Privacy notice

Who is responsible

The operator of Thermalix is the controller of your personal data. Write to us through the “Request access” form on the home page (say it is about your data) about anything in this notice.

What is kept, and why

Your account: email address, password (stored only as a one-way hash by Supabase) and sign-in times — to let you sign in. Your projects: the building data you enter, which can include its location, drawings you trace on and the results — to keep them for you. If you ask for access on the public page: your name, email, role and message — to reply. The legal basis is providing the service you asked for (GDPR Art. 6(1)(b)); for access requests, the steps you asked for before an account.

Who handles it for us

Supabase (database and sign-in; servers in Frankfurt, EU) and Cloudflare (serves the website). When you use the location map or place search, your browser loads map pictures and searches from the OpenStreetMap Foundation (UK), which then sees your IP address and what you searched. Weather data is fetched by our own server and doesn't carry your data. Cloudflare is a US company; transfers rely on the EU–US Data Privacy Framework and the EU's standard contractual clauses, and the UK has an EU adequacy decision.

In your browser

Only what the app needs: your sign-in session and a few settings (local storage). No advertising or tracking cookies, no analytics, no third-party fonts.

How long

Your account and projects until you delete them (or ask us to). Access requests until they are answered, and at most 12 months after.

Your rights

You can see, correct, download or delete your data, object to or restrict its use, and take it elsewhere. In the app: Account (your initial at the top right) → "Download all my data" or "Delete my account". For anything else, or a request about an access request, write to us through the “Request access” form on the home page (say it is about your data). You can also complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or the authority of your own country.

What we don't do

No selling or sharing of your data, no advertising, no decisions about you made by a computer.

Changes

This notice may change; the version on this site applies. Last updated 30 October 2026.