thermly

Privacy Policy

Last updated 13 October 2026.

Thermly is operated by Thermly Limited, a New Zealand company (company number 9430683, NZBN 9429053683823).

What we collect

Thermly collects the account details needed to provide access to the calculator, including your email address, display name when provided by your sign-in provider, the name and business name you give us, your role, login provider, approval status, and security logs. Project data you choose to save, including saved assemblies, H1 projects, uploaded plan documents, and a record of report generations, is stored against your account so you can return to it.

Project material can include personal information about other people, such as a client's name or a site address on a plan or a report. You must have the permission you need to upload and use it.

When you buy report credits, Stripe processes the payment and holds your card details. We hold the Stripe customer and payment identifiers, the amount paid and the credits bought.

How we use project material

We use the project material you upload to provide, secure and support Thermly. We may also use it to test Thermly and assure its quality, including re-running saved calculations to check that a change to Thermly still gives the result it should. We use project material for no other purpose. We do not use it to train AI models, and we do not let anyone else do so.

We treat project material as confidential. We disclose it only to the service providers that process it for us (hosting, storage, AI processing and email), to our staff and contractors who need it to provide, secure, support or test Thermly, where the law requires, or with your consent.

We may use and publish aggregated statistics about how Thermly is used that do not identify you, your client or the site. We do not publish project material, or anything that identifies you, your client or the site, without your consent.

Where we state it as a condition of a free-access offer, we ask you to tell us the outcome of a consent submission made with a Thermly report, including any request for information and any refusal.

AI processing

Some features read your project material with AI models: indexing and summarising an uploaded plan, reading its window and door schedules and insulation notes, tracing walls on it, extracting project details, and the AI review of a project. Those features send the material they work on (plan pages, images, notes and the inputs and calculated facts involved) to AI models that we access through Amazon Web Services' Bedrock service, ordinarily in Australia; a model may be served from another AWS region. Amazon does not keep that material after the request, does not use it to train models, and does not pass it to the companies that make the models. We keep what the models return (the plan index, the summary, extracted values and review results) with your project.

Where your data is held

Account and project data is stored with Amazon Web Services. Thermly's database, file storage and sign-in service run in AWS's New Zealand region; AI processing and email sending run in AWS's Australian region; analytics data is hosted by PostHog outside New Zealand. Google and Apple may process identity information when you choose those sign-in methods.

Records we keep, and for how long

  • Each time you accept the Terms of Use (when you first sign in, when a new version takes effect, and each time you generate a report) we record your account, the version you accepted and the time. For a report we also record which report it was: the kind of report, the project and its saved version, and a fingerprint of the PDF as issued. These records hold no project name and no project content. We keep them for 10 years from the acceptance, and they are not removed when a project is deleted.
  • We may keep a record of each final report you generate: the report as issued, the inputs behind it, the warnings shown and acknowledged, the version of Thermly that produced it and the version of the Terms of Use you accepted. A report can contain personal information, such as names and a site address. We may keep this record for up to 10 years from the date the report was generated. After the project is deleted the record is not available in Thermly, and we use it only for audit, to answer a claim or dispute, or where the law requires. It is kept for our purposes and does not replace your own copies.
  • A record of each project deletion: the project's identifier, the time, who deleted it and what happened to each file, with no project name and no project content, kept for 10 years from the deletion.
  • The usage and billing records for your account, kept for as long as tax and accounting law requires.
  • The activity log for your account, whose entries expire after 12 months.
  • Review comments written on a project, and cached results of AI reviews, which are not at present removed when the project is deleted. We remove them when your account is closed, or earlier on request.

What happens when you delete a project

The project is removed from Thermly at once and cannot be restored. We then delete its saved versions and its uploaded files: the plan, the mark-up and diagram images, and any window certificates. A file is kept while something else still uses it, such as another of your projects. The records listed above are kept for the periods stated. Keep your own copies of anything you need before you delete a project.

Analytics and advertising

On the production website, Thermly uses the Google tag to measure visits and actions resulting from our advertising. Google may process device, browser, usage, and cookie information for this purpose. The tag is not enabled on Thermly's test website or in local development. Learn more about how Google uses information from sites that use its services.

On the production website, Thermly uses PostHog, a product analytics service, to understand how the application is used: the pages visited, the features and controls used, and replays of how the interface is operated. This usage is linked to your account (your user id and email address). Values typed into forms are masked, plan drawings and uploaded plan or diagram images are never recorded, and project, client and organisation details shown on screen are excluded from what is collected. Analytics data is hosted by PostHog outside New Zealand. PostHog is not enabled on Thermly's test website or in local development. Learn more in PostHog's privacy policy.

Your rights

You can request access to, correction of, or deletion of your personal information. Requests are handled consistently with the New Zealand Privacy Act 2020. Deleting a project, closing your account or asking us to delete your information does not remove the records of final reports and of your acceptance of the Terms of Use described above: we keep those for the periods and purposes stated, and will tell you when that applies to a request.

Thermly Limited has a privacy officer, who handles these requests and any privacy concern. Our privacy officer can be reached at privacy@thermly.nz.