Legal
The Boring Page.
Privacy, terms, cookies, data processing, and security — all in one place. We know you won't read it. We wrote it anyway.
01
Privacy Policy
Last updated October 2026
Who we are
Solinth is operated by Solinth Ltd is a company registered in England & Wales, company number 16936589, with its registered office at 29 Thompson Close, Willenhall, WV13 1ST, United Kingdom. You can reach us at [email protected]. For the personal data we process about you when you use Solinth — your account details, billing data, and usage data — Solinth Ltd is the data controller under the UK GDPR and the Data Protection Act 2018. For the business data you upload into your workspace, you remain the controller and Solinth Ltd acts as your processor (see the Data Processing section). Our supervisory authority is the UK Information Commissioner's Office (ICO). Questions about privacy, and any request to exercise your rights, go to [email protected].
What we collect
We collect information you provide directly: your name, email address, company name, and billing details when you create an account or subscribe to a plan. We also collect usage data through PostHog analytics — this includes page views, feature usage, session duration, click patterns, and interaction patterns within the application. Session replay, canvas recording, heatmaps and automatic exception capture in PostHog are disabled. We do not capture text you copy, console output or network request and response bodies. Analytics URLs are reduced to their origin to exclude page paths, query parameters and share tokens. PostHog stores data using both cookies and browser localStorage, and tracking operates across subdomains (e.g. between our marketing site and application). Analytics starts only after your cookie choice has been recorded on our server, respects Do Not Track, and is switched off automatically if your browser sends a Global Privacy Control signal. Error tracking through BetterStack captures technical diagnostic data: browser type, operating system, screen resolution, and error stack traces. Payment processing through Stripe collects and handles billing information. Email delivery through Resend processes your email address for transactional communications.
How we use it
We use your data to operate and improve Solinth. Account information powers authentication and billing. Usage analytics help us understand which features matter and where the product falls short. We review consented feature events and aggregate usage patterns to diagnose usability issues. Error data helps us find and fix bugs before you notice them. We do not sell your data and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act. We do not use it for advertising. We do not share it with data brokers. Your business data stays inside your workspace and is never used to train models or enrich other products.
Free trial abuse prevention
The free trial is one per person. To keep it that way, when a workspace reaches the payment step of setup we record keyed hashes, never the values themselves, of: your email address with plus-tags and Gmail dots removed; any Google or GitHub account you sign in with; the identifier Stripe derives from your card number, if you add a card; a random identifier held in our solinth_did cookie; and your IP address. We compare them with earlier trials. A match can mean a card is needed to start the trial, or that the workspace has no trial and goes straight to a paid plan; it never affects anything else about your account. Our lawful basis is our legitimate interests in preventing abuse of the free trial. The hashes are kept for 18 months, including after an account is deleted so that deleting and signing up again does not restart the trial, and are then deleted automatically. If you think we got it wrong, email [email protected] and we will look at it.
Who we share it with
We share data only with the service providers needed to run Solinth. The provider list and their roles are in the Data Processing section below. In summary: payment processing, transactional email, product analytics, logging and uptime monitoring, database and cache hosting, integration sync, CDN and file storage, background job processing, and — only if you switch on an AI feature — the AI provider whose key you supplied. Each provider processes only the minimum data required for their function. Contact [email protected] for documentation about sub-processor agreements and international transfer safeguards. We do not share data with any other third parties unless required by law — and if that happens, we will notify you unless legally prohibited from doing so.
Google account data
If you connect a Google service to Solinth, we access only the data covered by the scopes you approve, and only in read-only form: Google Analytics (analytics.readonly), Google Search Console (webmasters.readonly), Google Ads (adwords), YouTube (youtube.readonly), and Google Sheets (spreadsheets.readonly). We use that data for one purpose — to populate the dashboards, metrics, and reports inside your own workspace. We never use Google user data for advertising, never sell or transfer it, and never use it to train machine learning or AI models. The OAuth tokens authorising the connection are held by our self-hosted Nango integration service, and any credentials we store are encrypted at rest; the metrics we retrieve are stored in your workspace so your dashboards keep working between syncs. You can disconnect a Google integration at any time from Settings → Integrations, or revoke our access directly at myaccount.google.com/permissions — on disconnection we stop syncing immediately and delete the retrieved data within 30 days. Solinth's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your rights
You can access, correct, or delete your personal data at any time through your account settings or by emailing [email protected]. Settings → Security holds both tools: Export my data returns everything we hold about you as structured JSON, and Delete my account schedules erasure after a 30-day grace period during which you can cancel. Under the UK GDPR you have the right to data portability, the right to restrict processing, and the right to object to processing. Under the CCPA/CPRA, California residents have the right to know, to delete, to correct, and to opt out of sale or sharing — we do neither, and we honour Global Privacy Control signals automatically. Residents of Colorado, Connecticut, Montana, Oregon, Texas, Virginia and other US states with comprehensive privacy laws have equivalent rights, and we do not discriminate against anyone for exercising them. We aim to acknowledge requests within one business day, and we will respond fully without undue delay and within one month, as required by the UK GDPR (extendable by up to two further months for complex requests, with notice). If you believe we have mishandled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk; if you are in the EEA, you may also contact your local supervisory authority.
