Thanex Privacy Policy

This Privacy Policy explains how Thanex Ltd ("Thanex", "we", "us", "our") handles personal information across the whole Thanex service: the mobile app for iOS and Android, the Thanex Cloud web portal at app.thanex.uk, paid subscriptions, and the connection that lets you link an AI assistant to your data (together, the "Service").

Thanex Ltd is registered in England and Wales with company number 16426957. Our registered address is Flat 11, Mill Pond Place, 1 Mill Lane, Maidstone, ME14 1GL. For any privacy question or to exercise your rights, contact us at support@thanex.uk. System emails are sent from noreply@thanex.uk.

This Privacy Policy should be read alongside our Terms of Use, which it forms part of.

Thanex handles two different kinds of information, and who is legally responsible is different for each. This structure matters for your rights, so please read it.

Bucket 1: Project Content. This is the photos captured through the Service and the structured information about them, including the details burned into each photo and the data stored for search and filter. The Organisation that owns the project is the controller of this content. Thanex acts as the processor and handles Project Content on the Organisation's behalf and on its instructions. If you want to access, correct, or delete Project Content, the Organisation that controls it is responsible, and you should contact that Organisation. See Section 11.

Bucket 2: Account and Service Information. This is the information Thanex needs to give you an account and run the Service, such as your name, email, sign-in details, and information about how you use the Service. Thanex is the controller of this information.

Where this Privacy Policy refers to information generally, it covers both buckets.

Account level information:

• your full name and email address;
• your sign-in method, which may be email and password, or Apple, Google, or Microsoft sign-in.

Organisation level information:

• the free text name of the Organisation you create or join.

Project level information:

• your Job Title, where an Owner or Admin sets one for you in a project.

Photo data (Project Content):

• the photos you capture and the details burned into each photo, which include the project, the Photo Type, the date, the time, the photographer name, the Job Title where set, any tags and description you add, GPS coordinates where available, and a "Captured with Thanex" watermark;
• a structured copy of the photo information held in our database for search, filter, and AI queries.

Technical and usage information:

• information needed to run, secure, and support the Service, such as device and log information, and information about how the Service is used.

We do not ask for special category data and you should not capture it unless you have the right to and a lawful basis for doing so.

When you capture a photo, the image and a metadata strip are burned together into a single JPEG file at the moment of capture. The burned details are permanently fixed and cannot be edited or removed afterwards. There is no separate unstamped original, and the file contains no EXIF metadata. A structured copy of the photo information is stored in our database so the Service can search, filter, and answer AI queries.

Photos are stored in Thanex Cloud and are not automatically saved to your phone gallery. The app has write only access to your device gallery, so you can choose to save a photo out, but the app does not read or import photos from your existing library.

GPS coordinates are captured automatically when you grant location permission and are shown on the strip. You can turn location off in your device settings, after which GPS is not recorded. Capture still works without GPS.

Photos are stored in Amazon Web Services in the London region (eu-west-2), which means photo storage is kept in the United Kingdom.

For the Account and Service information we control, we rely on the following lawful bases under UK GDPR:

• Contract: to create and run your account, provide the Service, and provide and manage paid plans bought on the web.
• Legitimate interests: to secure, maintain, support, and improve the Service, to keep records, and to protect Thanex, our users, and third parties. Where we rely on legitimate interests, we balance our interests against your rights.
• Legal obligation: to meet our legal, tax, and accounting duties.
• Consent: for any marketing emails, which we will only send if you have agreed. You can withdraw consent at any time. Service emails are not marketing and are covered in Section 12.

For Project Content, the Organisation is the controller and is responsible for the lawful basis for capturing and using that content. Thanex processes Project Content on the Organisation's instructions.

We use trusted service providers to run the Service. We share information with them only so far as needed and under contracts that require them to protect it. We share by category as follows:

• Cloud storage for photos: a cloud hosting provider that stores photos, in the United Kingdom (London region, eu-west-2).
• Application and database hosting: a provider that hosts the application and database.
• Website and frontend hosting: a provider that hosts our website and frontend.
• Communications and notifications: providers used for system emails and for services such as push notifications, diagnostics, and analytics.
• Payment processing for web purchases: Stripe processes payments for paid plans bought at app.thanex.uk. Thanex does not store your full card details.
• Sign-in providers: Apple, Google, and Microsoft, where you choose to sign in with them.
• AI assistants you connect: where you choose to connect one, as described in Section 7.

