Privacy policy.
The controller is Thylon Limited, currently in incorporation in the United Kingdom. Hosting, the application form processor and retention periods are stated below. The remaining items — company number, registered office and VAT number — will be published once registration completes. A German Datenschutzerklärung will follow.
Controller
Thylon Limited, a company in incorporation in England and Wales, is the controller for personal data processed on this website. The company has no registered office address yet; one will be published here once incorporation completes. Contact: hello@thylon.com.
No cookies, no advertising trackers
We set no cookies of our own and run no advertising or third-party tracking scripts on this site, which is why there is no consent banner. Basic site usage is still measured — see “Site analytics” below.
Visiting this site
Our website is hosted by GoDaddy, which processes technical access data (IP address, timestamp, requested page, browser information) in server logs to deliver the site securely. Legal basis: legitimate interest (Art. 6 (1)(f) GDPR). Logs are kept briefly and then deleted.
Web fonts: this draft currently loads fonts from Google Fonts, which transmits your IP address to Google. Fonts will be self-hosted at launch, and this section updated.
Site analytics
We use Lovable's built-in visitor analytics to understand how the site is used. It sets no cookies, stores nothing on your device, does not keep your IP address and cannot identify you or recognise a returning visitor. It records the pages you visit, where you came from, your country, browser, operating system and device type, how long you stay, how fast pages load, errors, and which buttons and links are clicked. There is no banner for this, so it is recorded for every visitor. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.
The access application
When you apply for access we process the details you submit — name, work email, company, what you ship, destinations, applicable regimes, team size and timeline — solely to evaluate your application and run the launch cohort. Legal basis: steps prior to entering a contract (Art. 6 (1)(b) GDPR) and legitimate interest. Application data is deleted after 12 months if no customer relationship follows.
Recipients
Hosting: GoDaddy. Application form processing: Formspree (Formspree Inc., United States), which receives the details you submit and stores them on Amazon Web Services servers in the United States. That is a transfer outside the UK and EU; Formspree relies on Standard Contractual Clauses for it. Site analytics: Lovable (see “Site analytics” above). We disclose any further third-country transfers and safeguards here when another processor outside the UK or EU is engaged.
Your rights
- Access, rectification and erasure of your personal data
- Restriction of processing and data portability
- Objection to processing based on legitimate interest
- Complaint to a supervisory authority — to be confirmed once the registered office is in place; for a UK company this is the Information Commissioner's Office (ICO)
Changes
We update this policy as the product and its processors change; the current version always lives at this address.