# Privacy Notice
Version 2026-10-07.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
## 1 Who we are and what this notice covers
Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: admin@threadlinehq.io. Incorporation of the proposed company Threadline, Lda. is pending; it is not the present contracting party.
This notice covers the Threadline website, web application, Chrome extension, accounts, company settings, workspaces, research, AI-assisted drafts, shared briefs, internal Analytics and service notifications. It also explains the handling of professional information about people who do not have an account. The company’s issued registration particulars will be published when incorporation and the transfer of operation are completed.
Threadline is controller for its account administration, billing, security, support and its own service-usage analysis and internal registration notifications. Where we process customer prospect and workspace content only on the customer’s documented instructions, the customer is controller and Threadline is processor under the Data Processing Agreement. Actual purposes determine these roles. A customer’s contract with us is not a lawful basis for all processing about third-party prospects.
## 2 Information and sources
Account information includes name, email, account identifier, verification and setup status, company, language, workspace membership, plan and subscription details. Stripe handles payment-card information; Threadline receives payment and subscription identifiers and status.
Company or vendor settings can include your website, offering, pitch, value propositions, pain points, differentiators, proof points, customer examples, custom writing instructions, signature and booking links. These can include confidential business information you supply. They are not necessarily public information.
Professional prospect information can include a name, job title, employer, location, profile or company URL, biography, work history and professional activity displayed on a profile a user views. Sources include the selected LinkedIn or Sales Navigator page, user submissions, company websites, public-web research and news. Information visible to an authorised signed-in user is not necessarily available to the general public.
The service also handles saved prospects, notes, tasks, drafts, comments, reviews, approvals, generated summaries, inferences, sources, workspace activity and public-brief content and access metadata. AI-generated inferences about an identifiable person are personal data, even when uncertain.
Technical records can include IP/network metadata handled by service providers, browser or extension version, device/session information, request identifiers, actions, timestamps, errors, durations and AI usage/cost records. Some product activity records include a prospect’s profile URL, name or company. Hashed identifiers are not necessarily anonymous.
We do not intend the service for children or for processing special-category or criminal-offence data. Avoid submitting sensitive personal details, credentials or irrelevant private material. Public availability does not remove data-protection obligations.
## 3 When the extension and research collect information
The extension displays its interface on supported LinkedIn pages. Opening the Threadline panel can send a profile-view activity event containing the current prospect’s URL, name and company before a Reveal is requested. A Reveal then processes selected visible professional information and company context to provide the requested research and drafts. This notice does not claim collection starts only when Reveal is clicked.
The extension does not open other LinkedIn profiles in the background or automatically send LinkedIn invitations, messages, comments or likes. Separately, the web app can refresh public-web announcements for companies you choose to monitor. Threadline is independent from LinkedIn; this description is not a statement of LinkedIn approval.
Browser and extension storage hold authentication/session tokens, pairing state, preferences, caches and queued technical events. See the Cookie and Local Storage Policy and Chrome Extension Privacy Disclosure.
## 4 Purposes and lawful bases
We use account and service information to provide the service you request and administer your contract (GDPR Article 6(1)(b)). For business accounts whose users are not themselves the contracting party, relevant account administration can rely on legitimate interests in delivering the organisation’s service (Article 6(1)(f)).
We rely on legitimate interests for proportionate service security, troubleshooting, abuse prevention, support, service-usage analysis and internal registration/setup alerts: operating the service, identifying failures, assisting onboarding and understanding adoption. These interests must be necessary, balanced against people’s rights and subject to minimisation, limited access and an effective objection process. Unnecessary terminal-equipment tracking requires consent where applicable; describing a purpose as analytics does not make it strictly necessary.
Billing and accounting use contract and applicable legal obligations (Article 6(1)(c)); proportionate legal-claim records can rely on legitimate interests. Marketing emails and new marketing opt-ins are currently disabled. Any future optional electronic marketing or optional tracking requires a lawful basis and consent where the applicable law requires it; registration does not supply that consent. You can withdraw any historical consent without affecting prior lawful processing.
For prospect or workspace processing under customer instructions, the customer determines and documents the lawful basis. Where Threadline determines a separate purpose itself, it must establish its own lawful basis and transparency. We do not claim a blanket legitimate-interest permission for all public data or outreach.
Required account fields enable registration and service delivery; if you do not provide them, we may be unable to provide the relevant service. Optional information is identified in the relevant flow.
## 5 Internal Analytics and registration notifications
Threadline’s private Analytics displays account email, supplied company, registration/setup information, account status and service-usage metrics such as feature counts, activity times, performance, errors and AI costs. It is restricted to authorised founders. The analytics dataset does not copy full prospect URLs, message content or AI prompts, although separate product records can contain them. It is not anonymous simply because some views show totals.
Both founders receive an internal email when an account is created and another when the account has supplied its company and completed setup. These alerts contain limited account details such as first name, email, relevant times, verification status and company where available, plus a link to private Analytics. Resend delivers them to the founders’ Threadline business inboxes. The alerts are for internal administration and onboarding; they are not marketing emails sent to the new user.
