# Terms of Service
Version 2026-10-07.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
## 1 Provider and agreement
Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: admin@threadlinehq.io. Incorporation of the proposed company Threadline, Lda. is pending; it is not the present contracting party.
These Terms cover the Threadline website, web application, Chrome extension and related services. The proposed company will become the provider only after incorporation and an appropriately notified contractual transfer. Contact admin@threadlinehq.io for contract, support or complaint questions.
You must be at least 18 and legally capable of contracting. We accept business and consumer users. Whether you are a consumer depends on the purpose for which you contract, not simply the email address or plan you choose. If you act for an organisation, you must have authority to bind it.
These Terms apply when validly brought to your attention and accepted in the relevant contract flow. The Privacy Notice explains processing; acknowledging it is not blanket consent to every processing activity. The Data Processing Agreement governs processing on customer instructions. The AI and Third-Party Platform Terms supplement these Terms, but cannot reduce mandatory rights.
## 2 Service and permitted use
Threadline helps you prepare sales research and communications through Full Reveal, additional signal messages, email generation, permitted regenerations, Account Intelligence, shared briefs, monitored announcements, custom messaging prompts, writing controls and Team workspace, as available in your plan. Company settings, saved drafts and related utilities support these functions.
You may use your authorised access and generated material for lawful personal or professional purposes, including your own business development and sales communications. We do not prohibit ordinary commercial use that the service is designed to support. You may not resell access, share credentials or collect data unlawfully.
The extension processes professional context from a profile you view; opening its panel can record a profile-view event before a Reveal. Monitored announcements can refresh selected companies from public-web sources. Threadline does not automatically send LinkedIn invitations, messages or emails on your behalf. You choose whether, where and what to send.
You need an internet connection, a compatible current browser and, for the extension, a supported Chrome environment and authorised access to the source page. Third-party changes can affect compatibility. AI and public-source output can be inaccurate or unavailable and requires human review.
## 3 Accounts and workspaces
Provide accurate account information and protect your credentials and devices. Notify us of suspected unauthorised access. Organisation administrators can manage members, roles, shared settings and materials according to the service’s permissions. Their internal decisions remain the organisation’s responsibility.
Workspace ownership, personal subscription and personal credit balances are distinct. Transferring a workspace does not automatically transfer a payment contract. Before closing an account that owns a workspace, transfer ownership or export material you are entitled to keep; deleting the owner’s account can delete that workspace and its dependent content. A departing member’s contribution may remain in another customer’s retained records with attribution removed where supported.
You are responsible for your authorised use, but not for consequences attributable to our breach of our own obligations.
## 4 Plans prices and credits
The plan and checkout or signed order specify features, included Reveals, currency, billing period, total payable price, taxes, renewal and any applicable minimum term. Consumer price information must include applicable taxes and unavoidable charges before the order is placed. A marketing price labelled excluding VAT is not a substitute for the consumer’s final total.
Free provides 5 Reveals once. Starter and Pro offer monthly or annual billing with allowances refreshed monthly. Teams is arranged by contacting Threadline, with custom pricing and Reveal limits per seat stated in the agreed order; it is not a standard self-service purchase. Existing contracts continue according to their agreed terms.
Only a Reveal consumes a Reveal credit. Included follow-up outputs remain subject to plan access and reasonable security or usage limits. Monthly plan allowances do not roll over. Purchased refill credits do not expire under the current offer. Credits are a service allowance, not cash or transferable stored value. Restoring a credit after a failed request is distinct from refunding a payment.
A paid subscription renews for its stated period until cancelled. We obtain authority for recurring charges in the payment flow. We give advance notice of material price or contract changes; changes will not retrospectively alter a paid period. You may reject future renewal by cancelling. Mandatory consumer rules on digital-service modifications and termination remain applicable.
## 5 Cancellation account closure and refunds
You can cancel future renewal through the available billing controls or contact admin@threadlinehq.io if they fail or are unavailable. Ordinary renewal cancellation generally leaves access until the paid period ends. We explain the effective date and any refund due. Statutory withdrawal and remedies for non-conformity are separate from ordinary cancellation.
