Privacy Policy

2. Explicit AI Processing Disclosure

• No Training on User Data: We maintain strict Zero Data Retention (ZDR) agreements with our enterprise LLM providers. Your email data is never used to train, improve, or fine-tune their AI models.
• Strictly Transient Processing: Data is sent to the AI models strictly to generate instantaneous outputs (summaries, risk flags, drafts). Once the output is generated, the raw source data is immediately discarded from the AI provider's memory.

3. Information We Collect

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process transactions and manage your subscription.
• Generate AI-driven negotiation strategies and risk assessments.
• Push status updates to your authorized integrations (e.g., Slack notifications).
• Detect, investigate, and prevent fraudulent transactions or security incidents.
• Communicate regarding updates, security alerts, and support messages.

5. How We Secure Your Data

Security is foundational to Threadmind. We employ industry-standard security measures:

6. Sharing Your Information

We only share your data with categorized sub-processors strictly required to operate the Service:

• Cloud Infrastructure: Supabase (Database and Auth) and Vercel (Hosting/Compute).
• AI Infrastructure: We utilize enterprise LLM providers to process data. We maintain strict Zero Data Retention (ZDR) agreements ensuring your data is never used to train their models and is discarded immediately.
• Payment Processing: Dodopayments handles all billing explicitly; we do not store raw credit card information.
• Analytics & Observability: We utilize Posthog, Google Analytics (for usage tracking), Sentry (for crash reporting), and Langfuse (for AI tracing) to monitor and improve our Service. These sub-processors only collect aggregated or pseudonymized usage data and exceptions, not your raw email contents.
• Marketing & Advertising: We run paid advertising campaigns (e.g., Google Ads, Facebook Ads, TikTok Ads, Native Ads). We share limited website visitor data (such as page views or signup events) with these ad networks to measure campaign performance and deliver personalized ads. Strict Firewall: These ad networks NEVER receive access to your Gmail data, AI analyses, or extension usage.
• Your Authorized Integrations: Data pushed to Slack or HubSpot only occurs based on your explicit authorization.

7. Data Retention and Deletion

We retain account profile information as long as your account is active.

• Analyses: AI-generated analyses and chat histories are stored so you can review them. You can delete individual thread analyses via the dashboard.
• Cache: Intermediate data is stored in transient caches (e.g., Redis) that are explicitly invalidated upon task completion or manual deletion.

If you request account deletion, we will purge all your personally identifiable information, stored analyses, and integration tokens from our active databases within 30 days.

8. GDPR & European Privacy Rights

If you are a resident of the European Economic Area (EEA) or the United Kingdom (UK), Threadmind acts as the Data Controller. Our legal bases for processing your data include: (a) Performance of a Contract (to provide the Service); (b) Legitimate Interests (to improve and secure the Service); and (c) Explicit Consent (for optional integrations or marketing).

Your GDPR Rights

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You may request corrections to inaccurate or incomplete data.
• Right to Erasure / Right to be Forgotten (Art. 17): You may request the deletion of your personal data when it is no longer necessary for the purposes collected.
• Right to Object (Art. 21): You may object to the processing of your data based on legitimate interests.
• Right to Data Portability (Art. 20): You may request your data in a structured, commonly used format.
• Right to Withdraw Consent: You may revoke OAuth access (e.g., Google or Slack) directly from your account settings at any time.

To exercise these rights, email privacy@trythreadmind.com. You also maintain the right to lodge a complaint with your local Data Protection Authority (DPA) if you believe our processing violates applicable law.

9. CCPA & California Privacy Rights

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents are afforded specific rights regarding their personal information.

• Right to Know: You may request the specific pieces and categories of personal information we have collected, the sources, and the business purposes.
• Right to Delete: You may request the deletion of personal information we collected from you.
• Right to Limit: You may direct us to limit the use of your sensitive personal information (such as explicit email contents) strictly to providing the requested service.
• Right of Non-Discrimination: We will not deny services, charge different prices, or provide a different level of quality for exercising your CCPA rights.

10. International Data Transfers

Threadmind operates globally. If you reside in the EEA, UK, or Switzerland, your data may be transferred to and processed in the United States or other jurisdictions where our cloud infrastructure (Vercel, Supabase) is located. We safeguard these transfers according to Chapter V of the GDPR by relying on the European Commission's approved Standard Contractual Clauses (SCCs) and implementing strict supplementary measures, such as transit encryption and logical isolation, to ensure your data receives an adequate level of protection globally.