We do not sell your personal information. We may also share information where we must by law, to protect our rights or the safety of others, or in connection with a business sale or reorganisation.

Thanex Cloud lets you connect external AI assistants you choose, such as Claude, ChatGPT, or Copilot, to your own Thanex data. When you connect one, Thanex gives that assistant read access to the structured data in your database and to your images, on your instruction. Technically, this connection is provided through a Model Context Protocol (MCP) connection.

The AI assistant you connect is a third party service that Thanex does not own or control. Thanex passes your own data to the assistant because you have instructed us to. What you or the AI assistant then do with that data is your responsibility and is outside Thanex's control. The assistant has its own terms and privacy practices, which you should review before connecting.

Thanex does not use your photos or content to train its own artificial intelligence or machine learning models, and does not provide your photos or content to any third party to train their models.

Photo storage is kept in the United Kingdom. For other parts of the Service, we use trusted service providers who may process data in the United Kingdom, the European Union, or the United States. Where data is transferred outside the United Kingdom, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, so that your information continues to be protected. You can ask us for more information about the safeguards we use by contacting support@thanex.uk.

We keep personal information only for as long as we need it.

• Account and Service information: kept while your account is active and for a reasonable period afterwards to meet our legal, accounting, and security needs.
• Project Content: kept while the Organisation that owns it needs it. The Organisation, as controller, decides how long to keep its Project Content within the Service.
• Deleted photos: when a photo is permanently deleted, it is held for 30 days and then permanently removed from the Service.
• Backups and legal copies: after content is removed from the Service, we may still hold copies for a limited period in routine backups and any copies we are required to keep by law, after which they are deleted or overwritten in the normal course.

You can delete your account from within the mobile app and from the web portal. When you delete your account, we remove or anonymise the Account and Service information we hold about you as controller, except for anything we must keep by law.

Project Content is owned by the Organisation, not by you, so deleting your individual account does not delete Project Content from the Organisation's projects. Your name may remain attributed to photos you captured because those photos belong to the Organisation. If you want Project Content removed, the Organisation that controls it is responsible, and you should contact that Organisation. Some information may also remain for a limited period in routine backups and where we must keep it by law.

Under UK data protection law you have rights over your personal information, including the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, and the right to object. Where we rely on consent, you can withdraw it at any time.

For Account and Service information, which Thanex controls, contact us at support@thanex.uk and we will respond as required by law.

For Project Content, the Organisation that owns the project is the controller. To access, correct, or delete Project Content, please contact the Organisation that controls your data. As processor, Thanex will help the controlling Organisation respond to your request, but we cannot decide these requests ourselves for content we do not control.

You also have the right to complain to us directly about how we handle your personal information, and the right to complain to the Information Commissioner's Office (ICO). We would like the chance to deal with your concerns first, so please contact us at support@thanex.uk. We will acknowledge your complaint within 30 days and respond without undue delay. You can contact the ICO at ico.org.uk or by post or phone using the details on their website. Complaining to us does not affect your right to complain to the ICO.

Some emails are part of the Service and are not marketing. These include account verification, password reset, project and Organisation invites, and important notices about your account or the Service. Because these emails are needed to provide the Service, you cannot opt out of them while you have an account. They are sent from noreply@thanex.uk.

Any marketing emails are separate. We will only send marketing if you have agreed, and you can opt out of marketing at any time without affecting service emails.

The mobile app asks for the following device permissions:

• Camera: required to capture photos. This is the core function of the app.
• Location: used to record GPS coordinates on the photo strip when you grant permission. You can turn location off in your device settings, and capture still works without it.
• Notifications: used to send you push notifications about your account and activity, where you allow them.
• Save to device (write only): the app can save a photo out to your device gallery when you choose to. The app does not read or import photos from your existing photo library.

You can change these permissions at any time in your device settings.

The Service is for people aged 18 and over and is intended for use at work in construction. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has used the Service, contact us at support@thanex.uk.

We may update this Privacy Policy from time to time. If we make a significant change, we will give reasonable notice, for example by email or through the Service. The "Last updated" date shows when it last changed.

For any privacy question or to exercise your rights, contact us at support@thanex.uk. Thanex Ltd, Flat 11, Mill Pond Place, 1 Mill Lane, Maidstone, ME14 1GL. Company number 16426957, registered in England and Wales.