You can request account closure and exercise data-protection rights without waiting for a subscription to expire. Billing obligations, lawfully retained accounting records and privacy erasure are assessed separately. Use export tools before closure where needed; contact us for records missing from the self-service export. A technical failure in a billing or deletion control does not remove your statutory rights.
Refunds required by law are provided regardless of a plan’s usual refund policy. We do not use credits, suspension, a dispute or a payment claim to exclude mandatory remedies.
## 6 Consumer withdrawal
If you are an EU consumer entering a qualifying distance service contract, you may withdraw without giving a reason within 14 days after the contract is concluded. Use Withdraw from a contract in Billing, or send a clear statement to admin@threadlinehq.io or the postal address above before the deadline. You may use the form below but it is not compulsory. If required withdrawal information was not supplied, the statutory extended period applies.
We reimburse payments due on withdrawal without undue delay and within 14 days after receiving your notice, using the original payment method unless you expressly agree otherwise and without a refund fee.
Threadline offers a full refund of the relevant initial subscription or refill payment for a withdrawal received within 14 days of that contract. No deduction is made for use during those 14 days. This additional refund policy does not reduce any longer statutory period or other remedy. Renewal cancellation is separate; an ordinary renewal does not automatically start a new 14-day period. Starting an ongoing digital service or using a Reveal does not by itself remove the withdrawal right. If you choose immediate service at checkout, you request access during the withdrawal period. Under the full-refund policy above, Threadline does not charge a proportionate amount for that use. Loss of the right for a fully performed paid service requires the legally required prior consent and acknowledgement. Separate rules can apply to qualifying digital content. We will not treat ordinary registration, installation or a general Terms checkbox as those specific acknowledgements.
Withdrawal form: To Threadline at admin@threadlinehq.io or Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. I notify you that I withdraw from my contract for the following service: [service and order reference]. Contract date: [date]. Consumer name: [name]. Consumer address: [address]. Date: [date]. Signature: [only if sent on paper].
The equivalent statutory form and instructions must accompany the contract confirmation in a durable form. Contact us in Portuguese or English. This form does not restrict other valid ways to exercise the right.
## 7 Consumer conformity and remedies
We must supply the digital service in conformity with the contract and applicable objective requirements, including relevant functionality, compatibility, security updates and continuity during the supply period. If it is not supplied or is non-conforming, consumers have the remedies provided by applicable law, including bringing it into conformity, an appropriate price reduction or termination when the relevant conditions are met. Free service can also attract digital-service protection where the statutory conditions apply.
Contact admin@threadlinehq.io describing the issue. We will not charge for a remedy that must be free by law or require you to waive mandatory rights. Portuguese law includes Decreto-Lei 84/2021 and applicable distance-contract rules. Consumers retain any more protective mandatory rules applicable in their country of habitual residence.
## 8 Data use outreach and acceptable conduct
Use only data and accounts you are authorised to access. Do not evade access controls, scrape in bulk, use false identities, bypass limits or interfere with service security. Do not upload secrets, irrelevant sensitive personal data, children’s data or third-party confidential information without authority for the specific processing.
Do not use Threadline for spam, harassment, stalking, deception, unlawful discrimination, impersonation, defamation or infringement. Do not infer or target sensitive traits or use output for high-impact decisions about employment, lending, insurance, housing, health or similar matters.
Public professional information is still personal data. If you determine why prospects are researched or contacted, establish a lawful basis, give required indirect-collection notices, minimise and correct data, set retention and honour rights and suppression. A GDPR legitimate interest in research does not automatically permit electronic marketing. Portuguese rules can require prior consent for messages to natural persons, including professional recipients; narrow existing-customer exceptions have conditions. Check the applicable recipient-country and channel rules before sending.
## 9 LinkedIn and other third parties
Threadline is independent from LinkedIn and is not sponsored or approved by it. LinkedIn’s agreements restrict certain browser-plugin copying, scraping and overlays. User initiation, low volume and a publicly visible profile do not establish an exception or guarantee compliance. A platform may restrict the feature or your account. We do not guarantee uninterrupted access or platform permission.
We remain responsible for our own product design and conduct. These Terms do not shift Threadline’s statutory obligations to you. We may suspend or redesign a feature where reasonably necessary for a legal, security or platform issue, with appropriate notice and consumer remedies where required.
