Theia Privacy Policy

Last updated: August 2026

This policy explains how Theia collects, uses, shares, and protects personal information when you use our mobile and desktop apps, our website, and related services (together, the "Services"). The Services are available in the United Kingdom, the European Economic Area (EEA), and the United States, and this policy is written to meet the requirements of the UK GDPR, the EU GDPR, and applicable US state privacy laws.

1. Who we are

Theia is operated by GETTHEIA LTD, a company registered in England and Wales with company number 17395702, whose registered office is at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ ("Theia", "we", "us", or "our"). For the processing described in this policy, we are the data controller unless stated otherwise.

Privacy enquiries: privacy@gettheia.co

Support enquiries: support@gettheia.co

2. Information we collect

Depending on how you use Theia, we may process:

• Account and profile information: name, email address, authentication identifiers, business name, contact details, business address, and business logo.
• Inventory content: item photographs, titles, descriptions, categories, materials, condition, dimensions, prices, costs, locations, notes, and other catalogue fields you add to your inventory.
• Voice content: audio you choose to submit for transcription and the resulting text.
• Contacts and transaction records: information you enter about buyers, sellers, consignors, ownership, purchases, sales, invoices, and consignment activity. This may include personal data about people other than the account holder.
• Subscription and billing records: plan, subscription status, payment-provider customer and subscription identifiers, invoice and payment status, and related support history. Our payment provider (Stripe) or the applicable app marketplace (Apple or Google) processes payment-card details; we do not receive or store your full card number. Stripe’s privacy notice is available at stripe.com/privacy.
• Support and website enquiries: information submitted through contact forms, email, or support conversations.
• Technical and security information: IP address, browser and device information, operating system, timestamps, authentication and service logs, error and crash information, and security events generated when the Services are used. This information is primarily needed to maintain the security and operation of the Services.
• Cookie and preference data: essential site and session preferences and, where enabled and consented to, optional analytics or marketing data. See section 12.

Sensitive information. We do not ask for, and do not intend to process, special category data (such as health, biometric, or religious information). Please do not enter such information into the Services.

3. How and why we use information (lawful bases)

The UK GDPR and EU GDPR require us to have a lawful basis for each use of personal information. We rely on the following:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded the processing is proportionate. Where we rely on consent, you may withdraw it at any time by emailing privacy@gettheia.co or, for marketing emails, by using the unsubscribe link included in every message; withdrawal does not affect processing already carried out lawfully.

We do not sell personal data, and we do not use your inventory content for advertising.

4. Why our employees cannot see your stored data

We have designed Theia so that your inventory database is isolated to your account by the system itself, not merely by internal policy. In practical terms:

• Row-level security at the database layer. Every record in the Theia database is tagged to the account that created it, and the database engine enforces row-level security policies on every query. A request can only ever return rows belonging to the authenticated user making it. This restriction is applied by the database itself, so it cannot be bypassed by the app, by an API call, or by an internal admin console.
• No standing staff access. Our employees and contractors do not have day-to-day access to customer inventory content, photographs, contacts, or transaction records. There is no internal tool that lets staff browse customer data.
• Least-privilege production access. Direct access to production infrastructure is limited to a small number of authorised engineers, protected by multi-factor authentication, and used only for operating and maintaining the service (for example, deployments and database migrations), not for viewing customer content.
• Encryption. Data is encrypted in transit (TLS) and at rest on our hosting provider’s infrastructure.
• Support access only with your permission. If you ask us for help that genuinely requires looking at something in your account, we will ask for your permission first. Any such access is limited to what is needed to resolve your issue and is logged.

The only circumstances in which we would access account data without a support request from you are the narrow ones the law anticipates: investigating a security incident affecting your account, or complying with a valid legal obligation. Any such access is restricted to authorised personnel, limited to what is necessary, and recorded.

5. AI-assisted cataloguing

When you choose to use AI-assisted features, the photos, audio, text, or related item information needed for that specific request is sent to the relevant AI service provider, which returns draft catalogue details or a transcription. AI output may be inaccurate or incomplete and should always be reviewed by you before you rely on it.

Our AI provider is currently OpenAI, accessed through its API platform for business customers. Under OpenAI’s API terms, which apply to our use of the service, data submitted through our integration is not used to train or improve OpenAI’s models. OpenAI may retain API inputs and outputs for up to 30 days to provide the service and monitor for abuse, after which they are deleted unless OpenAI is legally required to retain them. We have entered into OpenAI’s standard data processing addendum. If we change or add AI providers, we will update this policy.

