Privacy Policy

What this policy covers

This website currently presents ThymeCreek and offers a sign-up for launch news, occasional notes and tips. You can browse without joining the newsletter. A subscription does not give access to a meal-planning or health service.

Customer accounts, Sage, personalised meal planning, wearable or other sensor connections, condition-informed recommendations, ingredient ordering and delivery are planned. They are not active through this website. Sage does not currently process visitors' health information or give individual advice. We will explain any new processing, and obtain any permission the law requires, before launching those services.

Information we receive

When you ask for updates, we receive your email address and a label showing that the request came from this marketing website. Our website passes the request through Vercel to Brevo, which sends a confirmation email and manages the subscription. We record whether you confirm, unsubscribe or object so that we can manage your preference. If Brevo cannot accept a request, the sign-up fails; we do not save a new fallback newsletter record in Vercel Blob.

Brevo handles information about messages, including delivery, failure, complaint and unsubscribe status. Historical records also contain opens and link clicks associated with a contact. Our present per-contact Brevo setting treats unknown interaction-tracking consent as No for future individual open and click measurement. This does not remove historical records or establish that no anonymous measurement occurs.

When you contact us, we receive your address, message and any information you choose to include. Please do not send medical records, allergy information or other sensitive health details through the newsletter form or a general enquiry.

Vercel receives technical information needed to deliver and protect the website, which may include an IP address, requested URL, time, browser or device characteristics and security signals. Its protection systems may create a temporary browser session if they challenge a request. See our Cookie Policy for website storage and access technologies. We do not currently run optional website analytics or Google or Meta advertising pixels on this site.

Purposes and lawful bases

Newsletter. We use your address to send a confirmation request and, only after confirmation, the updates you requested. The lawful basis for sending marketing emails is your consent. We use the request and confirmation record to establish your choice and administer the subscription; our legitimate interest is operating a permission-based mailing list and demonstrating that we respected your preference.

Delivery and suppression. We use delivery, bounce, complaint and unsubscribe status to keep the mailing service reliable and avoid sending to someone who has opted out. Our legitimate interests are maintaining a functioning service and respecting objections; we also process information where necessary to comply with direct-marketing and data-protection duties.

Website and security. We use request and security information to serve pages, diagnose faults and prevent misuse. Our legitimate interests are making the site available and protecting it and its visitors.

Enquiries and rights. We use an ordinary message to answer you on the basis of our legitimate interest in responding. We use information needed for a privacy-rights request or complaint to comply with our legal obligations and to keep a proportionate record of our response. Where necessary, we may retain relevant information to establish, exercise or defend a legal claim, based on our legitimate interest in doing so.

We do not make decisions about you solely by automated means that produce legal or similarly significant effects on this website.

Email interactions

Receiving our newsletter does not require agreeing to person-linked measurement of whether you open or click an email. Brevo has historically recorded identifiable opens and confirmation-link clicks. We are reviewing those earlier records and will seek to remove or de-identify interaction data that is no longer justified, while retaining what is needed to show a confirmation, honour an objection or resolve a specific issue.

Brevo's current per-contact preference is set to avoid individual open and click tracking when permission for that measurement is unknown. Brevo may still record limited delivery-related information, including a last-open date, where it treats the activity as necessary for delivery management. This setting governs future messages and does not rewrite past contact histories, campaign reports or event records. We use necessary confirmation-link activity to know whether you completed sign-up. We do not treat an open or click as renewed marketing consent.

Who handles the information

Vercel hosts and protects the website and handles the sign-up request before it reaches Brevo. Brevo sends the confirmation email, manages newsletter contacts and preferences, and processes email delivery and event information. An email provider handles messages sent to hello@thymecreek.com. These suppliers may use authorised infrastructure and support providers. We may disclose information where the law requires it.

We do not sell newsletter addresses or share them with Google or Meta for advertising through this site at present. If we add advertising or analytics services, we will update this policy and our website controls before using them.

Processing outside the UK

Brevo says its newsletter contact databases are hosted in the European Economic Area. The UK recognises the EEA as providing adequate protection for transfers from the UK. This database location does not mean every delivery, support or onward processing activity stays in the EEA.

