Thanex Cookie Policy

1. Purpose and Scope

1.1 The Cookie Policy, referred to as the “Policy,” explains how Thanex Ltd uses cookies, local storage, software development kits, pixels, tags, device identifiers, and comparable storage or access technologies.

1.2 Thanex Ltd, referred to as “Thanex,” “we,” “us,” or “our,” is a private limited company incorporated in England and Wales under company number 16426957. Its registered office is at Flat 11, Mill Pond Place, Mill Lane, Maidstone, England, ME14 1GL, United Kingdom.

1.3 Thanex operates five environments that a person can reach, and the technologies used in each of them differ. The public website at https://thanex.uk uses strictly necessary technologies and Cloudflare Web Analytics, which stores nothing on a visitor’s device, and presents no consent banner. The web application at https://app.thanex.uk uses only technologies that operate without consent. The mobile applications use device storage, operating-system permissions, and the subscription-entitlement software development kit described in clause 12, rather than browser cookies. The upload page reached through a Task link uses two strictly necessary technologies and nothing else, and so does the page that opens a photograph from a Report link. Clause 6 sets out the position for each environment, and the remaining clauses describe the individual categories.

1.4 Third-party websites, application marketplaces, authentication pages, and payment pages place their own technologies under their own policies. Thanex does not control the technologies placed independently by Apple, Google, Microsoft, RevenueCat, or Amazon Web Services on their own domains.

2. Contact Details

2.1 Questions concerning cookies, consent settings, analytics, or related personal-data processing may be sent to [email protected].

2.2 Postal enquiries may be addressed to Thanex Ltd, Flat 11, Mill Pond Place, Mill Lane, Maidstone, England, ME14 1GL, United Kingdom.

3. Applicable Legislation

3.1 The use of cookies and related technologies is governed principally by the Privacy and Electronic Communications (EC Directive) Regulations 2003, referred to as “PECR,” as amended by section 112 of the Data (Use and Access) Act 2025, which came into force on 5 February 2026, together with the United Kingdom General Data Protection Regulation, referred to as the “UK GDPR,” and the Data Protection Act 2018.

3.2 PECR applies whenever information is stored on, or accessed from, a computer, telephone, tablet, browser, mobile application, or other terminal equipment. The rules apply whether or not the information stored or accessed amounts to personal data, so a value written by a mobile application falls within them just as a browser cookie does.

3.3 Where information derived from a cookie identifies an individual, or can reasonably be connected to one, the UK GDPR also applies, and, for a visitor in the European Economic Area, Regulation (EU) 2016/679 may apply as well.

3.4 Schedule A1 to PECR, inserted by the Data (Use and Access) Act 2025, sets out the exceptions to the consent requirement. Paragraph 3 concerns storage or access necessary solely for transmitting a communication, paragraph 4 concerns storage or access strictly necessary for an information society service that the subscriber or user has requested, paragraph 5 concerns statistical purposes, paragraph 6 concerns adapting the appearance or the function of a website to a user’s preferences, and paragraph 7 concerns emergency assistance.

4. Meaning of Cookies and Similar Technologies

4.1 A cookie is a small text file placed on a browser or device when a person accesses a website or an online service, and it may store an identifier, a preference, an authentication status, session information, a consent choice, or other technical information.

4.2 A first-party technology is set by the domain being visited, and a third-party technology is set by another domain. A session technology is discarded when the browser closes, and a persistent technology remains for a defined period or until it is deleted.

4.3 References in the Policy to cookies include local storage, software development kits, pixels, tags, and device identifiers, unless the context requires otherwise.

5. Where Consent Is Required and Where It Is Not

5.1 Clear information about the purpose of each technology must be given before it is used.

5.2 A technology that requires consent is not activated before the User has made an affirmative choice. Closing a banner, continuing to browse, or leaving a pre-selected setting untouched does not constitute valid consent.

5.3 Consent must be freely given, specific, informed, and capable of being withdrawn as easily as it was given.

5.4 Strictly necessary technologies operate without consent under paragraphs 3 and 4 of Schedule A1 to PECR, because they are required in order to transmit a communication or to provide a service that the User has expressly requested.

