Privacy Policy
Last updated: 26 August 2026
This policy explains what personal information the Innovation Toolkit (the “Toolkit”) collects, why, who we share it with, and what you can ask us to do about it. The Toolkit is operated by Treehouse Innovation (“we”, “us”), who are the data controller for the information described here.
1. Information we collect
- Your account. Your name, your email address and your password. Passwords are stored only as a one-way hash, so nobody at Treehouse can read yours, our own support staff included.
- Your access. Which organisation and cohort you belong to, and your subscription or licence status, including when it renews or ends.
- Sessions you save. If you use the session designer and choose to save an agenda, we store that agenda against your account.
- What you type into the AI features. The words you enter when you ask the Toolkit to find a tool or design a session, and the options you choose, such as time available and group size.
- Payment records. If you subscribe yourself: the amount, the currency, whether each payment succeeded, your subscription status, and a reference from our payment provider. We never see or store your card details.
- Enquiries. Anything you send us through the enquiry form on our website.
- Technical data. Standard server logs, including your IP address, browser type and timestamps, and a session cookie that keeps you signed in.
2. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Giving you access to the Toolkit and keeping you signed in | Performance of a contract |
| Producing search results and session agendas from what you type | Performance of a contract |
| Taking payment where you subscribe yourself | Performance of a contract |
| Answering an enquiry you sent us | Legitimate interests, in responding to you |
| Keeping the service secure and diagnosing faults | Legitimate interests, in running the service safely |
| Sending the newsletter | Consent, which you can withdraw at any time |
3. What we send to the AI service
The Toolkit uses OpenAI's models, hosted on Microsoft Azure for two features: finding a relevant method from a description you type, and drafting a session agenda. Being specific about this matters, so:
- What is sent: the words you typed, the options you chose (time available, group size, format), and our own catalogue of tools.
- What is not sent: your name, your email address, your organisation’s identity, or anything else that identifies you or your employer.
What is sent is not used to train or improve any models. Microsoft’s Azure OpenAI Service processes the prompt and the response within the Azure service, does not share them with OpenAI, and does not use them to train models. That is a term of the service, not a setting. And because nothing in what we send identifies you, your employer or anyone else, there is nothing in it that could be connected back to you.
Please do not type confidential information, or personal information about other people, into those fields. They are for describing the work, not the people.
4. Who we share information with
We do not sell your personal information. We share it with these providers purely to run the Toolkit:
| Provider | Purpose | What they receive |
|---|---|---|
| DigitalOcean | Hosting, in London, United Kingdom | Everything the Toolkit stores, held on their infrastructure |
| Microsoft (Azure OpenAI Service) | Tool search and session design | The text you typed and the options you chose. Nothing that identifies you |
| SendGrid (Twilio) | Account email: verification links, password resets | Your email address and your name |
| Brevo | The newsletter list, if you subscribe | Your email address |
| Stripe | Card payment | Your email address and the amount. Card details go to Stripe directly and never reach us |
Some of these providers operate outside the UK. Where information is transferred internationally, that transfer relies on the safeguards those providers offer, such as standard contractual clauses.
5. Where your information is held
The Toolkit runs on servers in London, United Kingdom. The database is encrypted at rest, and everything passing between your browser and the Toolkit is encrypted in transit.
6. Cookies
The Toolkit sets one essential cookie, which keeps you signed in. It carries a signed session identifier and nothing else, and it expires after a period of inactivity.
We use no tracking cookies, no advertising cookies and no third-party analytics. Nothing here follows you around the internet.
7. How long we keep it
- Your account and saved sessions are kept while your access is active.
- Removing someone’s access removes their saved sessions and payment records with it.
- Removing an organisation removes its cohorts and everyone’s seats within them.
- Enquiries are kept while we are dealing with them, and for a reasonable period afterwards.
- Server logs are kept for a limited period, for security and fault diagnosis.
8. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong;
- delete your information, where we have no continuing reason to keep it;
- restrict or object to how we use it;
- provide it in a portable form.
You can withdraw newsletter consent at any time using the unsubscribe link in any of those emails. To exercise any of these rights, email us at the address below. If you are not satisfied with our response, you can complain to the Information Commissioner’s Office.
9. If you reach the Toolkit through your employer
Where your organisation bought access for you, they decide who holds a seat and can withdraw it. They can see that you hold a seat and whether it is active. They cannot read the sessions you save.
10. Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change is significant, we will tell account holders by email.
11. Contact us
Email hello@treehouseinnovation.com with any question about this policy, or about the information we hold.