Email inbox copies, delivery-provider logs and the application’s notification records have separate lifecycles. Account deletion does not automatically erase every copy in a mailbox or backup. Rights requests include these records where relevant.
## 6 AI processing
Selected profile information, company research, vendor settings, custom instructions and relevant workspace context are sent to OpenAI to generate summaries and drafts. This may include non-public material you enter. Do not submit information you lack authority to disclose for that processing.
OpenAI states API data is not used for model training by default. Threadline does not use customer content to train a general-purpose model. A request setting such as store:false does not eliminate all provider retention. Standard abuse-monitoring records can be retained for up to 30 days, subject to the provider’s exceptions and applicable law. Threadline does not promise Zero Data Retention or EU-only OpenAI processing.
Output can be wrong, biased or outdated. A person must review it. Threadline does not use the described service to make solely automated decisions with legal or similarly significant effects. It must not be used for high-impact decisions about employment, credit, insurance, housing or similar matters.
## 7 Recipients and international processing
Supabase supplies authentication, database, storage and backend functions. The observed primary project region is London, United Kingdom. The UK is outside the EU; an applicable EU adequacy decision currently covers relevant transfers. Support and onward processing can involve other locations.
OpenAI provides AI processing and web-search-assisted research. Stripe provides payments and fraud/compliance processing; it can act as an independent controller for some activities. Resend delivers service emails and internal registration/setup alerts. Lovable and its hosting infrastructure deliver the marketing website. Cloudflare provides network/security services. GitHub Pages distributes the static web application and extension downloads. Netlify hosts the private Analytics application. The domain’s inbound email is routed through Titan; Lark is used for internal documentation. Business mailboxes and any configured mail clients can hold alert copies. Each receives the data relevant to its role, rather than unrestricted access to all product content. Fonts are served with the website files and do not require a browser request to Google Fonts.
Authorised workspace members and anyone receiving a public brief link can receive information you choose to share. Advisers, authorities and parties involved in a corporate transaction may receive necessary information subject to law and confidentiality safeguards.
For transfers requiring safeguards, we use the applicable adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where necessary. Contact us for information about relevant safeguards. This is not an EU-only hosting or processing promise. Supplier entities, purposes, locations, agreements and configuration evidence are maintained in the supplier register; unresolved evidence is recorded in the readiness register.
## 8 Retention and deletion
Retention depends on the record and purpose. There is no single automatic deletion period for all Threadline data. Current cleanup runs daily, so an expiry is followed by the next successful cleanup run.
- Expired pairing and device-authorisation records are removed by scheduled cleanup.
- Reveal job records normally expire after 7 days; company-enrichment cache records after 5 days. Saved outputs or workspace copies have their own lifecycle.
- Public briefs normally expire after 30 days unless otherwise configured. Access ends at expiry or revocation; stored brief records are cleaned up 7 days after expiry or revocation.
- Interaction events are generally kept for 90 days; product activity and AI usage/cost records for 180 days.
- Observability records have record-specific expiry, commonly 30, 60 or 90 days. Some billing/webhook integrity records are retained for 400 days.
- Private Analytics event and audit history is retained for up to 400 days. Account/cohort information can remain while the account exists; it is not all governed by that 400-day event window.
- Internal founder registration/setup notification delivery records currently have no automatic age-based deletion rule. They are linked to account deletion. Founders’ inbox copies and email-provider logs are separate. Requests for earlier deletion or objection are assessed by purpose and applicable obligations.
- Accounts, company settings, saved prospects, drafts and workspace content remain while needed for the account or customer’s instructions, until deleted or the purpose ends. There is currently no general inactivity rule automatically deleting all durable content.
- Tax, payment, dispute, rights-request and narrowly necessary suppression records can be retained for legal obligations or claims. They must not be reused for unrelated purposes. Provider backups expire under their applicable schedules; we do not promise immediate deletion from every backup.
Account deletion removes active personal product data and owned workspaces through the service’s deletion process. Export or transfer workspace ownership first if colleagues still need that workspace. Records controlled by another customer can remain under that customer’s lawful instructions, with attribution removed where the product supports it. Copies exported or downloaded by customers are their responsibility.
## 9 Your rights and how to contact us
Email admin@threadlinehq.io for access, correction, erasure, restriction, portability where applicable, objection, withdrawal of consent or information about safeguards. You do not need a Threadline account. Give enough information to locate the relevant account, profile or record; we may request proportionate verification without routinely demanding an identity-document copy.
We respond without undue delay and within one month. If the law permits an extension because of complexity or number of requests, we explain the reason within that first month. We explain any refusal and complaint options. Direct-marketing objections are honoured for that purpose; other legitimate-interest objections are assessed under Article 21.
Account exports include personal product records, private Analytics records, notification records, recorded Terms acceptance, marketing choices and consumer billing/withdrawal records. A full access response may still require separate mailbox, support, payment-provider or other provider records. Contact us for a complete access response. If a self-service deletion or export fails, the email channel remains available. Account closure, subscription cancellation and statutory erasure are distinct processes; an outstanding subscription does not remove your statutory rights.