5.5 The statistical exception in paragraph 5 and the appearance exception in paragraph 6 of Schedule A1 apply only where their statutory conditions are met, which include the provision of clear and comprehensive information and a simple means of objecting, free of charge. Thanex does not rely on either exception on its public website at present, because no preference or statistical technology that stores or reads information on a visitor’s device is used there.

5.6 Thanex measures visits to the public website with Cloudflare Web Analytics, which sets no cookies and does not use local storage or any other technology that stores information on, or reads stored information from, a visitor’s device. It therefore operates without a consent request.

6. What Each Thanex Environment Uses

6.1 The public website at https://thanex.uk uses strictly necessary technologies and Cloudflare Web Analytics, which stores nothing on a visitor’s device. It uses no preference, analytics, marketing, or advertising technology that requires consent, so no consent banner or cookie-preference tool is presented there.

6.2 The web application at https://app.thanex.uk uses only technologies that operate without consent. The session and authentication technologies described in clause 7 are strictly necessary under paragraph 4 of Schedule A1 to PECR, and so is the entitlement value described in clause 12.4, without which a signed-in Account cannot be shown the functionality that has been paid for. The display preference described in clause 8 is stored only because the signed-in User has actively selected it in the account settings, so storing it is likewise strictly necessary in order to deliver the setting that the User asked for. No analytics or marketing technology operates there, no consent banner is displayed, and the position is explained through the Policy and a link kept in the interface.

6.3 The mobile applications use device storage, application identifiers, authentication tokens, notification tokens, cached data, and the RevenueCat software development kit rather than browser cookies. No analytics software development kit, no advertising software development kit, and no attribution or crash-reporting software development kit is embedded in them. Device permissions, which are not cookies but which involve access to device functions, are described in clause 13.

6.4 The upload page reached through a Task link, and the page that opens a photograph from a Report link, use a session identifier and a security control, both strictly necessary, and are described in clause 14. No consent banner appears there either.

6.5 The purpose of the arrangement described in clause 6 is to confine consent requests to the environment in which they are genuinely required, so that a working User is not asked repeatedly to make a choice that has no application to the tool being used.

7. Strictly Necessary Technologies

7.1 Strictly necessary technologies support functions without which the requested website, application, or Account service cannot operate properly.

7.2 Their purposes include maintaining a signed-in session, authenticating a User, keeping a request associated with the correct Account and Workspace, recognising which plan entitlement applies, balancing load between servers, protecting against fraudulent or automated access, and protecting a form submission.

7.3 Blocking these technologies through browser or device settings may prevent sign-in, Account access, form submission, or other core functions.

7.4 The legal permission for their storage or access arises under paragraph 3 or paragraph 4 of Schedule A1 to PECR. Where personal data is processed by means of them, Thanex relies on contractual necessity, on legal obligations, or on its legitimate interests in operating and protecting the Service.

7.5 No record of a cookie choice is kept on the public website, because no choice is requested there.

8. Preference and Functionality Technologies

8.1 A preference technology remembers a choice that alters the appearance or the operation of an interface, such as a display theme, a language, an interface layout, or an accessibility setting. Local storage is used to retain the value, and the browser preserves it until local storage is cleared or the setting is changed.

8.2 The public website uses no preference technology at present. If one is introduced, it will be offered with a free means of objection or, where the appearance exception in paragraph 6 of Schedule A1 to PECR does not apply, with a request for consent.

8.3 In the web application the position is different, because the preference exists only where a signed-in User has gone into the account settings and chosen it. Storing a setting that the User has expressly selected is strictly necessary in order to provide the service requested, within paragraph 4 of Schedule A1, and the User removes it by changing the setting back.

9. Analytics on the Website

9.1 Analytics technologies help Thanex understand how the public website is used, and they operate on https://thanex.uk only.

9.2 The information collected comprises the page viewed, the referral source, the browser, operating system, and device type, the country derived from the IP address, and page-load performance measurements.