## 10 AI content ownership and confidentiality
You retain the rights you have in submitted content. You authorise us to host, process, transform and transmit it as needed to provide, secure and support the service and comply with law. This does not transfer ownership of your confidential company information to us or give us rights in third-party material that you do not hold.
Subject to applicable law and third-party rights, you may use generated outputs for lawful personal or business purposes. Outputs may not be unique or protected by copyright; verify factual claims and source rights before publication. We retain rights in the service’s software, interface, branding and underlying technology, excluding your content and third-party rights.
We protect non-public customer information with reasonable care and disclose it only to authorised personnel and providers for the relevant purpose or where law requires. A user who shares a public brief authorises access by anyone possessing the link until expiry or revocation. Recipients can forward or copy it; revocation cannot recall their downloaded copies.
## 11 Availability changes suspension and termination
We provide the service with reasonable skill and care. No separate uptime SLA applies unless agreed. Dependencies and maintenance can affect availability. Changes to a consumer digital service beyond those needed for conformity require a contractual valid reason, no additional cost and the legally required information and remedies; any material negative impact triggers the rights provided by applicable law.
We may suspend access proportionately for a material breach, security threat, unlawful use or non-payment. Where practicable and lawful, we explain the reason and provide a way to challenge or remedy it. You may contact us to terminate under these Terms or statutory rights. Data return, retention and deletion follow the Privacy Notice and DPA where applicable.
## 12 Liability and disputes
Nothing excludes or limits liability that cannot lawfully be excluded, including mandatory consumer and data-protection rights, fraud, wilful misconduct or other protected liability. For consumers, liability and remedies remain governed by applicable mandatory law.
For business customers only, and subject to those exceptions, neither party is liable for indirect or consequential loss; aggregate contractual liability is limited to fees paid or payable for the service in the 12 months preceding the event, unless an agreed order or DPA provides otherwise. No cap limits a data subject’s rights against a liable party under the GDPR. These clauses remain subject to applicable Portuguese rules on standard terms and non-excludable fault.
Portuguese law governs. Business disputes are subject to competent Lisbon courts unless agreed otherwise. Consumers retain the courts and mandatory protections available under applicable law, including those of their habitual residence. Contact us first if you wish, without losing any right to complain or bring proceedings.
For eligible disputes within its competence, the Centro de Arbitragem de Conflitos de Consumo de Lisboa provides information at https://www.centroarbitragemlisboa.pt/. Other competent Portuguese ADR bodies are listed by the Ministry of Justice at https://dgpj.justica.gov.pt/Resolucao-de-Litigios/Arbitragem/Centros-de-Arbitragem-apoiados. We do not claim voluntary membership or adherence that has not been confirmed. Mandatory consumer arbitration rights, where applicable, remain unaffected.
The official electronic complaints-book platform is https://www.livroreclamacoes.pt/INICIO/. An electronic complaints-book registration for the future company is pending incorporation. This does not restrict complaints to the operators, competent authorities or applicable dispute-resolution bodies. Real-money consumer sales remain unavailable pending the required business and complaints arrangements. Do not use the discontinued EU ODR platform as a complaint route.
## 13 Contract documents and changes
A negotiated order prevails only for an express, lawful variation; the DPA prevails for processor obligations. Mandatory consumer law always prevails. We communicate material changes and do not make them retroactive. A change of corporate operator requires appropriate information and any legally required arrangements; pending incorporation is not treated as a completed transfer of this contract.

## Extension account creation
You can create a Free account in the Chrome extension with an email address and password and complete the same company setup there. The account is activated immediately without an email code or activation-link step; an informational acknowledgement is sent by email. Activation does not establish ownership of the supplied mailbox. Provide an email address you control. The same account and its one-time allowance of five Free Reveals are used in the extension and web dashboard. Signing in through another surface, reconnecting or repeating setup does not create another allowance. Paid upgrades remain in the web application and its separate checkout flow.

