Last updated 21 October 2026
I'm Martin, a sole trader trading as ThermoLet, and I run this site and the ThermoLet service. For data protection law I'm the data controller for the personal data described here. That means I decide what is collected and why, and I'm responsible for looking after it.
You can reach me about anything on this page at [email protected]. I answer these myself. My full name and a postal address for formal correspondence are available on request. Email and ask, and I'll send them straight back.
This policy covers this website, the signup process and the ThermoLet service.
This site sets no cookies of its own and the page loads nothing from a third-party domain. There is no advertising pixel, no analytics script and no tracking of any kind. Fonts are served from this domain rather than Google's, specifically so that visiting the page doesn't tell anyone else you were here.
The only personal information you deliberately give me through this site is what you type into the signup form. The infrastructure that delivers the site processes technical information such as your IP address in order to serve you the page, which is covered below.
The signup form asks for the following. Only the first two are required; leave any of the rest blank and nothing is stored for them.
| What | Why I ask |
|---|---|
| First name | So I can write to you like a person |
| Email address | To arrange your setup, and it's the only way I contact you |
| Thermostat make | To check I support it. Right now that means Hive |
| Number of properties | To plan how long your setup will take |
| Booking platform | To check I can read your calendar feed |
| Best time to call | So I don't ring at a useless hour |
The form also has a hidden field that people never see. If it's filled in, the submission came from a bot and is discarded without being stored. It's a spam trap, not a tracker.
I process your signup details because you've asked me to contact you about ThermoLet, and to take the steps you've asked for before we enter into a contract. The tick box on the form is not pre-ticked and the form won't submit without it, so nothing is stored unless you deliberately asked for it.
Two narrower bases sit alongside that. I rely on my legitimate interest in running and securing the service for things like keeping the site up and blocking spam submissions, having weighed that against your interests. And where I rely on consent for a particular use, such as sending you something that is marketing rather than about your own setup, I'll ask for it separately and you can withdraw it at any time. I may also have to keep some information to meet a legal obligation, tax records being the obvious one.
Whichever applies, you can ask me to stop and to delete your details: see your rights below.
I email you to arrange a setup call, and I use the answers to prepare for it. That's all. I don't sell your details, share them for marketing, or add you to anything you didn't ask for.
Two companies handle your signup data on my behalf. Both are processors, which means they act on my instructions and can't use your data for their own purposes. The service you'd use as a host runs somewhere else again, covered below, and Brevo does one further thing once you're a host, also below.
Your signup goes to Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France), which stores the contact list and sends the emails. Brevo is a French company operating under the GDPR, and its data processing agreement lists the servers that hold contact data as being in the EU: OVH in France, and Google Cloud in Belgium.
Being stored in the EU isn't quite the same as never leaving it, and I'd rather say so. The same agreement allows processing outside the European Economic Area where Brevo, its group companies or its own suppliers operate, its support tooling being the everyday example, and covers those transfers with standard contractual clauses or the EU-US Data Privacy Framework. So: your details are stored in Europe, and may be accessed from outside it under those safeguards.
Brevo also delivers the emails ThermoLet sends you once you're a host: the code you sign in with, and, if you switch them on, emails about your own property. That is a separate thing from the mailing list, from the same company.
This site is hosted on Cloudflare Pages (privacy policy). Like any web host, Cloudflare processes your IP address and basic request information in order to serve you the page and to block attacks. I haven't enabled any Cloudflare analytics product, and nothing in my account gives me a log of who visited. What Cloudflare itself keeps, and for how long, is governed by its own terms rather than by me.
ThermoLet sets no cookies on this site, and uses none anywhere for analytics, advertising or tracking. There is no consent banner because there is nothing to consent to. Cloudflare may set a strictly necessary cookie of its own for security or bot filtering; that isn't something I can read, and it tells me nothing about you. If my own position ever changes (if I add analytics or an advertising pixel), I'll ask you first, properly, and refusing will be as easy as accepting.
The ThermoLet app sets two cookies, both strictly necessary. One protects your account against forged requests, and is set when you open the app. The other is set when you ask for a sign-in code, so that the code only works in the browser that asked for it. Once you've signed in, it keeps you signed in for up to 30 days, so you don't need a fresh code every visit. Signing out deletes it, both in your browser and on ThermoLet's side. Neither cookie is shared with anyone. You can clear them from your browser at any time, which signs you out.
Records I have to keep for tax or accounting are the exception to all of the above, and are kept for as long as the law requires.
Under UK data protection law you may have the right to ask me to:
Which of these applies depends on the data and why I'm holding it. Erasure and portability, in particular, don't cover everything in every situation: I can't delete a record I'm legally required to keep, for instance. Where a right doesn't apply I'll tell you which one and why, rather than just declining.
Email [email protected] and I'll action it. There's no charge, and I'll respond within one month. I'm a one-person business, so it'll usually be a lot faster than that.
If you think I've handled your data badly, please tell me first and I'll try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, without going through me at all.
This section applies once you're a host, whether I set your property up with you or you set it up yourself. It's here so you know what you'd be agreeing to before you start.
To link your bookings to your heating, ThermoLet reads:
I don't store anything about your guests. ThermoLet takes three things from a calendar feed: the booking's reference, when it starts, and when it ends. Never payment information, which no feed carries. It also reads each entry's title, but only to tell a guest stay from a block you've made yourself, and it stores the answer to that question rather than the text.
Airbnb's feed does put two extra details in each booking: a link to the reservation, and the last four digits of the guest's phone number. ThermoLet ignores both. They are not read and not stored. I have no way to identify who is staying in your property, and I don't want it.