Vercel and our other providers may process or access information outside the UK or EEA. Vercel Inc. appears on the US Data Privacy Framework list with the UK Extension for covered non-HR data; that certification is relevant only where that entity actually receives the covered information. Other transfers must be assessed against the applicable UK adequacy regulations or appropriate UK transfer safeguards. We are checking the account-specific recipient and onward-access arrangements and will update this explanation as they are confirmed. Email hello@thymecreek.com to ask about the destination and arrangement for a particular transfer.

How long we keep information

We use the following retention schedule. Reviews and removals are carried out manually; these are our controller rules, not a claim that every supplier automatically deletes all copies at the same time. A documented legal claim or other legal duty may require the minimum relevant information to be kept longer, with the exception reviewed.

• Unconfirmed request: review and remove a pending contact that remains unconfirmed after 30 days from the request, if Brevo creates one. No marketing is sent before confirmation.
• Confirmed contact: keep it while subscribed; review age annually. At 24 months from the last affirmative confirmation or renewed permission, ask for fresh permission or stop marketing and remove the ordinary subscription record. An open or click is not renewal.
• Permission evidence: keep the minimum request, confirmation, source and withdrawal details while marketing, then for 24 months after the later of the last marketing message or withdrawal, unless a specific claim requires longer.
• Do-not-contact record: retain only the information needed to avoid emailing an address after an unsubscribe, objection, complaint or hard bounce while the marketing channel operates or that instruction remains relevant. Review this record yearly. Removing the rest of a profile does not necessarily mean removing this block.
• Ordinary enquiries: review for deletion 12 months after the last substantive reply or resolution. Keep a minimal record of privacy-rights requests and complaints for six years after closure, with an annual review; remove unnecessary attachments sooner.
• Our exports and working copies: delete them within 30 days after the task closes, unless a documented hold applies. Any old private newsletter objects from a previous fallback are to be inventoried and removed where unjustified; the current sign-up no longer creates them.

Our Brevo transactional email log is configured for one month, with message previews off. That setting does not limit contact History, campaign reports or all email events to one month. Brevo says some event records may have no automatic expiry in smaller accounts. We review historical identifiable interaction records monthly and seek deletion or de-identification when no delivery, abuse, rights or legal purpose justifies keeping them. Provider-held records and backups may follow their own documented retention cycles; we will investigate those when dealing with a rights request rather than promise an unverified universal deletion date.

Website request and security information is used only while needed for page delivery, fault diagnosis or abuse investigation. We delete any controller-controlled export or drain within 30 days after its case closes, absent a documented hold. The period for some provider-held security records and backups depends on the provider's own retention process; dashboard visibility is not the same as deletion.

Newsletter choices and objections

You can withdraw newsletter consent or object to direct marketing at any time by using the unsubscribe link in a marketing email or emailing hello@thymecreek.com. We will stop sending marketing to your address and retain only a proportionate suppression record where needed to honour that choice. Withdrawal does not affect the lawfulness of processing before it.

Tell us separately if you also want us to consider erasure of other information. You do not need to subscribe to use the website. An objection to direct marketing also covers any profiling for that purpose.

Your data protection rights

Depending on the circumstances, you can request access, correction, erasure, restriction and a portable copy of your personal information. You can object to processing based on legitimate interests, including a direct-marketing objection, and withdraw consent where we rely on it. Some rights have legal exceptions; we will explain if one applies.

Email hello@thymecreek.com to make a request. We may ask for information reasonably needed to verify identity. Requests are normally free. We will respond without undue delay and generally within one month, subject to lawful extensions. We will not wait for an erasure decision before actioning a direct-marketing objection.

Questions and complaints

Contact ThymeCreek Ltd at hello@thymecreek.com if you have a privacy question or complaint. We will acknowledge a data protection complaint within 30 days and investigate and respond without undue delay. You can also complain to the UK Information Commissioner's Office without asking our permission.

Other pages and changes

Read our Cookie Policy, Terms & Conditions, and Health & Wellness Disclaimer. We will update the date and this page when our handling of personal information changes materially.