Privacy Policy

1. Who processes this data

THANGAIL, a non-profit initiative in the process of incorporation, run by members of Qresec ("we", "us"), operates thangail.org and the analyst platform it links to. For the data described below we act as the data controller.

2. Data we collect

On the public pages (/, /training, /briefing, /contribute and /login):

• "Request access" form (/sign-up): full name, organisation, role, institutional email and an optional message, only if you submit it voluntarily.
• Masterclass registration (/training): email, and optionally full name, organisation and sector, only if you register.
• Sector briefing quote request (/briefing): organisation, sector, scope, timeframe, email and an optional message, only if you submit it. This is a business inquiry. No rate is published on the site.
• Contributor application (/contribute): full name, email, the area you work in and an optional message, only if you submit it. No timeline is promised on the site.
• A challenge signal from Cloudflare Turnstile on every form above, to tell a person apart from an automated submission. Turnstile does not use cookies for this and does not track you across other sites.
• Cookies from Google Analytics, only after you accept the cookie banner on this public site. They are never loaded before consent, and never inside the authenticated platform.

3. NDA electronic signature

If your access request requires signing our Non-Disclosure Agreement (/nda), we record the IP address reported by our proxy, your browser user agent, a timestamp, the language and version of the document, and its cryptographic hash. This constitutes the evidence of your electronic signature under clause 6 of that agreement.

Legal basis: performance of the contract you become a party to by signing. Retention: for as long as the agreement remains in force plus the applicable statute-of-limitations period.

This signature record is append-only: it cannot be edited or deleted, by anyone, including us. That is what makes it usable as evidence. This means a request to erase this specific record conflicts with our obligation to preserve proof of a contract, and we will not be able to honour a deletion request over it while the agreement remains relevant.

4. Data for approved analysts

If your access is approved, we use your email address solely to send a one-time sign-in link. There are no passwords to collect or store.

The platform keeps operational logs (who signed in, what was reviewed or approved) needed to run and audit the service securely. These logs are internal to your organisation and are not shared externally.

5. Why we process it

To evaluate and respond to access requests, to authenticate approved analysts, and (only if you consent) to measure anonymous traffic on the public pages so we understand what visitors find useful.

6. Who else touches this data

We rely on a small number of infrastructure providers to run the service. None of them use your data for their own purposes:

• Supabase: database, authentication and row-level access control.
• Vercel: hosting of the public site and the platform.
• Resend: delivery of the one-time sign-in email, and transactional confirmations for the forms listed in section 2 (masterclass registration, briefing quote request). Never marketing email.
• Cloudflare Turnstile: bot-detection challenge on the public forms listed in section 2.
• Google Analytics: anonymous traffic measurement, only on the public pages and only after consent.

7. Security

Data in transit is encrypted (HTTPS/TLS). Access to stored data is enforced at the database level through row-level security, not only in application code. Sign-in is passwordless, which removes an entire class of credential-leak risk.

8. How long we keep it

We keep access-request data only for as long as needed to evaluate and respond to it. Authentication data is kept while your analyst account remains active. Analytics data, when you consent to it, is retained under Google Analytics’ standard settings.

9. We do not sell your data

We do not sell, rent or trade your personal data to third parties, under any circumstance.

10. Cookies

The only cookies this site sets are from Google Analytics, and only on the public pages, and only after you click "Allow" on the cookie banner. If you click "Decline", or never respond, nothing is set. You can change your choice at any time by clearing this site’s data in your browser, which resets the banner.

11. Your rights

You can ask to access, correct, delete or object to the processing of your personal data at any time by writing to hola@revsignlab.com.

12. Changes to this policy

We may update this policy as the service evolves. The date at the top of this page reflects the latest version.

13. Contact

For any question about this policy, write to hola@revsignlab.com.