Privacy Policy

The short version

If you read nothing else, read this. Everything below says the same thing in more detail.

• We collect your email, the website URL you submit, the search configuration you approve, the public thread data a run retrieves, payment metadata from our processor, and basic technical logs such as your IP address. The full list, with reasons, is below.
• We read public content only. We never ask for your Reddit, Quora or LinkedIn account, and there is no place in the product to connect one.
• ThreadSpot has no write access to any platform. It cannot post, comment, vote or send a message. You post from your own account, in your own words.
• We do not sell your data and we do not share it for advertising. If the business is ever sold or reorganised, customer data may pass to the buyer as part of that. We would email account holders before it happened, and the buyer would be bound by this policy until we told you otherwise.
• You can ask us to show you your data, correct it, or delete it. Write to privacy@threadspot.in. We will delete everything we are allowed to delete. Two things we cannot erase on the day you ask: payment and tax records, which Indian law requires us to keep for a set period, and encrypted backups, which are overwritten on their own cycle. Both are explained in the retention section below.

Who is responsible for your data

ThreadSpot is operated by [REGISTERED ENTITY NAME], a company registered in India at [REGISTERED ADDRESS].

Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) we are the Data Fiduciary for your personal data and you are the Data Principal. Where the GDPR or the UK GDPR applies to our processing of your personal data, we act as the data controller and the rights set out in the section for EU and UK users apply to you.

For anything on this page, write to privacy@threadspot.in. A person reads that inbox.

What we collect and why

We only collect what a run needs. Here is the full list, with the reason next to it.

• Your account email. Used to sign you in, send you your run results, and contact you about billing or a problem with a run. This is the only identifier you give us directly. We also log an IP address automatically, as described in the technical logs bullet below.
• The website URL you submit. ThreadSpot reads the public pages of that site to understand what you sell and who you sell to. It is the input the whole run is built on.
• The search configuration you approve. Your keywords, search queries, target communities, exclusion rules and relevance threshold. We keep this so your next run does not start from nothing and so you can see why a thread was surfaced.
• The public thread data a run retrieves. Thread titles, URLs, visible post and comment text, and public metadata such as the community name and post age, plus the relevance score we assign and the draft reply we write.
• Payment metadata from our payment processor. The amount, currency, date, status, and the last four digits and card brand the processor returns to us. The card form is provided by our payment processor. Your card number, expiry and CVV are submitted to the processor, not to ThreadSpot, and we do not store them. [CONFIRM THE CHECKOUT USES THE PROCESSOR HOSTED OR TOKENISED CARD FORM BEFORE PUBLISHING THIS]
• Basic technical logs. IP address, browser type and timestamps, kept so we can debug failures, stop abuse, and keep the service up.

What we do not collect

This is as important as the list above, because most tools in this category ask for more.

• Your Reddit, Quora or LinkedIn login. We never ask for it. There is no OAuth connection to any of those platforms in the product, and no place to enter one.
• Your card number. Our payment processor handles the card form. We receive only the metadata described above.
• Private messages, private groups, closed communities, paywalled content, or anything else a platform does not make publicly visible. Our sources serve public content only, as described in the next section.
• Location beyond what an IP address roughly implies, or contact lists. We do not buy personal data from data brokers or marketing data vendors. The only outside data sources we use are the ones that serve public thread content, described in the next section.
• Sensitive categories of personal data. We have no reason to collect health, financial, biometric, religious or political data, and we do not ask for any of it.

How ThreadSpot reads public threads

ThreadSpot searches Reddit, Quora and LinkedIn for public discussions that our scoring judges to be relevant to your website and your search configuration.

ThreadSpot reads public content only. Depending on the platform, that content reaches us through public pages, public search results, or a platform API or licensed data provider that serves public content. We do not log into any platform as you, and we do not read private messages, private groups, closed communities, paywalled content, or anything else a platform does not make publicly visible. [CONFIRM HOW LINKEDIN PUBLIC CONTENT IS OBTAINED AND NAME THE SOURCE]

Threads are written by other people. When we retrieve a thread we necessarily retrieve whatever its author chose to publish, including their public username. We use that content for one purpose only: to score the thread for relevance to you and to draft a reply you might post. We do not build profiles of thread authors and we do not enrich their usernames with data from anywhere else. We do not sell thread data and we do not share it for advertising. Apart from our hosting provider, which stores our database, the only third party we send this content to is the AI provider that helps us score threads and write drafts, described in the sections below.

