Privacy notice.

The data controller for the personal data described here is The University of Sheffield, acting through its Commercialisation Department. Stratum Thermal is a University project, and the University is the organisation accountable for your data.

Infinite Chapters Ltd builds and hosts this platform on the University's behalf, acting as the University's processor under a written Article 28 data processing agreement. It processes personal data only on the University's instructions. This matters because the site is served from stratumthermal.co.uk rather than a University domain: the University is still the organisation accountable for your data.

If you register interest or ask us to spec a cover. Your name, email address, company, job role, whether you hold or influence the budget, your timeline, and any free-text note you write. If you refer the enquiry upward, we also record the email address of the colleague or manager you name. If that is you and you did not expect to hear from us, the email we send you says so: it tells you that your address came from someone using the Sizer, why we hold it and how to have it erased. You have the same rights set out below.

If you save a spec in the Sizer. The configuration choices you made, an optional nickname for the spec, and — if you choose “save to my email” rather than a plain link — your email address, so you can recall your specs later with a one-time code. Choosing the plain permalink instead means we hold no email address for that spec.

If you upload a file. The file itself and its filename. Uploads accept CAD geometry, thermal data, spreadsheets, PDFs, decks and archives, up to 50 MB. Because decks and specification documents routinely carry names, contact details and signatures, we treat every upload as containing personal data. Files are stored privately and are never publicly readable; access is by short-lived, server-issued links only.

If you ask for a paid analysis. Your email address, linked to the spec it concerns.

If we meet you offline. Our team may add you to our contact records after an exhibition or a meeting: your name, email address, company, country, phone number and notes our staff write about the conversation. This data is entered by hand by us, not submitted by you. Because you did not give it to us through this site, the first time we write to you we tell you in that email where your details came from and how to have them erased.

Whenever you use the site. First-party usage telemetry: which pages and configurator steps you reached and an identifier for your browser session. This is used to understand how the configurator is used. It is stored in our own database — there is no third-party analytics service, no advertising or tracking network, and no profiling of you as an individual.

What we do not collect. We do not geolocate you. We do not keep your IP address in our records. It is used only while your request is being handled, to protect the site from abuse and excessive automated traffic, and it is not written to our database. Our hosting provider keeps short-lived server logs, as any web host does. The platform previously resolved a country code from your IP address via a provider in the United States; that was removed, along with its cache, because it was not needed to deliver the service. Country codes recorded before then are retained on the records that already carry them, and are deleted on the schedule below.

We use this data to respond to your enquiry, to let you save and recall specifications, to prepare and deliver a thermal cover specification for you, to keep a record of our contact with you, and to understand how the configurator is used so we can improve it.

Where you register interest or ask to hear from us, we rely on your consent: you confirm by clicking a link in an email we send you, and nothing is added to our records until you do. Where you ask us to prepare or deliver a specification, a quote or a paid analysis, we process your data because you have asked us to and it is necessary to do what you requested. Where we keep a record of contact with someone we have met, or measure how the configurator is used so we can improve it, we rely on our legitimate interests in running and improving this service — balanced against your interests, and you can object at any time using the contact details below.

We do not use your data for any automated decision-making or profiling that produces a legal or similarly significant effect on you. We do not use artificial intelligence or machine learning to process your data, and no personal data is sent to an AI service.

We use a small number of processors to run the platform. Each is bound by a contract restricting them to processing on our instructions:

• Railway (Netherlands) — application and database hosting.
• Tigris (Netherlands) — storage of uploaded files.
• Resend (Ireland) — sending the transactional emails the platform relies on (confirmation links, one-time codes, spec links).

All personal data is stored and processed within the UK and European Economic Area. There is no transfer of personal data outside the UK or EEA. We do not sell your data or share it with advertisers.

Data is deleted automatically once it passes the period below. Where a record points at an uploaded file, the file is deleted with it.

• Enquiries, referrals and contact records, including staff notes — 24 months from our last contact with you.
• Saved specifications and the files uploaded with them — 12 months.
• “Spec any surface” enquiries and their uploaded files — 12 months.
• Paid analysis requests — 24 months.
• Usage telemetry — 12 months.
• An unconfirmed interest registration is deleted within days if you never click the confirmation link, one-time codes expire within minutes, and sessions expire within 30 days.

The site sets one first-party cookie, session_id. It holds a random identifier — nothing about you is stored in the cookie itself. It is HTTP-only (unreadable by scripts), scoped to this site, and expires after 30 days at the latest.

That cookie does two jobs: it keeps you signed in where you have an account, and it lets us count a visit as one journey rather than a set of disconnected page views in our own usage telemetry.

There are no advertising cookies, no third-party cookies, no tracking pixels and no cross-site tracking of any kind. If you would rather not be counted in our usage statistics, email us at the address below and we will exclude you.

You have the right to ask for a copy of your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, to have it ported to another provider, and — where we rely on consent — to withdraw that consent at any time. Withdrawing consent does not affect processing already carried out.

To exercise these rights, or to object to how we use your data, email mark@stratumthermal.co.uk. Requests are passed to the University of Sheffield as data controller.

If you are unhappy with how your data has been handled you can complain to the Information Commissioner's Office at ico.org.uk.

Last updated: 26 August 2026.