9.3 Cloudflare Web Analytics, provided by Cloudflare, Inc., is used to measure visits. It sets no cookies, uses no local storage, and does not use fingerprinting to identify a visitor or to follow a visitor across visits or across websites.

9.4 Because nothing is stored on or read from a visitor’s device, no consent is requested for Cloudflare Web Analytics. The information published by Cloudflare is available at https://www.cloudflare.com/web-analytics/.

9.5 Refusing analytics does not restrict access to the website, to the web application, or to the mobile applications.

9.6 If Thanex introduces an analytics technology that stores or reads information on a visitor’s device, such as Google Analytics, the Policy will be revised before it is used, and the technology will be activated only where consent has been given.

10. Marketing and Campaign Measurement

10.1 Thanex does not use marketing or campaign-measurement technologies on its website, in its web application, in its mobile applications, or in its emails. If it introduces them, the Policy will be revised before they are used, and they will be activated only where consent has been given.

10.4 Marketing cookies, pixels, and comparable tracking technologies are used only with the consent required by PECR and by the UK GDPR or the EU GDPR.

10.5 Withdrawing cookie consent does not by itself remove a person from an email list. Marketing emails are stopped by selecting the unsubscribe link in the message or by writing to [email protected].

11. Authentication Technologies

11.1 Users may sign in with Apple, Google, or Microsoft.

11.2 Selecting a third-party sign-in option may direct the User to the provider’s domain or activate the provider’s authentication interface, and the provider may use cookies to identify the account, to maintain its own session, to apply security checks, and to record that authorisation has been granted.

11.3 Technologies used on a provider’s own domain are governed by that provider’s policy. Thanex receives only the information authorised through the authentication process, subject to the provider’s settings and to the Thanex Privacy Policy.

11.4 After sign-in, the authentication token issued to the browser or to the mobile application is a strictly necessary technology under clause 7.

12. Subscription Purchases and the Entitlement Technology

12.1 Paid subscriptions are sold through the Apple App Store and Google Play. No checkout page is operated by Thanex, and no payment technology is placed by Thanex on any Thanex domain.

12.2 Technologies used during a purchase are placed by the relevant Store within its own application or on its own domain, and they are governed by the terms and the privacy notice of Apple or of Google.

12.3 The mobile applications embed the software development kit supplied by RevenueCat, Inc., which Thanex uses to determine whether the signed-in Account holds an active subscription and which entitlements follow from it. The kit stores on the device the values needed for that purpose, which may include the Thanex application user identifier, cached entitlement and subscription-status information, and technical device information, and it communicates with the RevenueCat service to validate the Apple receipt or the Google purchase token issued by the Store.

12.4 The entitlement value is a strictly necessary technology within paragraph 4 of Schedule A1 to PECR. Without it the application cannot tell whether the User is on Free, on Professional, or on a Business plan, cannot tell how many live Projects the plan in force allows, and cannot therefore deliver the service that the User has requested and paid for. No consent is requested for it, and none is required.

12.5 The RevenueCat technology is not payment-card processing. It handles no card number, expiry date, or security code, and it takes no payment. Neither is it marketing technology, advertising technology, or analytics technology: it is not used to profile a User, to build an audience, to measure a campaign, to attribute an installation to a source, or to study how the application is used.

12.6 Information handled by RevenueCat on behalf of Thanex is described in the Thanex Privacy Policy, together with the transfer safeguards applying to it.

13. Mobile Applications and Device Permissions

13.1 The mobile applications use device storage, application identifiers, authentication tokens, notification tokens, cached data, and the entitlement values described in clause 12 in place of browser cookies. Their purposes include keeping a User signed in, holding the photo stamping settings of the active Workspace, recording the active Workspace, caching images so that the gallery can be displayed without repeated download, queuing an upload while connectivity is unavailable, recognising the plan entitlement in force, and routing push notifications to the correct device.

13.2 Camera permission allows capture through the application. Location permission allows the application to receive GPS coordinates for a capture. Notification permission allows the delivery of authorised push notifications concerning Tasks, invitations, Project activity, security, and entitlement events. Photo-library permission, where it is requested, allows a captured file to be written to the device gallery.

