This notice covers this website (thatched.ai) and THATCHED Convert at pdf.thatched.ai. The data controller is THATCHED Ltd, company no. 16546239, The Bristol Office, 2nd Floor, 5 High Street, Westbury On Trym, Bristol, England, BS9 3BY. Contact and grievance officer: business@thatched.ai.
The short version
- Your files are processed on our own server. We never sell or share them, and never use them to train AI.
- Free conversions are deleted after 24 hours. Paid orders are deleted after 7 days.
- Contact-form messages are kept for 12 months, then deleted.
- No account, no advertising, no tracking cookies. Ask us to delete your data and we do it within 30 days.
The contact form
When you send the contact form we store: the topic you chose, your email, your name if you gave it, the language you asked for (only for language requests), your message, that you ticked the consent box, the time, and a reference number. We use it only to reply to you. The form is stored in a Cloudflare D1 database. We keep it for 12 months from the day you sent it, then delete it.
To stop spam, the form uses Cloudflare Turnstile. Turnstile runs a check in your browser and Cloudflare sees technical data such as your IP address and browser details to do it. It does not set advertising cookies.
Convert: files, limits and payments
The PDF you upload, the language you choose, and the Word and Excel files we produce are used only to do the conversion and let you download the result. We use your IP address to apply daily free-use limits and to protect the service from abuse.
In India you pay by UPI in your own UPI app. We keep an order record: order reference, number of pages, amount, file name, the UPI transaction reference (UTR) you enter, the times you claimed payment and we released the file, and the payment screenshot if you upload one. We do not receive your bank details. When you claim a payment we send ourselves a phone notification (through Bark) with the order reference, the amount and a shortened file name, so a person can check it. It never contains the file.
Outside India you pay by card through Stripe. Stripe handles your card details; we never see them. We receive the payment confirmation for the order.
The page-view counter
This website loads a small counter script of our own from thatched-tools.pages.dev. When a page loads it sends: the site name, the event ("view"), the page path, and two yes/no flags (first visit today, first visit ever), plus the website you came from (address only, no path) and any utm_source, utm_medium or utm_campaign tags in the link. The two flags are worked out in your browser and kept in its local storage; no cookie is set and no id for you is sent. It does not count automated browsers or known bots. On our server these counts are passed on to Amplitude for analysis, and script errors are reported to Sentry so we can fix them. Your IP address reaches our server as part of any web request.
Who processes data for us
- Vercel and Cloudflare host this website, so they see connection data such as your IP address and keep standard logs.
- Cloudflare also runs our DNS, Turnstile, the contact-form database (D1) and carries traffic to pdf.thatched.ai.
- Stripe processes card payments. UPI payments go through your own UPI app and bank.
- Bark delivers our payment notifications, as described above.
- Amplitude receives page-view counts and Sentry receives error reports, as described above.
How long we keep it
- Free conversion files: 24 hours.
- Paid order files and payment screenshots: 7 days.
- Contact-form messages: 12 months.
- Order records needed for accounting: as long as the law requires.
Legal basis
We process your files and order records to provide the service you ask for (contract); contact-form messages on your consent; and usage and security data for our legitimate interest in keeping the service working and fair. We keep accounting records to meet legal obligations.
Your rights
Under UK GDPR you can ask to see, correct or delete your data, to restrict or object to how we use it, to get a copy, and to withdraw consent at any time. Under India's Digital Personal Data Protection Act 2023 you can ask for a summary of your data and who it is shared with, ask us to correct, complete or erase it, raise a grievance, and nominate someone to act for you.
Email business@thatched.aifrom the address you used. We act on deletion requests within 30 days and reply to every request. If you are unhappy with our answer you can complain to the UK Information Commissioner's Office (ico.org.uk) or, in India, to the Data Protection Board of India.
Changes
If we change how we handle data, we update this page and its date.