Privacy Policy

Last updated: 7 April 2026

1. Data Controller

CoreSeed Ltd is the data controller for all personal data processed through Thorn Layer. CoreSeed Ltd is registered in England and Wales.

Address: Aylesbury, Buckinghamshire, United Kingdom
Contact: privacy@thornlayer.com

2. What We Collect

When you create an account, we collect:

  • Email address (for account authentication and billing)
  • Billing information (processed by Stripe — we do not store card details)
  • Usage metadata (request counts, timestamps, outcomes — never content)

3. What We Do Not Collect or Store

Thorn Layer does not store, log, or retain any prompt content or LLM response content at any point. Request content exists only in memory for the duration of processing and is never written to any storage layer. Your LLM API key is held in memory only for the duration of the proxied request and is never persisted.

4. How We Use Your Data

  • To provide the Thorn Layer proxy service
  • To calculate usage and billing
  • To send transactional emails (welcome, usage alerts, invoices)
  • To maintain service reliability and security

5. Data Sharing

We share personal data only with:

  • Stripe (payment processing)
  • Resend (transactional email delivery)
  • Supabase (account data storage, EU region)
  • Cloudflare (edge processing infrastructure)
  • Sentry (error monitoring — no personal data in payloads)

We do not sell personal data to third parties.

6. Data Retention

Account data is retained for the duration of your account plus 30 days after deletion. Usage metadata is retained for 12 months for billing reconciliation. No prompt content is ever retained.

7. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation, you have the right to access, rectify, erase, restrict processing, and port your personal data. You also have the right to object to processing and to withdraw consent at any time.

To exercise any of these rights, contact privacy@thornlayer.com.

8. Cookies

See our Cookie Policy for details on cookie usage.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email to the address on your account.