Privacy Policy

We collect only what the service needs to work:

• Account information. Your email address and name, received from Google when you sign in.
• Gmail OAuth tokens. When you connect Gmail, Google issues tokens that let Threadline act on the permissions you granted. We never ask for or store your Google password. Tokens are encrypted at rest (AES-256-GCM).
• Lead data you upload. The contents of the CSV files you import, such as names, email addresses, job titles, company names and URLs, notes, and LinkedIn URLs (stored as a reference only — LinkedIn is never scraped).
• Public company research. Information about your leads' companies gathered from public web sources, together with links to those sources. LinkedIn is never scraped.
• Generated drafts. The research summaries, opportunity analysis, subject line options, draft and final emails and self-review notes produced for each lead, and any changes you make to them.
• Gmail message data. The Gmail message and thread IDs of emails sent through Threadline, and the content of replies on threads the app started. We use these to detect replies, out-of-office responses and bounces, and to write relevant follow-ups.
• Campaign settings and activity. Your company profile, playbooks and prompts, campaign settings, suppression list, and an audit log of generated messages, sends, replies and bounces.

We use the information above only to provide and secure the service you asked for:

• to sign you in and keep your account secure;
• to research leads, generate drafts and show you the notes behind them;
• to send the emails you have set up, from your Gmail account, on your schedule;
• to detect replies, out-of-office responses and bounces so sequences stop or pause correctly, and to give follow-ups the context of the earlier thread;
• to enforce daily limits, prevent duplicate sends and maintain the audit log;
• to respond to your support requests.

Drafts are written by Anthropic's Claude models. To generate an email, we send Anthropic's API the relevant lead context: the lead's details from your spreadsheet, public information about their company, your company profile and playbook and, for follow-ups, the content of the earlier messages in that thread — including replies where relevant.

This data is sent solely to generate drafts for you. It is not used by Threadline to train generalized AI models. Anthropic processes it under its own commercial terms and privacy commitments.

Threadline's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Google user data:

• is used only to provide and improve the user-facing features described here;
• is not used to train generalized AI or machine-learning models;
• is not sold;
• is not used for advertising, including retargeting or personalized ads;
• is transferred to third parties only as necessary to provide the service (for example, to Anthropic to generate drafts, and to our hosting providers), to comply with the law, or as part of a merger or acquisition with notice to you;
• is not read by humans except with your explicit consent (for example, to investigate a support request), where necessary for security, to comply with the law, or when the data has been aggregated and anonymized for internal operations.

We do not sell your personal information. We share it only with:

• Google, to authenticate you and to send and read email through the Gmail API with the permissions you granted;
• Anthropic, to generate drafts, as described above;
• Infrastructure providers that host and operate the service on our behalf, under confidentiality and security obligations;
• authorities, where we are legally required to.

OAuth tokens are encrypted at rest with AES-256-GCM. Daily sending caps are enforced on our servers, sending is designed so the same email is never sent twice to a lead, and an append-only audit log records the service's actions. No method of storage or transmission is perfectly secure, but we work to protect your data using industry-standard measures. See our Security page for more.

We keep your data while your account is active so the service can work — for example, so that previously-replied and suppressed contacts are never emailed again.

You can ask us to delete your account and associated data at any time by emailing support@example.com from the address you sign in with. You can also revoke Threadline's access to your Google account at any time from your Google Account's security settings; once revoked, we can no longer send or read email on your behalf.

When you upload information about other people, you are responsible for having a lawful basis to process it and to contact them, and for complying with applicable anti-spam and privacy laws (such as CAN-SPAM and GDPR). If someone asks you to stop contacting them, add them to your suppression list. If a lead asks us about their data, we may refer them to you.

Depending on where you live, you may have rights to access, correct, export or delete your personal information, or to object to certain processing. To exercise any of these rights, contact support@example.com.

Threadline is a business tool and is not intended for anyone under 16.

We may update this policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you by email.

Questions about this policy or your data? Email support@example.com.