Connecting your thermostat uses OAuth, which means you authorise ThermoLet through your thermostat provider's own login. I never see or store your thermostat account password, only a token, which you can revoke from your provider's app at any time. Revoking it immediately stops ThermoLet controlling anything.
That token is encrypted by ThermoLet, with AES-256-GCM, before it is written to the database. That is a stronger thing than the disk encryption a hosting provider gives you: the value is unreadable in the database itself, and in any backup of it, without a key that lives in the application's configuration rather than in the data.
A Hive reaches ThermoLet through Samsung SmartThings, so there are two companies in that chain besides me: your thermostat provider, and Samsung. Both are separate companies with their own privacy policies (Hive, SmartThings), governing accounts you hold with them rather than with me. You authorise the connection through their own login, so you see exactly who you're authorising. I send commands and read the state back; I don't change your relationship with either of them.
Every command sent to your thermostat is written to a log: what was sent, when, why, and whether the thermostat accepted it. It's what lets me answer "why was the house cold on Tuesday?", both for you and for me when something misbehaves. It records your property's heating, not any person.
ThermoLet has no passwords. Each time you sign in, it emails you a 6-digit code, which works once and expires after 30 minutes. The email contains the code and nothing about your properties or your bookings. Brevo delivers it, through the same email-sending service as the property emails below. These emails are how you get into your account rather than something you opt into, and they are never marketing.
ThermoLet stores a keyed hash of each code, never the code itself, and counts wrong guesses against your account so that a code can't be guessed. Used and expired codes stay with your account, as hashes, until it's closed. To stop codes being requested in bulk, ThermoLet also counts requests per IP address, in memory only: that count is never written down, and is gone the next time the service restarts.
You can ask ThermoLet to email you when it changes the heating at one of your properties. It is off for every property until you switch it on, and you switch it on and off per property, in that property's settings. Switched on, you get two messages per booking: one when the warm-up hands the thermostat back your schedule before an arrival, and one when checkout turns it back down to your minimum temperature for the empty property. Nothing else is emailed under this setting.
A message contains your name for the property, your name for the thermostat, the time ThermoLet changed it, and the arrival or departure time of the booking behind the change. Nothing about your guests, because there is nothing about your guests to put in it.
Brevo delivers them: the same company as the mailing list above, but its email-sending service rather than its contact list. It carries the message and, like any email provider, keeps its own record of what it sent. Switching these on does not add you to the marketing list and is not consent to marketing: they go to the address you registered with, they're about your own setup, and the switch in your settings is the only thing that turns them on or off.
Subscriptions are handled by Stripe (Stripe Payments Europe, Limited; privacy policy), which runs the checkout page, takes payments and sends your receipts. I use it because it means your card details never reach ThermoLet: you type them into Stripe's page, and I never see or store them.
When you start checkout, ThermoLet tells Stripe your email address and your ThermoLet account number, so a payment can be matched to your account. On Stripe's page you give it your name, optionally a business name, your billing address and your card. Stripe then emails you about your subscription: receipts, and a notice if a payment fails.
From Stripe, ThermoLet keeps only what it needs to know whether your subscription is paid for: a reference to your customer record and your subscription at Stripe, the subscription's status, whether you pay monthly or yearly, how many properties your plan covers, when your free trial ends, and the date of any failed payment. Nothing about your bookings, your properties or your thermostat goes to Stripe. I process this to provide the service you've subscribed to, and keep payment records because tax law requires it.
Stripe Payments Europe is a processor for me: it takes and holds your payment details on my behalf. The payments themselves are processed in the UK by its sister company Stripe Payments UK, Ltd, which is authorised by the Financial Conduct Authority. For some purposes of their own, such as preventing fraud and meeting their legal obligations as payment providers, the Stripe companies decide for themselves how to use the data and are responsible for it under Stripe's privacy policy. Stripe is based in the US and processes data there as well as in Europe, under the safeguards set out in its data processing agreement and privacy policy.
If your subscription stops, because it's cancelled or a payment can't be collected, ThermoLet emails you to say so, through Brevo like the emails above. That message says only that the subscription has stopped, and why.
The ThermoLet service and its database run on Railway (Railway Corporation, privacy policy), in its EU West region, so your data is stored in Amsterdam, in the Netherlands. The UK treats the EU as offering equivalent protection, so your data being there changes nothing about the rights you have over it.
Railway itself is a US company, so its staff can in principle reach the infrastructure from outside Europe while running and supporting it. That access is covered by Railway's data processing agreement, which I have signed: it includes the standard contractual clauses and the UK addendum, which is the safeguard UK law provides for exactly this. Choosing the EU region limits the exposure further: the data itself sits in the Netherlands, not the United States.
This is separate from the marketing site above, which is on Cloudflare Pages. Your calendar feed, your bookings and your thermostat token stay on Railway and are sent nowhere else. The exceptions are the emails, which are handed to Brevo to deliver: sign-in codes, which carry only the code, and the property emails, if you switch them on, which carry the two names and the one time described there. Brevo's mailing list still holds signup enquiries and nothing else. Billing is the other thing handled outside Railway, by Stripe, as described above, and none of your booking or thermostat data goes with it.
I take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. In practice that means: access to the production system and its database is restricted to me; there are no passwords to steal, and sign-in codes are stored only as keyed hashes, so a copy of the database yields no code that works; thermostat tokens are encrypted as described above; and everything travels over HTTPS.
No online service can be guaranteed completely secure, and I won't pretend otherwise. If there were a breach affecting your data I'd deal with it as the law requires, which includes telling the ICO within 72 hours where the rules call for it, and telling you if it were likely to put you at risk.
If I change anything meaningful I'll update the date at the top, and if it affects how I use data you've already given me, I'll email you rather than quietly editing the page.
← Back to the main page