Truethinks

Privacy Policy

Last updated: 9 October 2026

This policy explains how TRUETHINKS LTD ("Truethinks", "we") handles personal data on truethinks.com and in our own internal tools. We are a company registered in England and Wales (No. 16779253), registered office 128 City Road, London, EC1V 2NX, United Kingdom, and the data controller for the processing described here under the UK GDPR and the Data Protection Act 2018.

Our products and apps (for example Productrue, Enomotia and our ikas apps) have their own privacy policies, published on their websites and in their app store listings. Those policies apply when you use those products.

This website

• No tracking. truethinks.com does not use analytics, advertising or tracking cookies.
• Contact form. The enquiry form does not send anything to our servers. It opens your own email app with your message addressed to [email protected]. We receive your name, email address and message only if you send that email.
• Server logs. Our web server keeps standard access logs (IP address, browser, pages requested and time) for security and troubleshooting. We delete them automatically after about 30 days.

When you contact us

We use your name, email address and message to reply and, if you become a customer, to provide our services. The legal basis is our legitimate interest in responding to enquiries or taking steps to enter into a contract with you. We keep correspondence for as long as needed for that purpose. If it relates to a contract, we keep it for up to 6 years after the contract ends to meet UK legal and tax requirements.

Payments and invoices

Payments for our products are processed by Stripe. We receive the payment details needed to keep accounts and issue invoices: name, email address, billing country and address, amount, and the product purchased. We never receive full card numbers. UK law requires us to keep accounting records for 6 years.

Google user data (internal accounting tool)

Our internal administration tool (admin.truethinks.com) is used only by Truethinks staff. With the account owner's explicit consent, it connects to that staff member's own Gmail account with read-only access (gmail.readonly). It does this to find invoices and receipts for business expenses so they can be recorded in the company's accounts.

• It searches only for messages that look like invoices or receipts. It never sends, changes or deletes email.
• For each matching message it stores the sender, subject, date, a plain-text copy and any invoice attachments. It also extracts the supplier, date, amount and invoice number. Messages the user marks as personal or not relevant are deleted from the tool.
• To read an invoice, its content is sent to an AI model provider's API (OpenAI or Anthropic). The provider processes it under its business API terms, which do not allow API data to be used to train its models. Nothing else is shared with anyone.
• Data obtained through Google APIs is not used for advertising, is not sold or transferred to third parties (except the AI model provider, as described above, to provide this feature), and is not used to train AI models. It is not read by humans except the account owner reviewing their own invoices, or where needed for security or to comply with the law.
• Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Access can be revoked at any time in the tool, or at myaccount.google.com/permissions. Revoking access stops all further reading. Invoices already recorded as business expenses are kept for 6 years as UK law requires. Everything else is deleted on request.

Where data is stored

Our servers are hosted by DigitalOcean. The data on them is encrypted in transit and access is restricted to authorised staff using two-factor authentication. Some of our providers (Stripe, DigitalOcean, Google, OpenAI, Anthropic) may process data outside the UK. Where they do, the transfer is protected by the UK International Data Transfer Agreement or Addendum, or by adequacy regulations.

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to data portability. To exercise these rights, email [email protected]. You can also complain to the Information Commissioner's Office (ico.org.uk).

Changes

We will update this page if our practices change and revise the date at the top.