Privacy
Last updated 5 October 2026.
This explains what th3sis collects, why, and what you can ask us to do about it. th3sis is the data controller for the information described here.
What we collect
| What | Why | Lawful basis |
|---|---|---|
| Email address | To create your account, sign you in, and send service messages | Performance of a contract |
| Display name and profile picture, if you add them | To show who is signed in | Performance of a contract |
| Portfolio data you enter or import — accounts, transactions, holdings | To compute your returns and track your theses. This is the product. | Performance of a contract |
| Theses, valuation assumptions and notes you write | To value and track them | Performance of a contract |
| Subscription status, and a Stripe customer reference | To know what you have access to | Performance of a contract |
| Basic technical logs from our hosts | To keep the service running and secure | Legitimate interests |
We do not store your card details. Payment is handled by Stripe; th3sis receives a customer reference, a subscription status and a renewal date, and never a card number.
We do not use advertising trackers, and we do not sell personal data to anyone, ever.
Who processes it
- Supabase — database, authentication and file storage.
- Vercel — application hosting.
- Stripe — payments and billing. Stripe is a controller in its own right for the payment data it holds.
- Resend — transactional email, such as confirming your address. Sending is operated from the United States.
Some of these process data outside the UK and EEA. Where they do, transfers rely on the providers’ standard contractual clauses and equivalent safeguards. th3sis is operated from the United Kingdom, so UK data protection law applies to what we do with your data wherever you live.
How it is protected
Your rows are confined to you by row-level security in the database itself, not by the application remembering to filter — a query made on your behalf cannot return another user’s holdings even if the code asking for them is wrong. Profile pictures are served through short-lived signed URLs rather than public links.
How long it is kept
Account and portfolio data is kept while your account exists. If you close your account we delete it within 30 days, except where we must keep something longer — billing records, which UK tax law requires us to retain for six years.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it; and you can object to processing based on legitimate interests. Email support@th3sis.net and we will respond within one month.
If you think we have handled your data badly, please tell us first — but you are entitled to complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
th3sis sets a cookie to keep you signed in and a cookie to remember your theme choice. Both are necessary for the site to work as you asked it to, and there are no analytics or advertising cookies, which is why there is no consent banner.
Contact
Email support@th3sis.net.