Privacy

ThreadCase is operated by Dominic Simon Ward, a self-employed sole trader (autónomo, a natural person) established in Spain, who is the data controller for all personal data processed through this service; the controller's tax identification number (NIF: Y2423461B) and registered address (Calle Armiño, Cho, 38632 Arona, Santa Cruz de Tenerife, Spain) are set out in our Legal notice. If you have questions or wish to exercise your data protection rights, you can contact the controller at threadcase@dsl4.com. This notice describes how we collect, use and protect your personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD)

The data we process includes your email address, the case data and documents you choose to upload (which may include contracts, correspondence, medical records and other sensitive materials) and, if analytics are enabled, usage behaviour data. Document content is never included in analytics events. The legal basis for processing your account and case data is Article 6(1)(b) GDPR — processing necessary to perform the contract you enter into with us by creating an account

Any usage analytics are processed on the basis of your consent under Article 6(1)(a) GDPR, which you may withdraw at any time. Where you upload documents that may contain special category data, such as medical records or details relating to legal proceedings, that data is processed solely to provide the service you have requested, on the basis of your explicit consent given at the point of upload under Article 9(2)(a) GDPR. We use the following third-party processors, each bound by a data processing agreement: Cloudflare (infrastructure hosting and file storage — the application runs on Cloudflare Containers and your uploaded case files are stored in Cloudflare R2); Supabase (database hosting in the EU — your account and case data are stored in a managed PostgreSQL database); OpenAI (AI fact extraction on paid plans only — document content is transmitted to OpenAI solely to perform extraction and is not used to train models); Stripe (payment processing); Resend (transactional email delivery); and PostHog (usage analytics, operated from PostHog's EU cloud at eu.i.posthog.com using cookieless in-memory tracking with no document content, and only when analytics are enabled)

Some of these processors may transfer data outside the European Economic Area; where they do, the transfer relies on the European Commission's Standard Contractual Clauses or another adequate safeguard under Chapter V GDPR. Your data is retained for as long as your account remains active. If you request account deletion, your account data, case data and uploaded files are permanently deleted within 30 days of the request

Under the GDPR you have the right to access, rectify and erase your personal data (the right to be forgotten), to restrict or object to its processing, to data portability, and to withdraw any consent you have given at any time without affecting the lawfulness of processing carried out before withdrawal. You can exercise these rights at any time through Account → Privacy & data, or by emailing threadcase@dsl4.com. If you believe your rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD); we encourage you to contact us first so we can try to resolve it, and you can file the complaint through the AEPD electronic office at sedeagpd.gob.es or find information at www.aepd.es

We do not sell your data to any third party, and your document content is never used to train AI models. This site uses only one strictly necessary cookie, an authentication cookie that keeps you signed in, which does not require consent. We do not currently use advertising or non-essential analytics cookies; if we enable non-essential analytics in future, we will first ask for your consent through a cookie banner offering equally accessible accept and reject options, in line with the AEPD cookie guidance.