Privacy
Last updated: 2 November 2026. This page explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do with it.
1. Who we are
Thumbstop Media is a trading name of Jack Long, a sole trader. Jack Long is the controller of the personal data described here, which means he decides how it is used and is responsible for it.
- Email: jack@thumbstopmedia.co.uk
- Post: Thumbstop Media, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
We make short videos for dental and aesthetics clinics. Our customers are businesses, so most of the people whose details we hold are clinic owners and staff. We do not need patient records to do our work and we ask clinics not to send them.
2. Sample requests
When you ask for three free sample Reels, the form collects your clinic's website, your email address, your role and, if you choose, what you want more of. We use these to make the samples and send them to you.
Our legal basis is legitimate interests: you asked for the samples and we need these details to make and deliver them. The form data is stored in our database (Supabase). If the form can't save, your email app opens with a message to us instead, and that email sits in our inbox.
The samples are made from public material on your clinic's website and Google reviews. They are sent to you privately and are not posted anywhere.
3. Follow-up emails
After a sample request we send a short run of emails: a confirmation, the samples, and a few follow-ups over about ten days, then one useful email a month. The line under the form tells you this before you send it.
Our legal basis is your consent, given when you send the form. Every email has an unsubscribe link, and replying "stop" works too. Once you unsubscribe, the emails stop and your address goes on a do-not-contact list so we don't email you again by mistake. The sequence also stops if you reply or sign up.
4. Clients and payments
When a clinic signs up, Stripe takes the payment. Stripe collects the card details, email, business name and clinic website. We never see or store full card numbers. Stripe acts as a separate controller for its own fraud checks and legal duties. You can read Stripe's privacy policy.
After payment, the onboarding form on our welcome page asks for your clinic website, your email, who approves the Reels, your goal for the first month, your Instagram handle and anything else you want us to know. We use this to run the service.
Our legal basis is the contract between us. We keep payment and invoice records because the law requires us to keep business records for tax.
If you send us photos or clips that show people, you confirm you have their permission for us to use them in your Reels. For that content, and anything else you give us to make your Reels, we act on your instructions as your processor.
5. Approvals and posting
Each week we send a private link where your clinic approves Reels or asks for changes. We record who approved each Reel (the name typed in), the time, and any notes. This is our record that nothing went out without your say-so.
To post for you, we connect your Instagram, Facebook and TikTok accounts through our posting service, Upload-Post. You sign in on each platform's own page and we never see your passwords. We store the post links and the performance numbers each platform reports, such as views, watch time and shares. We use them for your monthly note.
We also combine performance numbers across all our clients to learn which hooks and formats work. These combined figures never include clinic names, personal details or comments, and we never show one clinic's data to another.
Our legal basis is the contract, plus legitimate interests for the approval record and the combined figures.
6. Contacting clinics
We sometimes contact clinics that haven't heard of us, using business contact details the clinic publishes, such as on its website or at Companies House. We only email limited companies and LLPs. Other clinics get a letter, or a phone call checked against the Telephone Preference Service.
Our legal basis is legitimate interests: offering a relevant service to a business. Every message tells you how to opt out. If you say no, we add you to our do-not-contact list the same day.
7. Analytics and cookies
This site does not currently run analytics, advertising pixels or tracking cookies. The only things stored on your device are the fonts your browser downloads and, on the approval page, the name you type so you don't have to type it again.
If we add visit counting or the Meta Pixel later, we will update this page first, and anything that needs your permission will only run after you say yes.
Pages on Stripe's checkout set Stripe's own cookies, covered by Stripe's policy.
The pixel work we do on clinic websites is separate. On those sites, the clinic is the controller and its own privacy notice applies.
8. Who we share data with
We don't sell personal data. We use these providers to run the business. Each only gets what it needs:
| Provider | What for |
|---|---|
| Supabase | Our database: forms, clients, approvals, post performance |
| Stripe | Payments and subscriptions |
| Google Workspace | Our email inbox and sending emails |
| n8n | Automation that sends emails and moves data between the tools above |
| Upload-Post | Posting to clients' social accounts and fetching their post stats |
| Meta | Posting to Instagram and Facebook for clients |
| TikTok | Posting to clients' TikTok accounts |
| Vercel | Hosting this website |
Some of these providers store data outside the UK, mainly in the US and the EU. When that happens we rely on UK adequacy regulations (the EU, and US companies certified under the UK extension to the Data Privacy Framework) or on the UK's International Data Transfer Addendum in the provider's contract.
We may also share data if the law requires it, for example with HMRC.
9. How long we keep things
| What | How long |
|---|---|
| Sample requests that don't become clients | 12 months after our last contact, then deleted |
| The sample Reels themselves | Your licence to use them lasts 30 days. We delete our copies after 12 months, with the request |
| Do-not-contact list (unsubscribes and opt-outs) | For as long as we send emails, so we never contact you again. Email address only |
| Outreach records for clinics that don't reply | 12 months after the last message |
| Client details and onboarding answers | For as long as you're a client, then 6 years for tax and legal records |
| Payment and invoice records | 6 years after the end of the tax year they relate to |
| Your Reels, brand files and photos | Removed within 14 days of cancelling, as our terms say |
| Approval records | 2 years after you stop being a client |
| Social account connections | Disconnected within 14 days of cancelling. You can also remove access yourself in each app's settings |
| Post performance numbers | 2 years after you stop being a client. After that, only the combined figures with no names remain |
| General emails with us | 2 years after the conversation ends |
10. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that's wrong
- delete your data, unless we have to keep it by law (for example tax records)
- limit how we use it while a problem is sorted out
- stop using it, including for any marketing, which we always will
- send the data you gave us to you or another company in a common format
- withdraw your consent where we rely on it, such as the follow-up emails. This doesn't affect anything we did before you withdrew it
Email jack@thumbstopmedia.co.uk with your request. We'll reply within one month. It's free. We may ask you to confirm who you are before handing over any data.
We don't make decisions about people by automated means alone.
Our service is for businesses. It isn't meant for anyone under 18.
11. Complaints
If you're unhappy with how we've handled your data, please tell us first at jack@thumbstopmedia.co.uk with "Data complaint" in the subject line. We'll confirm we've got it within 30 days, look into it, and tell you what we found and what we've done.
You can also complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Changes to this page
If we change how we use personal data, we'll update this page and the date at the top. If a change affects clients or people on our email list in a big way, we'll email them as well.