Privacy Policy

Itarck Ltdis the data controller for personal data processed through TIDE. Itarck Ltd is a company registered in England & Wales (company number 12930155). Registered office: Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW.

TIDE — the Transformation Readiness Diagnostic — is the diagnostic product operated by Itarck Ltd under the TIDEOS brand.

For any privacy question or to exercise a right described below, contact paul@thwaite.me.uk. We aim to respond within 30 days.

We only collect the data we need to run the diagnostic, follow up on enquiries, and keep the service secure. The main categories:

Under UK GDPR every use of personal data needs a lawful basis. The ones we rely on:

• Contract — to provide the diagnostic you requested, send your report, and manage your access code. We cannot deliver the diagnostic without processing these details.
• Legitimate interests — to keep TIDE secure (rate-limiting abuse), to improve the service, and to follow up on enquiries from prospective users. We have considered the privacy impact of these uses and limited what we collect accordingly.
• Consent — where we ask for it explicitly (for example, non-essential analytics cookies, if and when we introduce them). You can withdraw consent at any time.
• Legal obligation — to retain limited records where UK law requires it (for example, financial records for tax purposes if you become a paying customer).

We use a small number of trusted sub-processors to operate TIDE. Each is bound by a written agreement to use your data only on our instructions.

• Supabase — application database and file storage. Hosts the assessment, response, and report records. EU region (Ireland).
• Anthropic — provides the language model that facilitates the diagnostic conversation. Receives the programme context and your responses turn by turn so it can generate the next question. Anthropic does not use this data to train its models.
• Vercel— application hosting and execution. Our application code runs on Vercel’s infrastructure in London, so all requests pass through it. Vercel also provides content delivery for static assets.
• Resend — transactional email delivery (used to notify us of new contact / access-request submissions and to send you operational emails about your diagnostic).

We do not sell your personal data, and we do not share it with advertising networks.

Some sub-processors are based outside the UK or process data outside the UK / European Economic Area:

• Anthropic is based in the United States. Diagnostic content sent to Anthropic for facilitation crosses an international border. This transfer is covered by the UK-approved International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, which provide UK-recognised safeguards for personal data leaving the UK.
• Vercel and Resend are US companies whose UK service uses equivalent transfer safeguards.
• Supabase hosts your data in the EU (Ireland). No international transfer occurs for stored diagnostic records.

We keep personal data only as long as we need it for the purpose we collected it. Retention defaults below — these can change if you ask us to delete sooner (see § 7).

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Deleteyour data (the "right to be forgotten") where there is no compelling reason for us to keep it.
• Restrict how we use your data while a question or complaint is being resolved.
• Object to our use of your data where we are relying on legitimate interests.
• Portability — receive a copy of the data you gave us in a structured, machine-readable format.
• Withdraw consent at any time where consent is the lawful basis.

To exercise any of these rights, email paul@thwaite.me.ukwith enough information to identify your record (for example, the email address you used when completing a diagnostic). We'll respond within 30 days.

If you're unhappy with how we handle your data and we haven't been able to resolve it directly, you have the right to complain to the UK Information Commissioner's Office (ICO). The ICO is the UK's data protection regulator.

Contact details and the online complaints form are at ico.org.uk/make-a-complaint.

We'd prefer the chance to put things right first — please contact us at paul@thwaite.me.uk before escalating.

We may update this notice as TIDE changes — for example if we add a new sub-processor or change a retention period. Material changes will be reflected here and the "Last updated" date at the top will move.

The current version is dated 28 July 2026. Historic versions are tracked in our source-control history.