Privacy policy

I'm Martin, a sole trader trading as ThermoLet, and I run this site and the ThermoLet service. For data protection law I'm the data controller for the personal data described here — meaning I decide what is collected and why, and I'm responsible for looking after it.

You can reach me about anything on this page at martin@thermolet.co.uk. I answer these myself. My full name and a postal address for formal correspondence are available on request — email and ask, and I'll send them straight back.

This policy covers this website and the signup form in full, and summarises what the ThermoLet service processes once I've set you up. The service isn't generally available yet — I'm onboarding the first hosts personally — so the service section describes how it works today and I'll expand this policy as it grows.

The short version

What I collect when you sign up

The signup form asks for the following. Only the first two are required; leave any of the rest blank and nothing is stored for them.

The form also has a hidden field that people never see. If it's filled in, the submission came from a bot and is discarded without being stored. It's a spam trap, not a tracker.

My lawful basis

Consent. The tick box on the form is not pre-ticked and the form won't submit without it, so nothing is stored unless you actively opted in. You can withdraw that consent at any time and I'll delete your details — see your rights below.

What I do with it

I email you to arrange a setup call, and I use the answers to prepare for it. That's all. I don't sell your details, share them for marketing, or add you to anything you didn't ask for.

Who processes it for me

Two companies handle your signup data on my behalf. Both are processors, which means they act on my instructions and can't use your data for their own purposes. The service you'd use as a host runs somewhere else again — covered below.

Brevo — the mailing list

Your signup goes to Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France), which stores the contact list and sends the emails. Brevo is a French company operating under the GDPR and states that contact data is held in European data centres, so your details aren't transferred outside Europe.

Cloudflare — hosting

This site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address and basic request information in order to serve the page and to block attacks. I haven't enabled any Cloudflare analytics product, and I don't have access to a log of who visited.

Cookies

This site sets no cookies. There is no consent banner because there is nothing to consent to. If that ever changes — if I add analytics or an advertising pixel — I'll ask you first, properly, and refusing will be as easy as accepting.

How long I keep your signup details

• If you become a ThermoLet host: for as long as you're a customer, and then for up to 12 months afterwards in case you come back.
• If you don't: up to 24 months from your signup, then deleted. If I've clearly gone quiet on the idea, sooner.
• If you ask me to delete it: straight away.

Your rights

Under UK data protection law you can ask me to:

• Tell you what personal data I hold about you, and give you a copy
• Correct anything that's wrong
• Delete it
• Stop using it, or restrict what I do with it
• Hand it over in a portable format, or send it to someone else
• Withdraw your consent — you can do this at any time, and it's as simple as replying to any email I've sent you and saying so

Email martin@thermolet.co.uk and I'll action it. There's no charge, and I'll respond within one month. I'm a one-person business, so it'll usually be a lot faster than that.

If you think I've handled your data badly, please tell me first and I'll try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, without going through me at all.

What the ThermoLet service processes

This section applies once you're a host and I've set your property up. It's here so you know what you'd be agreeing to before you get on a call with me.

To link your bookings to your heating, ThermoLet reads:

• Your booking calendar feed — the iCal link your listing already publishes. This gives me arrival and departure dates and times, and whether a period is a guest stay or a block you've made yourself.
• Your thermostat — via the account you connect, the current temperature, the target temperature, the mode it's in and whether it's actively heating.
• Your property settings — the name you give the property, its timezone, your check-in and checkout times, when to start warming up, and any temperature limits you set.
• Your own account details — the email address and password you register with.

Connecting your thermostat uses OAuth, which means you authorise ThermoLet through your thermostat provider's own login. I never see or store your thermostat account password — only a token, which is encrypted in the database rather than held in plain text, and which you can revoke from your provider's app at any time. Revoking it immediately stops ThermoLet controlling anything.

Your thermostat provider (currently Hive, via SmartThings) is a separate company with its own privacy policy governing the account you already have with them. I send commands to it and read the state back; I don't change your relationship with them.

What ThermoLet records as it runs

Every command sent to your thermostat is written to a log: what was sent, when, why, and whether the thermostat accepted it. It's what lets me answer "why was the heating off on Tuesday?" — for you, and for me when something misbehaves. It records your property's heating, not any person.

Where it runs

The ThermoLet service and its database run on Railway (Railway Corporation, 548 Market St PMB 68956, San Francisco, California 94104), in its EU West region — your data is stored in Amsterdam, in the Netherlands. The UK treats the EU as offering equivalent protection, so your data being there changes nothing about the rights you have over it.

Railway itself is a US company, so its staff can in principle reach the infrastructure from outside Europe while running and supporting it. My contract with Railway covers that using the standard clauses UK law provides for exactly this, including the UK addendum.

This is separate from the marketing site above, which is on Cloudflare Pages. Nothing about your property or your bookings goes anywhere near Brevo — that holds signup enquiries only.

How long I keep it

• Bookings last as long as they're in your calendar feed. Cancel a stay and it disappears from ThermoLet at the next hourly read. Stays that have already finished are kept as history, so your past heating still makes sense.
• Remove a calendar and its bookings go with it. Unregister a thermostat and its command log goes with it.
• The command log outlives the booking that caused it — deleting a stay leaves the record that ThermoLet acted, with the stay no longer named.
• Your account, property settings and thermostat connection are kept while you're a host. Close your account and I delete all of it — email me and it's done.

Changes to this policy

If I change anything meaningful I'll update the date at the top, and if it affects how I use data you've already given me, I'll email you rather than quietly editing the page.

← Back to the main page