Skip to content

Privacy Policy

Last updated: 12 May 2026

1. Who we are

Thoryn B.V. (“Thoryn”, “we”, “us”) operates stg.thoryn.org and the Thoryn identity platform. We are registered in the Netherlands and process personal data under Dutch and EU law.

2. Data we collect

When you register for a Thoryn account we collect: first name, last name, work email address, password (bcrypt-hashed), organisation name, job title, and country. We also collect product interest selections and, optionally, how you heard about us.

Our analytics provider (Plausible, see section 9) collects aggregated page-view data with no cookies and no personal identifiers.

3. How we use your data

  • To create and manage your Thoryn account.
  • To send you a verification email when you register.
  • To contact you about onboarding and product updates.
  • To understand how visitors use our site, in aggregate.

4. Legal basis

Account registration and email verification: contract performance (Art. 6(1)(b) GDPR). Aggregated, cookieless analytics: legitimate interest (Art. 6(1)(f) GDPR) — understanding how the site performs without processing personal data.

5. Data residency

All personal data is stored and processed within the European Union. We do not transfer data to countries outside the EU/EEA.

6. Retention

Account data is retained for the duration of your account. You can delete your account self-service at any time from Settings → Account → Delete account in the Thoryn console. Once initiated, your account enters a 7-day grace period: you can cancel the deletion via a link in the confirmation email at any point during those seven days. After the grace window elapses, all your data is permanently erased — sessions, MFA factors, audit logs, registered passkeys, and the underlying user record. The 7-day window protects against accidental clicks and session-hijack-induced erasure.

7. Your rights

Under GDPR you have the right to access, rectify, erase, or port your data, and to object to or restrict processing. The right to erasure (Art. 17) is exercised self-service from your account settings as described in section 6; the other rights can be exercised by contacting privacy@thoryn.io.

8. Cookies

We use an essential session cookie to maintain your login state. You can review your preferences via the “Cookie preferences” link in the footer.

9. Analytics

We use Plausible Analytics to understand how visitors use the site. Plausible is hosted in the EU (Germany) and is designed to be privacy-first: it sets no cookies, stores no personal data, and does not use tracking pixels or fingerprints. Plausible’s published data policy explains exactly what is collected; we do not extend or modify that collection.

Because no personal data is processed, analytics run without a cookie consent banner. If you disagree with this interpretation, write to privacy@thoryn.ioand we’ll respond with our justification.

10. Contact

Thoryn B.V., Amsterdam, the Netherlands. privacy@thoryn.io