## Optional Google sign-in
Continue with Google is an alternative to email/password registration and sign-in in the web application and Chrome extension. When creating an account, the visible notice beside the registration action links to these Terms and the Privacy Notice. Choosing Register, Create Account or Continue with Google after that notice is the affirmative action accepting these Terms for a new account; no separate checkbox is required. The Privacy Notice explains processing and rights, rather than asking for blanket privacy consent. Returning users with a recorded current or explicitly compatible agreement sign in without accepting it again. A material contractual change requiring acceptance is presented separately before agreement is recorded. Marketing emails and new marketing opt-ins are currently disabled. Account, security and service emails remain available. Google authenticates you in its own window or page. You do not give Threadline your Google password. A new Google account receives the same Free allowance and company onboarding, and can use the same Threadline account on both surfaces. Existing accounts and their balances are not reset by signing in again. For security, an existing password account without verified mailbox ownership cannot be automatically linked solely by matching its email. Use that account's password sign-in or contact support.


---

# Platform and Third Party Terms
Version 2026-10-05.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
## 1 Relationship to the main Terms
These terms supplement the Threadline Terms of Service for the browser extension, profile context, public-web research, AI features, monitoring, shared briefs and third-party services. They do not override mandatory consumer protections, the DPA’s processor obligations or applicable data-protection law.
## 2 Independent service and platform restrictions
Threadline is independent from LinkedIn and other content sources. Use of a browser, API, trademark or public page does not establish endorsement or permission.
LinkedIn’s current agreements restrict certain browser-plugin copying, scraping and overlays. A user clicking a button, low processing volume or publicly visible information does not guarantee an exception. LinkedIn may change its pages, restrict extensions or act against an account. Threadline does not promise platform approval or uninterrupted access.
## 3 Actual operation
The extension displays its interface on supported LinkedIn pages. Opening its panel can transmit a profile-view event including a prospect URL, name and company before Reveal. A requested Reveal processes selected professional context and company research. The service does not open other LinkedIn profiles in the background or automatically send LinkedIn invitations, messages, comments or likes.
The web app’s monitored announcements refresh public-web information for companies selected by the user. That scheduled company research is distinct from browsing additional LinkedIn profiles. The Privacy Notice and extension disclosure describe collection and retention.
## 4 Lawful use and source rights
Use only accounts and material you are authorised to access. Do not evade authentication, access controls, rate limits, paywalls, contractual restrictions or suppression instructions. A feature being technically available is not legal permission.
Professional names, roles and inferred interests can be personal data even when public. Customers who determine prospect purposes must document their basis, minimise data, give notices, handle rights and apply the relevant electronic-marketing rules. Public material may also be protected by copyright, database rights, confidentiality or contract. Verify what you may reuse.
## 5 AI and provider dependencies
AI output requires human review. Input can include personal and confidential business information; submit only what is authorised for the requested processing. Providers, categories and transfers are described in the Privacy Notice. No general promise of zero retention, EU-only processing or perfect accuracy is made.
Third-party outages or policy changes can affect research and generation. Threadline may limit, suspend or redesign a feature to address a legal, security or platform issue, while preserving applicable contractual and consumer remedies.
## 6 Sharing and collaboration
Shared briefs are accessible to anyone possessing the link until expiry or revocation. Recipients can forward the link or retain a copy. Minimise personal and confidential material before sharing. Revocation ends access to Threadline’s link but cannot recall downloads or copies.
Workspace roles determine access within Threadline. A user exporting material to another system is responsible for lawful use and downstream rights/deletion handling within that system.
## 7 Allocation of responsibility
Threadline remains responsible for its own conduct, product design, processing agreements and disclosures. User responsibilities do not transfer those obligations or legalise prohibited platform conduct. Customers remain responsible for their instructions and outreach decisions. The main Terms govern warranties, liability, suspension and disputes, subject to mandatory law.
Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: admin@threadlinehq.io. Incorporation of the proposed company Threadline, Lda. is pending; it is not the present contracting party.

---

# AI Content and User Responsibility
Version 2026-10-05.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
## 1 How AI is used
Threadline uses OpenAI to turn selected professional information, public-web/company research, vendor settings and user instructions into summaries, signals, Account Intelligence and draft messages or emails. Inputs can include non-public company information and custom prompts you supply. Output is AI-assisted even when fluent or confident.
## 2 Review every output
Output may contain invented facts, mistaken attribution, bias, stale information or unsuitable wording. Check material names, dates, financial claims, source links and relevance. A cited URL does not prove the model’s interpretation is correct. Do not treat output as legal, financial, employment or other professional advice.
