We collect only what we need to answer you and to build and look after your website. We never sell your data, and you can ask us what we hold about you at any time.
ThrelsLoom is a service of Threls Ltd, a company registered in Malta under number C80922, with its registered office at Quad Central, Tower Q5, Level 02, Central Business District ("Threls", "we", "us"). For threlsloom.com, we are the controller of your personal data.
You can reach us about anything in this policy at info@threls.com.
This policy covers personal data we collect when you visit threlsloom.com or get in touch with us, and — for clients — when you use the ThrelsLoom CMS to manage your website.
If you visit a website that one of our clients runs on ThrelsLoom, that client is responsible for your data and its own privacy policy applies. We handle that data only on the client's behalf and on their instructions.
What you send us. Your name, email address and message, when you contact us through the site.
What your device tells us. IP address, browser type, pages visited and the time of your visit, recorded in our server logs.
Client account details. For clients: the name, work email and role (Admin or Editor) of each person using the CMS, and a record of activity for security purposes.
Billing details. For clients: billing contact, company details and payment records.
We do not knowingly collect special categories of data (such as health or religious beliefs), and we ask you not to send them to us.
Replying to your enquiry — the data you send us — because you asked us to before entering a contract, or our legitimate interest in responding
Building, running and supporting your website — client account details — performance of our contract with you
Keeping the website and CMS secure — device and log data — our legitimate interest in security
Invoicing and keeping accounts — billing details — legal obligation under Malta tax and company law
threlsloom.com sets no cookies for visitors browsing the site. If you log in to the ThrelsLoom CMS, two strictly necessary cookies are set by our server to keep your session working.
XSRF-TOKEN — protects forms against forgery — lasts 2 hours
laravel_session — keeps your CMS login working page to page — lasts 2 hours
We share personal data only with the service providers who help us run ThrelsLoom, and only as much as each needs. Each is bound by a contract to protect it.
Hetzner (via Laravel Forge) — hosts threlsloom.com, the CMS and its databases — Germany (eu-central)
Vercel — hosts our clients' public websites — United States (us-east-1)
DigitalOcean Spaces — stores images and files uploaded to the CMS — Germany (eu-central)
Postmark — sends account emails such as welcome and password reset — United States
Sentry — records technical errors so we can fix them — European Union (EU)
Where a provider handles data outside the European Economic Area, we make sure it is protected to EU standards, using an EU adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.
Enquiries that don't lead to work — 24 months after our last contact
Client account data — while you are a client, then 90 days so you can take a copy, then deleted
Server and application logs — 14 days
Security, audit and error logs — 90 days
Billing and accounting records — 10 years, as Maltese tax and company law requires
You can ask us to:
tell you what data we hold about you and give you a copy;
correct it if it is wrong;
delete it, where we no longer need it;
restrict or object to how we use it, including any use based on our legitimate interests;
give it to you, or another provider, in a portable format.
Email info@threls.com. We reply within one month and may ask you to confirm your identity first.
If you are unhappy with how we handled your data, you can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or to the data protection authority where you live. We would appreciate the chance to put it right first.
Each client's data sits in its own database, separate from every other client's. Every site is served over HTTPS and access is limited to the people who need it. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the regulator as the law requires.
ThrelsLoom is a business service and is not meant for anyone under 16. We do not knowingly collect their data.
If a change affects how we use clients' data, we will tell them by email before it takes effect.