Data retention
We keep your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days. Some data may be retained longer where required by law (tax records, for example, are kept for 7 years). Beyond that, each category has a fixed maximum life and is deleted automatically by a daily job: security and audit logs 90 days; product analytics events 365 days; link click events 90 days; conversion events 365 days; failed background jobs 30 days; payment and webhook event records 180 days; deduplication records 14 days; free-trial abuse signals 548 days (18 months), including after account deletion. Pseudonymous cookie-consent evidence is retained for 730 days and then deleted by our daily retention job. It contains the choice, policy version and server timestamp, without an IP address or browsing history. Session replay collection is disabled. Our routine backup retention policy is 90 days, excluding separately approved legal holds. Contact [email protected] for current backup coverage and retention evidence.
Sharing you control
Two features let data leave your workspace on your instruction, and neither is switched on by default. Share links create an unguessable URL for a dashboard, invoice or file that anyone holding the link can open — we mark those pages as no-index, strip the referrer, mask their contents from session replay, and let you set an expiry and revoke the link at any time. Workspace connections let you grant another Solinth organisation read access to specific data sources; the receiving organisation becomes responsible for what it does with what it sees, and you can withdraw a connection whenever you like. We recommend setting an expiry on any share link that carries personal data.
02
Terms of Service
Last updated October 2026
Account terms
You must be 18 or older to use Solinth. You are responsible for maintaining the security of your account credentials. One person or legal entity per account — sharing credentials across multiple users requires a team plan with individual seats. You are responsible for all activity that occurs under your account. If you suspect unauthorised access, notify us immediately at [email protected]. We reserve the right to suspend accounts that show signs of compromise to protect your data.
Acceptable use
Use Solinth for lawful business purposes. Do not use the platform to store, process, or transmit illegal content. Do not attempt to reverse-engineer, decompile, or extract source code from the application. Do not use automated tools to scrape, crawl, or overload the service. Do not impersonate others or misrepresent your affiliation. Do not attempt to access other users' data or workspaces. We reserve the right to suspend accounts that violate these terms, with notice where possible and immediately where required to protect other users or the service.
Data you should not put in Solinth
Solinth is business intelligence software, not a clinical or regulated records system. Do not upload protected health information as defined by HIPAA under the current service: HIPAA readiness and the required Business Associate Agreements have not been established. Please also avoid payment card numbers (send people to a payment processor instead), government identity document numbers, and biometric data. Special category data under the UK GDPR — health, race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation — should only go into Solinth if you have your own lawful basis under Article 9 and have told us first, so we can agree what additional measures are needed. If you need to process any of this and want to do it in Solinth, talk to us at [email protected] before uploading it.
Payment and billing
Subscriptions are billed monthly or annually in advance via Stripe. Prices are listed in pounds sterling (GBP) and US dollars (USD) and are exclusive of tax; your account is billed in the currency you first subscribe in. Review the total and any applicable tax shown at checkout before you pay; if you are a business with a valid VAT or tax registration number, you can enter it at checkout and it will be applied to your invoice. You can upgrade, downgrade, or cancel at any time from your billing settings. Downgrades take effect at the end of the current billing period. Failed payments are retried automatically. After 3 failed attempts, your account may be downgraded to a limited state until payment is resolved.
Cancellation and refunds
If you are a consumer in the UK or the EU, you have a statutory right to cancel a distance contract within 14 days of entering into it, without giving a reason. Using Solinth does not by itself waive your statutory cancellation rights. To exercise your cancellation right, email [email protected] within that period; we will handle your request and any refund in accordance with applicable law. Separately from your statutory rights, and for everyone regardless of location, we operate a 30-day goodwill policy: if Solinth is not working out in your first 30 days, email us and we will make it right. Nothing here affects your statutory rights, including the right to a remedy if the service is not as described, not fit for purpose, or not supplied with reasonable care and skill.
Intellectual property
You own your data. Everything you put into Solinth — your business records, documents, contacts, reports — remains yours. We claim no intellectual property rights over your content. Solinth's software, design, brand, and documentation are our intellectual property, protected by copyright and trademark law. Your subscription grants you a non-exclusive, non-transferable licence to use the software for the duration of your subscription. You may not redistribute, sublicense, or create derivative works from the Solinth platform.