You choose the final content, recipient, channel and timing. Threadline does not automatically send outreach. Review and edit before copying, sharing or sending. Similar output can be generated for others; no guarantee of exclusivity, copyright protection or non-infringement is made.
## 3 Inputs and prohibited uses
Submit only information you may lawfully process and disclose to the service and its providers. Do not include passwords, secrets, irrelevant private details, sensitive personal information, criminal allegations or children’s data. Do not submit another party’s confidential information without authority for the specific processing.
Do not use Threadline for harassment, spam, deception, impersonation, discrimination or unlawful targeting of sensitive traits. Do not use it for solely automated or high-impact decisions about employment, credit, insurance, housing, education, health, law enforcement or migration.
Public professional information remains personal data. The responsible controller must establish a lawful basis, provide required Article 14 notices, honour objections and choose a lawful retention and outreach process. A generated email is not permission to send unsolicited marketing.
## 4 Provider processing and retention
OpenAI receives relevant inputs and produces outputs. OpenAI states that API data is not used for model training by default. Threadline does not use customer content to train a general-purpose model. Standard abuse-monitoring records may be retained for up to 30 days, subject to provider exceptions and law; store:false does not remove all retention. Threadline does not promise Zero Data Retention or EU-only AI processing.
The Privacy Notice describes recipients, transfers and Threadline’s separate storage of saved outputs, usage records and account information. Deleting a browser cache does not delete those server or provider copies.
## 5 Transparency and correction
Threadline identifies its research and drafting features as AI-assisted. Do not misleadingly present an inference as verified fact or conceal an AI disclosure where the law or context requires it. Specific EU AI Act transparency duties depend on the feature, content and provider/deployer role; not every ordinary sales email has the same labelling rule.
Report incorrect, harmful or sensitive output to admin@threadlinehq.io with the relevant record or request reference and minimal necessary detail. A correction may need to cover saved outputs and shared briefs as well as the source field. Recipients of copied/exported material may need a separate correction.
## 6 Responsibilities and rights
You remain responsible for your own lawful inputs, review and communications. Threadline remains responsible for its own design, processing, security, disclosures and mandatory obligations. The main Terms govern permitted use and liability. Nothing in this notice excludes statutory consumer remedies or data-subject rights.
Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: admin@threadlinehq.io. Incorporation of the proposed company Threadline, Lda. is pending; it is not the present contracting party.

---

# Data Processing Agreement
Version 2026-10-05.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
## 1 Parties scope and roles
This DPA forms part of the applicable service agreement between the customer identified in the order or validly accepted service contract (Customer) and the confirmed Threadline legal operator (Threadline). Operator: Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: admin@threadlinehq.io. Incorporation of the proposed company Threadline, Lda. is pending; it is not the present contracting party.
This DPA is part of the Terms accepted by the Customer, identified by the account or agreed order. The current Threadline operators are identified above. It applies to the extent Threadline processes Customer Personal Data on the Customer’s documented instructions. The Customer must identify its responsible organisation and privacy contact accurately; a later corporate operator is not substituted without an appropriate transfer. Data Protection Law includes the GDPR, applicable Portuguese data-protection law and other applicable mandatory law.
Customer is controller, or processor for its own controller, of Customer Personal Data that Threadline processes on documented instructions. Threadline is processor or subprocessor for that data. This DPA does not cover Threadline’s separate controller processing for its own account administration, billing, security, service-usage analysis, registration/setup alerts or legal obligations, described in the Privacy Notice. A role label does not override the actual facts.
## 2 Instructions and permitted processing
Threadline processes Customer Personal Data only on documented instructions, including the agreement, configured features, authorised user actions and written instructions, including for transfers, unless Union or Member State law requires otherwise. It informs Customer of such a requirement before processing unless the law prohibits that information.
Threadline immediately informs Customer if, in its opinion, an instruction infringes applicable data-protection law, and may suspend the affected processing while the parties resolve it. Customer is responsible for lawful instructions, data sources, bases, notices, minimisation, accuracy, retention and outreach-channel rules.
Threadline does not sell Customer Personal Data, use it for personalised advertising or train a general-purpose AI model on it. It does not acquire a right to reuse customer prospect content for its own unrelated intelligence database through this DPA. Sensitive data and criminal-offence data are not authorised inputs without a separately agreed lawful arrangement.
