own clients we are a "processor": we handle it only on the studio's instructions, and the studio's own privacy notice applies. If you are a studio's client, please see our page for clients and contact the studio first.
What we hold, and why
| Who | What | Why | Lawful basis |
|---|---|---|---|
| Studio owners and team members | Name, work email, studio name and logo, plan and payment status (card details are held by Stripe, not us), which terms version was agreed and when, invite code used | To provide the service and send service emails | Contract |
| Anyone using the service | A one-way scrambled form of your IP address and email address, used to slow down floods of requests and deleted within a few hours; sign-in records | To keep the service secure and prevent abuse | Legitimate interests (security) |
| Studios whose workspace has been deleted | Studio name, owner email, invite code, reason, dates and terms version, for 365 days | To show the deletion happened and prevent repeat free trials | Legitimate interests (accountability and preventing misuse) |
| People at web design businesses we contact about ThreadPull | Name, business, work email or phone, from public business sources such as company websites and directories, and notes of our conversation | To tell businesses about ThreadPull | Legitimate interests (business-to-business marketing). You can object at any time and we will stop. |
| People who ask for an invite | Name, studio name, work email, website and any message you add | To reply with an invite code | Legitimate interests (responding to your request). Deleted 90 days after we decide, or after 180 days if we never do. |
| Anyone who emails us | What you send us | To reply and keep a record | Legitimate interests |
| Paying studios | Invoices and payment records | Tax and accounting | Legal obligation |
| Anyone who complains | The complaint and our handling of it | To handle the complaint | Legal obligation |
We do not sell personal information, use it to train AI, or make decisions about you by automated means.
Marketing
We only contact businesses, and we screen telephone numbers against the Telephone Preference Service and Corporate Telephone Preference Service. We only email sole traders and partnerships if they have agreed to it. Every marketing email lets you opt out, and if you ask us to stop we keep your details on a do-not-contact list so we don't contact you again. Otherwise, outreach records are deleted 12 months after our last contact unless you become a customer.
Cookies
We use one essential cookie to keep a studio user signed in. Clients opening their link get no cookies. We use no advertising, analytics or tracking cookies, so we don't ask for cookie consent.
On the sign-up and sign-in pages only, Cloudflare Turnstile checks that you're a person and not an automated script, using technical signals from your browser. Cloudflare uses this only to run the check. It is part of keeping the service secure (legitimate interests).
Who else handles the information
| Supplier | What they do | Where the information is | Safeguard for anything leaving the UK |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database and file storage | Database and files stored in the EU. Cloudflare is a US company and its network may carry requests through other countries. | EU-US Data Privacy Framework with its UK Extension, and the EU standard contractual clauses with the UK Addendum, under Cloudflare's data processing addendum |
| Resend | Sending the service's emails | United States | EU-US Data Privacy Framework with its UK Extension, under Resend's data processing addendum |
| Stripe | Card payments, once paid plans open | UK, EU and United States | Stripe's own data processing terms and transfer safeguards |
No other supplier receives studios' or clients' content. The optional writing-help feature is switched off, and no AI supplier is used. If one is ever added, it will be listed here first, with the notice set out below.
How long we keep it
- While your trial or plan is running: everything is kept.
- Projects with no activity for about six months are archived automatically. We email you 14 days before.
- Archived projects: their files are deleted 60 days after archiving (we email you 7 days before), and the whole project, including answers, is deleted 365 days after archiving (we email you 14 days before). Restoring a project stops the countdown.
- When a free trial ends, or a paid plan lapses (after 3 days' grace for a missed payment), your workspace becomes read-only and you can still download everything. 30 days later the workspace and everything in it is deleted. We email you when it ends, 14 days before and 3 days before.
- If you close your workspace yourself, it is deleted straight away.
- We never delete on schedule without warning you. If our warning emails can't be delivered, deletion waits until they have been.
- Copies of emails we send are kept for 90 days. Sign-in links are never stored in readable form.
- After a workspace is deleted we keep a small record for 365 days: the studio name, the owner's email address, any invite code, the dates and the terms version agreed. This shows the deletion happened and prevents repeat free trials.
- Backups: our database host keeps a rolling history for up to 30 days, so deleted information disappears from it completely within 30 days. Stored files are deleted immediately.
Invoices are kept for six years, as tax law requires. Complaint records are kept for three years after the complaint is closed. Unused sign-in links expire within a day.
Your rights
You can ask for a copy of your information, ask us to correct or delete it, ask us to restrict how we use it, object to how we use it (including to all marketing), or ask for it in a portable form. Email hello@threadpull.co.uk. We will respond within one month.
Complaints
If you are unhappy with how we have handled personal information, email hello@threadpull.co.uk with "Data protection complaint" in the subject. We will acknowledge your complaint within 30 days, look into it properly, keep you told how it is going, and tell you the outcome. If you are still unhappy you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
If we change this notice in a way that matters, we will tell studio owners by email before the change takes effect. Last updated: 10 November 2026.