TheoWorks

Privacy Policy

Last updated: 2026-07-13

Draft — pending legal review
This policy is an interim draft prepared by the TheoWorks team and has not yet been reviewed by legal counsel. It describes our current data practices in good faith; the final, reviewed version will supersede it.

This policy explains how the TheoWorks marketing website (theoworks.io) handles personal data when you visit it. It is written to meet the transparency requirements of the EU/UK General Data Protection Regulation (GDPR). It covers this website only — the TheoWorks product itself is git-native and, when self-hosted, keeps your data on your own infrastructure.

1. Who we are (data controller)

TheoWorks operates this website and is the data controller for the limited personal data described below. If you have any question about this policy or how your data is handled, contact us at privacy@theoworks.io or through the contact form on our home page.

2. What we collect and why

We keep data collection to the minimum needed to understand how the site is found and used:

  • Advertising & measurement (Google Ads). We use Google Ads with the gtag.js tag (Google Ads ID AW-18319600142) to measure page views and advertising conversions — for example, to see whether a visit came from one of our ads. This may set cookies and process online identifiers such as your IP address. None of this runs until you actively consent via the cookie banner (see “Consent” below).
  • Your consent choice. When you accept or decline on the cookie banner, we store your choice in your browser's local storage under the key tw-consent-v1 (value granted or denied). This is stored on your device only — it is not sent to us — and it exists so we can honour your choice and not re-prompt you on every visit.
  • Information you send us. If you fill in the enterprise contact form or email us, we receive the details you provide (such as your name, work email, company and message) so we can reply. We use this only to respond to and follow up on your enquiry.

We do not run our own analytics, we do not sell personal data, and we do not use the data collected here to build advertising profiles beyond what Google Ads measurement requires.

We use Google Consent Mode v2. When the page loads, all Google consent signals — ad_storage, analytics_storage, ad_user_data and ad_personalization — default to denied. Nothing is read from or written to your device for advertising or analytics until you choose.

A cookie banner asks you to Accept or Decline. Declining is as easy as accepting, and if you do nothing, measurement stays off.

Withdrawing or changing your consent. Your choice is remembered by the tw-consent-v1value in your browser's local storage. You can withdraw or change it at any time by clearing that stored value (or clearing this site's cookies and site data in your browser settings) — the banner then reappears on your next visit so you can choose again. You can also block or delete cookies directly in your browser at any time. Withdrawing consent does not affect the lawfulness of processing that happened while consent was in place.

4. Cookies and similar storage

  • Google Ads cookies. Set only after you accept, to measure ad performance and conversions and to reduce duplicate measurement. These are managed by Google.
  • Consent-choice storage. The tw-consent-v1 entry in local storage records whether you accepted or declined. It is strictly functional (it makes your choice stick) and is stored on your device only.

5. Third parties and international transfers

When you consent, advertising and measurement data is processed by Google (Google Ads / gtag.js) as an independent processor and/or controller under its own terms. See Google's Privacy Policy for details of how Google handles this data.

Google is a US-based provider, so consented data may be transferred to and processed in the United States and other countries outside the EU/UK. Where that happens, transfers rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (SCCs) together with Google's supplementary measures.

Our legal basis for advertising and measurement (Google Ads) is your consent (GDPR Article 6(1)(a)), which you give through the cookie banner and can withdraw at any time. Where you contact us, we process your details on the basis of our legitimate interest in responding to your enquiry (Article 6(1)(f)), or to take steps at your request prior to entering a contract (Article 6(1)(b)).

7. Data retention

Google retains advertising and conversion measurement data according to its own retention policies; we do not hold a separate copy of it. Your consent-choice value stays in your browser's local storage until you clear it. Enquiry details you send us are kept only as long as needed to handle your request and any reasonable follow-up, after which they are deleted.

8. Your rights

If you are in the EU/UK, you have the right to:

  • Access the personal data we hold about you;
  • Rectification of inaccurate or incomplete data;
  • Erasure of your data (“right to be forgotten”);
  • Restriction of processing;
  • Objection to processing;
  • Portability — to receive your data in a portable format;
  • Withdraw consent at any time, without affecting processing already carried out (see “Consent” above).

To exercise any of these rights, email us at privacy@theoworks.io. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been handled improperly.

9. Contact

Questions about this policy or your data? Email privacy@theoworks.io or use the contact form. This policy was last updated on 2026-07-13.