## 3 Personnel and security
Threadline ensures persons authorised to process the data are committed to confidentiality or under an appropriate statutory obligation. It implements appropriate technical and organisational measures under Article 32, taking account of the processing and risk. Annex II describes the scope of those measures without claiming unverified certifications or controls.
Threadline may improve measures without materially reducing the contracted protection. Customer must configure its own access, secure devices, minimise inputs and control sharing and exports. These customer duties do not reduce Threadline’s obligations.
## 4 Subprocessors
Customer gives general written authorisation for the processing-chain providers identified in Annex III, only within their described scope. Before adding or replacing a subprocessor, Threadline gives at least 30 days’ notice and a meaningful opportunity to object on reasonable data-protection grounds. If law or an urgent security event requires faster action, Threadline promptly explains the circumstances, limits exposure and provides an opportunity to object and a practical alternative or termination of the affected processing where necessary.
Threadline imposes the same applicable data-protection obligations on each subprocessor by contract and remains fully liable to Customer for the performance of the subprocessor’s obligations as required by Article 28(4). A general list of every commercial supplier is not a substitute for an accurate subprocessor schedule.
## 5 Assistance and individual rights
Taking account of the processing, Threadline assists Customer through appropriate technical and organisational measures in responding to data-subject requests. It forwards requests concerning Customer Personal Data without undue delay and does not respond substantively on Customer’s behalf unless authorised or legally required.
Threadline assists with security, breach notifications, DPIAs and prior consultation under Articles 32–36, taking into account the information available. Assistance includes locating relevant active records, generated derivatives, sharing links, provider copies and deletion restrictions. Self-service export is not treated as a complete response where additional records are held.
## 6 Personal data breaches
Threadline notifies Customer without undue delay after becoming aware of a breach affecting Customer Personal Data. It supplies, as available, the nature of the breach, affected categories and approximate numbers, likely consequences, measures taken or proposed and a contact. Information can be supplied in phases without undue further delay.
Customer controls its own regulator and individual notifications unless law provides otherwise. Threadline preserves relevant evidence and cooperates with containment and remediation. No acknowledgement or response SLA is represented as already operating unless separately agreed and supported.
## 7 Return deletion and retention
At the end of processing services, Threadline deletes or returns Customer Personal Data at Customer’s choice, and deletes existing copies unless Union or Member State law requires retention. Customer can request return before deletion through available export facilities or admin@threadlinehq.io. Threadline completes active-system return/deletion within 30 days of a validated instruction unless a shorter period is legally required or agreed.
Necessary retained legal records are limited to their purpose and protected from other use. Backups remain restricted and expire under the verified provider schedule, which must be supplied in the completed schedule; no unverified fixed backup period is promised. If a backup is restored, relevant deletion and suppression instructions must be reapplied before ordinary use resumes.
Account-owner deletion can remove the owned workspace. Customer must arrange transfer or return before deletion where required. Records in a different customer’s workspace require the appropriate controller’s instructions and lawful retention assessment. Copies independently exported by Customer are outside Threadline’s direct control.
## 8 Transfers
Threadline identifies the destination, recipient, purpose and applicable transfer mechanism before any restricted transfer. An applicable adequacy decision can support covered transfers; otherwise appropriate safeguards such as the correct modules of Commission Decision (EU) 2021/914, completed annexes and necessary supplementary measures must be in place. A generic reference to SCCs does not by itself complete the transfer assessment or contractual annexes.
The observed primary Supabase region is London, United Kingdom. The UK is not an EU location; the applicable adequacy decision is subject to its terms and continuing validity. Provider support, AI processing and onward subprocessors can involve other countries. Threadline does not promise EU-only processing. UK-restricted transfers require the appropriate UK mechanism where applicable.
## 9 Compliance information and audits
Threadline makes available all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by Customer or its mandated auditor. Current independent reports and written responses can be used first where sufficient.
Audits use proportionate scope, confidentiality, reasonable notice and safeguards for other customers and service security. Ordinarily 30 days’ notice is requested, but urgency, material incidents and competent-authority requirements may require less. Routine frequency or costs must not prevent a legally necessary audit. Mandatory regulator powers are unaffected.