If you are a thread author and you want content about you removed from our systems, write to privacy@threadspot.in with the thread URL. We will delete the copy we hold from our live systems and stop surfacing that thread, and any copy sitting in an encrypted backup is overwritten on the normal backup cycle. We may need to ask you something that shows you are the author. We cannot recall copies already delivered to a customer, and we cannot remove the thread from the platform it was posted on.

Nothing is ever posted for you

ThreadSpot has no write access to any platform. Not restricted access, not read only for now. We hold no account credentials that would let us act as you or post anywhere, and where a platform API is involved our access is read only. There is no code path in the product that publishes anything to Reddit, Quora, LinkedIn or anywhere else.

A draft reply is text on your screen. You read it, edit it, and post it yourself from your own account, or you decide the thread is not worth replying to and skip it. Everything you post is yours, written by you, under your name, and subject to that platform's rules like any other post.

How AI is used

We use a third party large language model provider to help score threads and write draft replies. We do not send your email address or your payment details. What we do send is the public thread text, a description of your website, and your search configuration. Your website is public already, and public thread text can contain the usernames its authors chose to publish.

We use a commercial agreement with our AI provider rather than a consumer account. Under the terms we have agreed, the content we send is not used to train their models. If we change provider, or if that term changes, we will update this page and email account holders as soon as we know.

The draft is a starting point, not an oracle. Read it before you post it.

Who else sees your data

We share data with a small number of service providers, only to run the service, and only with the minimum each one needs. We do not sell data and we do not share it for advertising.

• Payment processing: [PAYMENT PROCESSOR NAME]. Receives your payment details directly from you and returns transaction metadata to us.
• Email delivery: [EMAIL PROVIDER NAME]. Receives your email address so we can send run results, receipts and account mail.
• Hosting and storage: [HOSTING PROVIDER NAME]. Stores the application and database in [HOSTING REGION], which includes your account record, your run records and the thread content we hold.
• AI drafting: [LLM PROVIDER NAME]. Receives public thread text, a description of your website and your search configuration, as described above.
• Public thread sources. The platforms and any licensed data provider we use to retrieve public thread content receive the search queries a run needs to make, as described in the section on how ThreadSpot reads public threads.
• Business transfer. If the business is sold or reorganised, customer data may pass to the buyer as part of that. We would email account holders before it happened, and the buyer would be bound by this policy until we told you otherwise.
• Legal requirements. If a valid legal order requires us to disclose something, we will comply, and we will tell you unless we are legally forbidden from doing so.

How long we keep things

Longer than needed is a liability for us too, so we do not do it. If you want something gone sooner, ask and we will delete what we are allowed to delete.

• Account email and account record: for as long as your account exists, then deleted from our live systems within 30 days of you closing it. Encrypted backups are kept on a rolling cycle of [BACKUP RETENTION PERIOD, CONFIRM] and are overwritten in the normal course. We do not restore a closed account from a backup.
• Your run record, meaning the threads we surfaced, the scores, the links and the drafts: kept while your account is active so you can return to past runs, then deleted from our live systems within 30 days of account closure. You can delete an individual site and its runs from inside the product at any time. [CONFIRM SELF SERVE DELETION OF A SITE AND ITS RUNS EXISTS IN THE PRODUCT] Anything you have already downloaded or copied out of the product stays with you.
• The wider cache of retrieved public thread text that we hold outside your run record: deleted after [THREAD DATA RETENTION PERIOD, CONFIRM].
• Payment records: retained for [STATUTORY RECORD RETENTION PERIOD, CONFIRM WITH ACCOUNTANT] because Indian tax and accounting law requires us to keep transaction records. We cannot delete these on request, even if you close your account.
• Technical logs: [LOG RETENTION PERIOD, CONFIRM] days, then overwritten.