13.3 Device permissions are not cookies. They are addressed in the Policy because they involve access to device functions and may generate or store technical identifiers.

13.4 Every permission may be withdrawn at any time in the settings of the device or of the application. Withdrawal of camera permission prevents capture, and withdrawal of location permission prevents the recording of GPS coordinates, while previously captured records remain unaffected.

13.5 Apple and Google may collect their own diagnostic and crash information from a device according to the settings chosen by the User in the operating system. Collection of that kind is carried out by those providers and is governed by their policies.

14. Task Upload Pages and Report Photograph Links

14.1 A person who uploads photographs through a Task link uses a page operated by Thanex and does not need an Account.

14.2 That page uses strictly necessary technologies alone, namely a session identifier that keeps the upload associated with the correct request and a security control that protects the page against automated abuse. No analytics technology, no marketing technology, and no entitlement technology is used there, and no consent banner is therefore presented.

14.3 A short privacy notice appears on the upload page before any photograph is supplied, and the handling of the information collected is described in the Thanex Privacy Policy.

14.4 A person who opens a photograph from a link in a Report does not need an Account. That page uses the same strictly necessary technologies as the upload page and no analytics, marketing, or entitlement technology.

15. Managing Consent and Preferences

15.1 The public website uses no technology that requires consent, so no consent banner is presented on a first visit.

15.2 Should Thanex introduce an optional technology on the website, a visitor will be offered the choice of accepting it, rejecting it, or deciding category by category before it is used, and rejecting it will leave every essential function of the website available.

15.3 A link to the Policy is kept in the website footer. If a consent tool is introduced, a Cookie Settings link will be kept there too, and withdrawing consent will be as straightforward as giving it.

15.4 Withdrawal takes effect for future processing. It does not undo processing lawfully carried out while consent was in force, and it does not delete data already collected, which is instead retained for the periods described in clause 18.

16. Browser and Device Controls

16.1 A browser can be configured to block or delete cookies, to reject third-party cookies, or to clear stored data when it closes, and each browser publishes its own instructions.

16.2 Blocking all cookies, including strictly necessary ones, will prevent sign-in and will stop the web application from working.

16.3 Deleting cookies signs a User out of the web application, and the User must sign in again.

16.4 Clearing the storage of a mobile application signs the User out and removes the cached entitlement value. Signing in again restores both, because the entitlement is re-read from the Store record rather than recreated locally.

17. International Transfers

17.1 Google, Microsoft, Apple, RevenueCat, Amazon Web Services, and Cloudflare may process technical information outside the United Kingdom.

17.2 A restricted transfer is made only where a lawful transfer mechanism is available, as described in the Thanex Privacy Policy.

18. Retention of Information Collected Through These Technologies

18.1 A session technology expires when the browser session ends, and an authentication token expires according to the security configuration applied to it.

18.2 No record of a cookie choice is kept on the public website, because no choice is requested there.

18.3 Analytics information is retained by Cloudflare for the period it applies to Web Analytics data, and it contains no cookie or device identifier.

18.4 No campaign-measurement information is collected.

18.5 Entitlement values cached on a device are refreshed when the application checks subscription status and are removed when the User signs out, when the application storage is cleared, or when the application is uninstalled. The corresponding records held by Thanex and by RevenueCat are retained for the periods stated in the Thanex Privacy Policy.

19. Changes to the Policy

19.1 The Policy may be amended where a technology is added, removed, or reconfigured, where a provider changes its own practice, or where the law changes.

19.2 A material change affecting a consent requirement will be reflected in the Policy, and in a consent banner and preference panel where one becomes necessary, before it takes effect.

19.3 The date at the head of the Policy identifies the latest revision.

20. Contact

Enquiries about the Policy may be directed to Thanex Ltd, Flat 11, Mill Pond Place, Mill Lane, Maidstone, England, ME14 1GL, United Kingdom.

Email: [email protected]

Website: https://thanex.uk

Web application: https://app.thanex.uk

Company number: 16426957.