## 10 Priority liability and duration
This DPA prevails over inconsistent service terms concerning processor obligations. Applicable SCCs prevail where required. It remains effective while Threadline processes Customer Personal Data. Liability provisions do not limit non-excludable obligations or data-subject rights under the GDPR.
## Annex I Processing description
Subject matter and purpose: provide customer-requested professional research, AI-assisted drafting, prospect/workspace records, company settings, comments, approvals, shared briefs, support and related security functions.
Nature: collection from customer-selected or supplied sources, extraction, organisation, storage, transmission to authorised providers, generation, retrieval, display, collaboration, sharing, export, restriction and deletion.
Duration and frequency: for the service term and applicable return/deletion period; continuous storage and event-driven processing, including configured public-company monitoring.
Data subjects: authorised customer users, professional prospects selected by Customer, customer personnel, contacts and brief recipients.
Data categories: professional names, roles, employers, locations, profile/company URLs, biographies and work history; supplied business context and custom prompts; sources, inferences, generated outputs, notes, drafts, comments, approvals, sharing metadata and relevant service records. Special-category, criminal-offence and children’s data are not intended inputs; incidental sensitive material requires minimisation and correction.
Customer instructions: agreement, order, feature configuration and lawful authorised user/support instructions. Customer identifies the responsible controller and contacts in the order and supplies any additional industry or country restrictions before processing.
## Annex II Technical and organisational measures
Observed product controls include Supabase authentication, role and row-level access controls, server-side entitlement checks, HTTPS, private avatar storage with signed access, short-lived pairing/device authorisations, validation, rate/spend controls, operational logs and scheduled cleanup. Browser storage can contain session tokens and is not end-to-end encrypted. Public briefs are link-accessible and must be treated accordingly.
Required organisational measures include confidentiality, least privilege, access review and offboarding, incident handling, supplier oversight, appropriate training, deletion/rights assistance and tested recovery. Evidence of these operating procedures, exact backup coverage, restore tests and staff MFA remains to be completed in the readiness register. This annex does not claim an independent penetration test, ISO certification or SOC report held by Threadline.
## Annex III Processing-chain providers and scope
Supabase Pte. Ltd.: authentication, database, storage and backend functions for user, company, prospect and workspace content. The primary project is in London, UK; support and onward providers can operate elsewhere. The current provider DPA includes SCC provisions for relevant transfers: https://supabase.com/legal/customer-resources/data-processing-addendum. Its provider list is https://supabase.com/legal/customer-resources/subprocessor-list.
OpenAI Ireland Ltd. for an EEA customer under the applicable API agreement: relevant prompts, company/prospect context and generated outputs for requested generation and research. International processing can occur through affiliates and listed providers. Standard API abuse-monitoring retention can be up to 30 days; no Zero Data Retention or EU-only processing arrangement is represented. Provider DPA: https://openai.com/policies/data-processing-addendum/; providers: https://platform.openai.com/subprocessors.
Cloudflare, Inc. provides relevant network and security delivery. Its geographical scope is international and its role depends on the configured traffic path: https://www.cloudflare.com/cloudflare-customer-dpa/.
Resend (Plus Five Five, Inc.) provides delivery for service emails, including workspace invitations where used. Only necessary recipient and message content is supplied. Its DPA includes transfer clauses: https://resend.com/legal/dpa. Threadline's own account/founder/billing alerts are separate controller activities.
GitHub Pages distributes static app files and receives network requests. Lovable hosts the marketing website. Netlify hosts private founder Analytics. Titan hosts business mail and Lark holds internal documents. These are not authorised as general repositories for customer prospect datasets through this DPA. Where an instructed support or sharing flow puts Customer Personal Data in a provider's processing chain, Threadline must identify the applicable provider, scope and safeguards and obtain the required authorisation before extending that flow.
Threadline maintains the account-specific supplier and transfer evidence internally. Public provider terms do not prove that a particular account's contractual identity, configuration, backup coverage or transfer assessment has been verified. Customers may request the applicable evidence and backup/deletion information at admin@threadlinehq.io. Open evidence items do not reduce Threadline's obligations in this DPA or create a claim that all supplier checks are complete.