Cookies

We keep this simple. ThreadSpot sets a cookie to keep you logged in and a cookie to remember basic preferences. Those are strictly necessary for the site to work and you cannot turn them off while using an account.

For analytics we use [ANALYTICS TOOL NAME OR THE WORD NONE]. Where we use an analytics tool, it counts page views and tells us which pages are useful. We do not run advertising cookies, we do not run cross site trackers, and we do not share any of this with ad networks.

Your browser lets you block or delete cookies. If you block the login cookie, you will not be able to stay signed in.

Where your data is stored and sent

Our infrastructure is hosted in [HOSTING REGION]. Some of our service providers process data outside India, including in the United States.

Where the GDPR or UK GDPR applies and we transfer personal data outside the EEA or the UK, we rely on the European Commission Standard Contractual Clauses or the UK International Data Transfer Addendum with the relevant provider, together with any additional measures those clauses require. [CONFIRM SCC OR UK ADDENDUM IS IN PLACE WITH EVERY NAMED PROVIDER BEFORE PUBLISHING]

The DPDP Act permits transfers outside India unless the government notifies a country as restricted. If a country we rely on is notified, we will move that processing or stop using the provider, and we will update this page.

Your rights under the DPDP Act

If you are in India, the DPDP Act gives you the following rights. Write to privacy@threadspot.in to use any of them. Put the word DELETION in the subject line if that is what you want and we will treat it as a formal request.

• The right to know what personal data we hold about you and who we have shared it with.
• The right to have inaccurate or incomplete data corrected, updated or completed.
• The right to have your data erased once it is no longer needed for the purpose you gave it for, subject to the legal record keeping and the backup cycle described above.
• The right to withdraw the consent you gave, at any time, as easily as you gave it. Withdrawing consent does not undo processing that already happened.
• The right to nominate another person to exercise these rights on your behalf if you die or become unable to act.
• The right to a grievance process, described in the next section.

How we handle complaints

Our Grievance Officer under the DPDP Act is [GRIEVANCE OFFICER NAME], reachable at privacy@threadspot.in or by post at [REGISTERED ADDRESS].

We aim to acknowledge every request within 7 days and to complete it within 30 days. If a request is complex and will take longer, we will tell you why, and when to expect it, before the 30 days are up.

If you are not satisfied with how we handled your complaint, you can escalate it to the Data Protection Board of India once it is accepting complaints under the DPDP Act, and we will give you the current details on request. We would rather you raised it with us first.

If you are in the EU or UK

Where the GDPR or the UK GDPR applies to our processing of your personal data, you have the rights to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Use the same address: privacy@threadspot.in.

Our legal bases are straightforward. We process your account email, website URL and search configuration to perform the contract you entered when you paid for a run or took out a plan. We process technical logs and security data under our legitimate interest in keeping the service working and free of abuse. Where we rely on consent, such as marketing email, you can withdraw it at any time and we make the unsubscribe link work.

You also have the right to complain to your local supervisory authority, or to the Information Commissioner's Office in the UK. Again, we would rather you told us first.

Security

Traffic to ThreadSpot is encrypted in transit using TLS. Our database and file storage are encrypted at rest by our hosting provider. [CONFIRM AT REST ENCRYPTION IS ENABLED ON THE DATABASE, FILE STORAGE AND BACKUPS BEFORE PUBLISHING]

Access to production data is limited to the people who need it to operate the service, and that is a small number of people at [REGISTERED ENTITY NAME].

No system is perfect and we will not pretend otherwise. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires, and we will tell you what happened, what we did, and what you should do.

Children

ThreadSpot is a business tool and is not for anyone under 18. We do not knowingly collect data from children. Under the DPDP Act, processing a child's data requires verifiable parental consent, and rather than build that we simply do not serve children. If you believe a child has created an account, tell us at privacy@threadspot.in and we will delete it.

Changes to this policy

If we change how we handle your data in a way that matters, we will update this page and email account holders. Where the change is ours to schedule, we will do that before it takes effect. Where it is forced on us by a provider at short notice, we will tell you as soon as we know. Small corrections, such as fixing a typo or naming a provider more precisely, will just appear here with a new date at the top.

This policy is effective from [EFFECTIVE DATE].