Privacy policy

Theralon, of 490 Post St, Ste 500 PMB 2507, San Francisco, CA 94102, United States, is the controller of the personal information described in this policy. “We” and “us” mean that entity.

If you have a question about this policy, or want to exercise any of the rights in section 08, write to [email protected].

Two categories, and no more than that.

Information you give us. The contact form asks for your first name, last name, work email address, phone number, job title, company or institution, and country. A message is optional. What you submit is delivered as an email to our own mailbox and recorded in a private log of enquiries held in the same Google Workspace account — nothing else. The form sets no tracking identifier and passes through no marketing platform. If you email us directly instead, that correspondence sits in the same mailbox.

Information collected automatically. Serving a page produces an ordinary server log: the IP address the request came from, the browser user-agent string, the URL requested, the referring page, and a timestamp. Our hosting provider records these in order to serve the site, absorb attacks, and keep it available. We do not use them to build a profile of you.

We do not ask for special category data — health, biometrics, political or religious views, and the rest — and would rather you did not send any. This site takes no payments and stores no payment details. It is not directed at children, and we do not knowingly collect information about them.

This site sets no cookies of its own, no advertising cookies, and carries no third-party tracking pixels.

• Analytics. We use Cloudflare Web Analytics to count visits and see which pages are read. It sets no cookies, stores nothing in your browser, does not fingerprint you and does not follow you across other sites. We see aggregate figures, never individuals.
• Security. Our hosting provider may set a strictly necessary cookie to tell people from automated abuse. It is essential to keeping the site available and is not used for tracking.

Every use below is tied to the legal basis we rely on under the UK GDPR and the EU GDPR.

• Answering your enquiry, and following it up. Legitimate interests — replying to someone who has asked us to get in touch.
• Keeping the site available, secure and free of abuse. Legitimate interests — protecting our infrastructure and the people using it.
• Understanding how the site is used. Legitimate interests — aggregate visit statistics that identify no one.
• Keeping records of contracts, correspondence and consent where we are required to. Legal obligation.

Where we rely on legitimate interests we have weighed those interests against your rights and freedoms, and we will explain that assessment on request. We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not use it to train models.

We do not sell personal information, rent it, or share it with advertising networks or data brokers.

A short list of service providers processes it on our behalf, under contract and on our instructions:

• Cloudflare — hosting, content delivery, attack mitigation and visit statistics for this site. Processes request logs.
• Google (Google Workspace) — the mailbox behind [email protected], the service that receives contact form submissions (Google Apps Script), and the private log they are recorded in.

Beyond those, we disclose personal information only where the law requires it, to professional advisers under a duty of confidence, or to a successor organisation if the business is transferred — in which case this policy travels with it and you will be told.

The providers above operate globally, so your information may be processed outside the country you are in, including in the United States.

Where that involves a transfer out of the United Kingdom or the EEA, it is made under the safeguards those regimes require: an adequacy decision where one applies, and otherwise the relevant Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable), together with the provider’s own supplementary measures. Ask us and we will tell you which mechanism covers a particular transfer.

• Enquiry correspondence — for as long as the conversation is live, and for up to 24 months after the last contact, so that we can pick it up where it left off. Longer if it becomes part of a contract record we are required to retain.
• Server logs — short-lived, on our hosting provider’s standard retention, typically days rather than months.

Ask us to delete your correspondence earlier and we will, unless we are legally required to keep it.

Under UK and EU data protection law you can ask us to:

• Give you a copy of the personal information we hold about you, and tell you what we do with it.
• Correct it if it is wrong or incomplete.
• Delete it, where we have no continuing reason to hold it.
• Restrict how we use it while a question about it is being resolved.
• Send it to you, or to someone else, in a portable, machine-readable form, where that right applies.
• Stop using it, where we rely on legitimate interests and you object.
• Withdraw your consent at any time, where consent is what we relied on. Withdrawing it does not undo anything done beforehand.

Write to [email protected]. There is no charge, and we will respond within one month. We may first ask you to confirm who you are — only so that we do not hand your information to somebody else.

If you think we have handled your information badly, you can complain to a supervisory authority: in the UK, the Information Commissioner’s Office at ico.org.uk; in the EU, the authority for the country where you live or work. We would rather you raised it with us first, and we will take it seriously.

Traffic to this site is encrypted in transit over HTTPS. Contact form submissions are received by a service running inside our own Google Workspace account; no credentials appear in the code this site serves. The form validates and length-limits every field before it accepts a submission. Access to the mailbox is limited to the people who need it.

No system is perfectly secure and we will not claim otherwise. What we can say is that we do not collect what we do not need, which remains the strongest protection available.

We will update this page as the site changes. The date at the top always reflects the version currently in force. If a change materially affects how we handle your information, we will make that clear on the site rather than leaving you to spot it.

Email [email protected], use the contact form, or write to us at Theralon, 490 Post St, Ste 500 PMB 2507, San Francisco, CA 94102, United States.