Where we act only as a processor, we help the responsible customer handle the request. You may complain to the Portuguese CNPD at https://www.cnpd.pt/ or your competent local supervisory authority.
## 10 People whose information came from other sources
Professional data remains protected when publicly available. The responsible controller must give the required Article 14 information within a reasonable period, no later than one month, or at the first communication or disclosure if earlier, unless a specific exception is applicable and documented. A general website notice alone does not prove that obligation has been met. Our Prospect Data Notice explains the distinction between the customer’s processing and Threadline’s own purposes.
## 11 Security and changes
We use authentication, access controls, row-level database policies and HTTPS, with operational logging and scheduled cleanup. Public links can be forwarded, and browser storage is not end-to-end encrypted. No system is risk-free. See Security at Threadline for the supported control description.
We update this notice when practices change and communicate material changes through an appropriate channel. New consent is sought where legally required. Contact admin@threadlinehq.io for this notice or previous versions.
## Consent and contract records
For a new account, we record the Terms version, server time, acceptance method, registration action and surface, the versioned notice text and its hash, and the linked privacy-text hash. A button action following the visible notice is recorded as button-notice acceptance, not as a checked box or blanket privacy consent. Signing in with an existing current or explicitly compatible agreement does not create another acceptance. Marketing is disabled for all accounts. Historical marketing choices are retained as history; any previously active preference is set to off without rewriting the original event. Contact admin@threadlinehq.io for questions or withdrawal of any historical choice. Contract and withdrawal records include the order reference, amount, currency, applicable taxes, contract copy, request time and refund outcome. Transactional purchase, cancellation and withdrawal messages are separate from marketing. Current test billing records are kept for up to 400 days after completion unless an unresolved request requires longer; account consent and marketing records are deleted with the account. Statutory accounting retention for future real sales will be specified before those sales begin.

## Extension registration and acknowledgement
The Chrome-owned extension setup panel collects your email and password for registration or sign-in. Password confirmation is checked locally and is not sent as a second password field. Credentials are transmitted over HTTPS to the authentication service; the extension does not save passwords in its drafts. The server activates new extension accounts immediately and sends an acknowledgement through Resend. This service email requires no code or link click, is independent of optional marketing consent and is not evidence that you proved ownership of the mailbox. Existing web-registration confirmation behavior remains separate.
Company name, product/service category, website and editable company-profile suggestions use the same account profile as the web app. Unfinished company drafts and a temporary setup session are held in extension local storage so setup can resume. These are removed when setup connects the browser or when you explicitly leave setup using a different account; account-scoped drafts are not displayed to another signed-in account. Session expiry or revocation can require signing in again. Closing the panel alone does not erase the draft.
To prevent automated registrations, the signup service processes network signals and keyed hashes of network and email values in hourly rate-limit buckets. Bucket records are removed after 24 hours by hourly cleanup. These hashes are pseudonymous, not anonymous. Registration acknowledgement outbox records, including recipient, content and delivery status, expire after 30 days by hourly cleanup and are removed earlier with the account. Delivered inbox copies and Resend records follow their own lifecycle. These periods are separate from the existing founder-notification and consumer-billing records. Account exports include the retained acknowledgement record.

## Optional Google sign-in
If you choose Continue with Google, Google supplies a verified identity assertion to Threadline's Supabase authentication backend. We request only OpenID identity, email and basic profile. Account records can include your Google identifier, email and verification claim, name and profile-image URL supplied in that assertion. We use these to create or authenticate your Threadline account, protect account linking and administer the service. Threadline never receives your Google password and does not request Gmail, contacts, Drive or calendar access. We do not use Google sign-in data for advertising, resale, credit scoring or model training.
Google receives the sign-in request and related network/browser information under its own Privacy Policy at https://policies.google.com/privacy. Google processing can occur internationally; this is not an EU-only processing promise. Supabase handles the resulting Threadline identity and session. Your account email and name can also appear in the existing private founder account records and Resend service/registration notifications described above. Google sign-in does not grant marketing consent or additional Google permissions; marketing emails are currently disabled.
A sign-in attempt stores the displayed Terms version, button-notice version and action/surface (or an older installed client’s actual checked acknowledgements), marketing-off status, interface language, one-time security values, exact return address and a keyed network hash in a private server record. It expires after 10 minutes, is consumed on completion and is removed by hourly cleanup after expiry if abandoned. Only the sign-in attempt and its originating browser can complete the exchange. Google API tokens are used during the server exchange and are not returned to the extension/web application or saved as reusable Google API credentials. The normal Threadline session has its existing retention and revocation controls.
Google identity/account data remains for the account lifecycle and is removed from active Threadline authentication records on account deletion. New-account acknowledgement copies follow the existing 30-day outbox limit and earlier account deletion; recipient inbox and provider records are separate. You can remove Threadline's connection in your Google Account's third-party connections controls; this prevents future use of that Google connection but does not itself delete your Threadline account or immediately revoke an already issued Threadline session. Use Threadline sign-out/device controls and the deletion or privacy-request process for those actions.