Termination
You can close your account at any time from your settings. We can terminate or suspend your account if you violate these terms, with reasonable notice where possible. Upon termination, you have 30 days to export your data using our export tools or by requesting a data export via email. After 30 days, your data is permanently deleted. We are not liable for any loss resulting from account termination that follows these terms. Provisions that by their nature should survive termination (intellectual property, limitation of liability, indemnification) will survive.
Governing law
Solinth is provided by Solinth Ltd is a company registered in England & Wales, company number 16936589, with its registered office at 29 Thompson Close, Willenhall, WV13 1ST, United Kingdom. You can reach us at [email protected]. These terms, and any dispute or claim arising out of or in connection with them, are governed by the laws of England and Wales. You and Solinth Ltd submit to the exclusive jurisdiction of the courts of England and Wales — except that, if you are a consumer resident in the EEA, you keep the protection of the mandatory consumer law of your country of residence and may bring proceedings there. Nothing in these terms removes or limits any mandatory statutory rights you have under the law of your country of residence.
03
Cookie Policy
Last updated October 2026
Essential cookies
These cookies are required for Solinth to function. They handle authentication (keeping you logged in), security tokens (CSRF protection), and session management. You cannot opt out of essential cookies — without them, the application will not work. They expire when your session ends or after a reasonable authentication period. solinth_did holds a random identifier, set when a workspace reaches the payment step of setup, that lets us recognise a browser that has already started a free trial (see Free trial abuse prevention); it lasts 400 days.
Hosting and CDN security
Solinth is deployed using Coolify and delivered through Cloudflare CDN. Cloudflare may set security cookies when the corresponding protection features are active: __cf_bm supports bot detection and expires after 30 minutes of inactivity; cf_clearance records a passed security challenge for the configured challenge-passage duration. These cookies depend on the security features in use, rather than CDN delivery alone.
Analytics cookies and local storage
We use PostHog for product analytics. PostHog sets cookies and uses browser localStorage to track sessions and distinguish unique visitors. These cookies operate across subdomains (e.g. solinth.com and app.solinth.com). Analytics requests use a first-party proxy, but the data still goes to PostHog. Nothing is collected until you opt in: analytics is off by default, respects Do Not Track, and is forced off if your browser sends a Global Privacy Control signal. You can change your mind at any time through Cookie Settings in the footer. When opted out, no analytics data is collected from your sessions. PostHog data is hosted in the United States. Contact [email protected] for information about the applicable processing agreement and international transfer safeguards.
04
Data Processing
Last updated October 2026
Sub-processors
Solinth uses the following sub-processors to deliver the service: Netcup (hosting for Solinth-managed infrastructure), Stripe (payment processing, US), Resend (transactional email, US), PostHog (product analytics, US), BetterStack (operational logging and uptime monitoring), and Cloudflare (CDN delivery, security, file and encrypted backup storage, and asset delivery, global services with EU-jurisdiction backup storage). Supabase, our former database provider, no longer holds Solinth data: it no longer hosts the serving primary database, and its projects were deleted on 24 September 2026 after the migration was verified. Primary and analytics databases, caching, background processing and integration sync run on Solinth-managed infrastructure; use of their software does not mean their vendors host this data. Authentication runs inside Solinth. The integration providers you connect to also receive and return your data. Contact [email protected] for documentation about sub-processor agreements and international transfer safeguards. We will notify workspace owners at their verified account email at least 30 days before adding a new sub-processor and give you the opportunity to object. Required owner notices do not depend on an optional subscription; other users can enable additional notices in Settings → Security → Privacy. The dated change history below records announcements and their effective dates. Contact [email protected] to object or request assistance.
Sub-processor change history
24 September 2026: Supabase was removed as a sub-processor. After every migrated record was verified on Solinth-managed infrastructure, its projects and the legacy data they held were deleted. Removing a sub-processor adds no new processing. 23 September 2026: the primary database now runs on Solinth-managed infrastructure with the already listed hosting provider. Cloudflare's disclosed role includes encrypted backup storage. No new sub-processor is announced by this correction.
AI providers
AI features are off unless you turn them on, and they run on your own API key — we never bill you for tokens and we hold no model provider account on your behalf. If you enable one, the content you send to that feature (your prompt and the workspace data it references) is transmitted to the provider whose key you supplied, and that provider becomes a sub-processor for that content. Supported providers are Anthropic, OpenAI, Google, OpenRouter, Mistral, Cohere, Perplexity, Groq, xAI and DeepSeek. They are based in different countries with different legal regimes — DeepSeek processes data in China, which has no UK or EU adequacy decision — so choose the provider whose terms and location suit the data you intend to use, and check that provider's own policy on training and retention. Your API key is encrypted at rest with AES-256-GCM before storage and is never logged, never returned by our API, and never shared. We do not send workspace data to any AI provider for our own purposes, and we never use your data to train models.