Theia does not make solely automated decisions that have legal or similarly significant effects on you.

6. Who receives your information

We share personal information with carefully selected service providers (processors) that help us operate Theia. They act only on our documented instructions, under contracts requiring them to protect your information, and cannot use it for their own purposes. The categories of recipient are:

An up-to-date list of the specific providers we use, including their processing locations and transfer safeguards, is available on request from privacy@gettheia.co.

We may also disclose information when required by law, to establish or defend legal claims, or in connection with a genuine business reorganisation (such as a merger or sale of assets), subject to appropriate safeguards. We do not sell, rent, or trade personal data.

7. International transfers

Some of the recipients described in section 6 process information outside the UK and EEA (for example, in the United States). Where UK or EU data-protection law requires it, we rely on an adequacy decision (including, where applicable, the EU–US Data Privacy Framework and its UK Extension) or on Standard Contractual Clauses together with the UK International Data Transfer Addendum, and we carry out transfer risk assessments where required. You can request further information about, or a copy of, the relevant safeguard by contacting privacy@gettheia.co.

8. How long we keep information

We retain information only for as long as needed for the purposes described in this policy, including legal, accounting, security, dispute, and backup requirements:

When we no longer need personal information, we delete or anonymise it. Where deletion from backup archives is not immediately possible, we securely store the information, isolate it from further processing, and delete it in line with our backup cycle.

9. Security

We use technical and organisational measures designed to protect information, including encrypted transport, encryption at rest, multi-factor authentication for administrative access, least-privilege access controls, database row-level security policies (see section 4), logging, and monitoring. No internet service can guarantee absolute security; if you believe your account or information is at risk, please contact us immediately at support@gettheia.co.

10. Your rights (UK and EEA)

Depending on the circumstances and the lawful basis we rely on, you have the right to:

• be informed about, access, and obtain a copy of your personal data;
• have inaccurate data corrected and, in certain cases, have data erased;
• restrict or object to certain processing, including any direct marketing;
• receive certain data in a portable format; and
• withdraw consent at any time, where processing is based on consent.

To exercise these rights, email privacy@gettheia.co. We may need to verify your identity, and we will respond within the timescales required by law. You can also manage much of your information directly in your account settings.

If you are in the UK, you can complain to the Information Commissioner’s Office (ico.org.uk/make-a-complaint). If you are in the EEA, you can complain to your local supervisory authority. We would welcome the opportunity to address your concern first.

11. Your rights (United States)

If you are a resident of California or another US state with a comprehensive privacy law (such as Colorado, Connecticut, Texas, or Virginia), you may have rights to know what personal information we collect, to access, correct, or delete it, to receive it in a portable format, and to opt out of the sale or sharing of personal information and of targeted advertising.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes requiring an opt-out right. We will not discriminate against you for exercising your privacy rights.

To exercise these rights, email privacy@gettheia.co. We will verify your identity before acting on a request, and you may use an authorised agent where the law allows, provided the agent supplies proof of authorisation.

12. Cookies and similar technologies

Our public website and web app use strictly necessary cookies and browser storage for security, authentication, session persistence, and saved preferences. We do not set optional analytics or marketing cookies without your consent.

[INSERT A COOKIE TABLE OR A LINK TO YOUR COOKIE POLICY LISTING EACH COOKIE OR STORAGE KEY, ITS PROVIDER, PURPOSE, TYPE, AND DURATION. REMOVE REFERENCES TO ANY TOOLS YOU DO NOT ACTUALLY USE.]

You can change optional-cookie choices at any time using [COOKIE SETTINGS LINK/METHOD] or through your browser settings. Some web browsers offer a “Do Not Track” signal; as no uniform standard has been adopted, we do not currently respond to such signals, but we will update this policy if that changes.

13. Your responsibilities for other people’s information

If you enter information about buyers, sellers, consignors, or other people, you are responsible for having a lawful basis to do so and for giving those individuals any privacy information the law requires. Do not upload information you do not have the right to use. Where you record such information in Theia, you act as the controller of it and we process it on your behalf.

14. Children

Theia is a business inventory service intended for adults and is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

15. Changes to this policy

We may update this policy when our processing or legal obligations change. We will post the new version on this page and update the “Last updated” date. If a change materially affects how we handle your information, we will give you additional notice, for example by email or an in-app message.

16. Contact us

GETTHEIA LTD

71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

Privacy: privacy@gettheia.co

Support: support@gettheia.co