Data transfer mechanisms
Some providers process personal data outside the United Kingdom or EEA. International transfers require an applicable adequacy decision or appropriate safeguards, such as the EU Standard Contractual Clauses with the UK Addendum or the UK's International Data Transfer Agreement, together with any required transfer assessment and supplementary measures. Data Privacy Framework reliance depends on the recipient's relevant certification and the data covered. A provider's location or published template alone does not establish the safeguards for a particular transfer. Contact [email protected] to request the provider-specific arrangements and information about obtaining a copy of applicable safeguards. Choosing an AI provider does not by itself resolve its contractual or international-transfer requirements.
GDPR compliance
Solinth acts as a data processor on your behalf when handling your workspace data. You are the data controller. We process personal data only on your documented instructions and for the purposes described in this agreement. We implement appropriate technical and organisational measures to ensure security of processing. Our staff who access personal data are bound by confidentiality obligations. We assist you in responding to data subject requests and in conducting data protection impact assessments where required.
Breach notification
In the event of a personal data breach, we will notify you without undue delay and in any case within 72 hours of becoming aware of the breach. Our notification will describe the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures we have taken or propose to take. We have a documented incident response runbook. We will cooperate fully with your investigation and regulatory notification obligations.
05
Security
Last updated October 2026
Infrastructure
Solinth operates its application, primary and analytics databases, caching and background processing on Solinth-managed infrastructure. Cloudflare provides CDN delivery and network protections. Hosting providers, backup storage and other external processing are listed in our sub-processor disclosure. Deployment software alone does not establish a hosting location or compliance certification.
Encryption
Public web connections use HTTPS, with HTTP redirected to HTTPS. Sensitive fields such as BYOK API keys are encrypted at the application level before storage. TLS versions and storage encryption depend on the service and connection; we do not claim that every internal connection uses TLS 1.3 or that every storage volume has disk encryption. We do not implement client-side end-to-end encryption of workspace data. Contact [email protected] for current infrastructure and backup-encryption evidence.
Access controls
Production management access is restricted through access policies, authenticated administration and separate operator credentials. PostgreSQL row-level security scopes ordinary application database requests to their workspace. Cross-workspace maintenance uses a separate privileged system role and must be restricted to authorized operations. Application endpoints also enforce authentication and authorization. Contact [email protected] for current access-review and administrator-authentication evidence.
Incident response
We maintain a documented incident response plan covering identification, containment, eradication, recovery, and post-incident review. Security incidents are classified by severity and escalated accordingly. Critical incidents trigger immediate response with a target resolution time measured in hours, not days. We conduct post-incident reviews for all significant events and publish root cause analyses where appropriate. If you discover a security vulnerability, please report it to [email protected] — we take every report seriously and will respond within one business day.
06
Accessibility
Last updated October 2026
Our commitment
We want Solinth to be usable by everyone, including people who navigate by keyboard, use a screen reader, rely on magnification, or need reduced motion. We are working towards conformance with the Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA, which is the standard referenced by EN 301 549 and the European Accessibility Act, and by the UK's Equality Act 2010 duty to make reasonable adjustments.
Where we are today
We are honest about this: we have not yet completed an independent accessibility audit, so we cannot claim full WCAG 2.1 AA conformance. What we have done is build the foundations in and test them automatically — skip links to bypass navigation, semantic landmarks, labelled form controls, visible keyboard focus, accessible names on icon-only buttons, dialogs that trap and restore focus, charts that expose their underlying data as text, and a reduced-motion setting that the whole interface respects. Automated accessibility checks run in our test suite on every change. Known gaps are in complex interactive surfaces — the dashboard builder, drag-and-drop arrangement, and some data visualisations — where keyboard and screen reader support is incomplete. An independent audit is planned, and we will publish the result here, including what it finds.
Getting help or reporting a problem
If any part of Solinth is difficult or impossible for you to use, email [email protected] with the page and what went wrong, and we will treat it as a bug rather than a feature request. We aim to acknowledge accessibility reports within one business day and to agree a fix or a workaround with you. If you need information from the product in a different format, ask and we will provide it. If you are not satisfied with our response, you can contact the Equality Advisory and Support Service in the UK, or your national enforcement body in the EU.
Questions?
If you have questions about any of these policies, or need a signed DPA for your records, reach out. We respond within one business day.
[email protected]·Mon–Fri, 9am–6pm GMT
Contact Us© 2026 Solinth. All rights reserved.
Solinth Ltd · Registered in England & Wales · Company No. 16936589 · Registered office: 29 Thompson Close, Willenhall, WV13 1ST, United Kingdom