This Privacy Policy is issued by ThriveStack Corporation. It sets out how ThriveStack processes personal data in connection with its websites and the ThriveStack citedby and ThriveStack Revenue Intelligence services, and the rights available to data subjects under the EU General Data Protection Regulation (“GDPR”).
Who is the controller, and what does this Privacy Policy cover?
1.1 Controller. This Privacy Policy is issued by ThriveStack Corporation (“ThriveStack”, “we” or “us”), 2747 204th LN NE, Sammamish, WA, USA. Except as provided in Section 5, ThriveStack is the controller of the personal data described in this Privacy Policy within the meaning of Article 4(7) GDPR.
1.2 Scope. This Privacy Policy applies to the processing of personal data (a) when you visit our websites; (b) when you register for or use the Services; (c) when you communicate with us, subscribe to our mailings or schedule a meeting; (d) when you make a payment to us; and (e) in our internal operations. For each category, we state the personal data processed, the purpose, the legal basis under Article 6 GDPR, the recipients and the retention period.
1.3 Definitions. In this Privacy Policy:
- “Services” means ThriveStack citedby and ThriveStack Revenue Intelligence, each as described in Section 2;
- “Customer” means a legal entity that has entered into an agreement with ThriveStack for the Services;
- “Customer Data” means data submitted to the Services by or on behalf of a Customer, including data transferred from Connected Systems;
- “Connected Systems” means third-party systems that a Customer connects to the Services, including customer relationship management (“CRM”) systems, billing systems, analytics tools and similar systems; and
- “personal data” has the meaning given in Article 4(1) GDPR.
1.4 Applicable law. We process personal data in accordance with the GDPR where it applies to the processing.
What are ThriveStack citedby and ThriveStack Revenue Intelligence?
2.1 ThriveStack citedby. ThriveStack citedby is a software-as-a-service offering that monitors and analyzes how a brand appears and is cited in responses generated by artificial intelligence engines, and provides related reports and recommendations.
2.2 ThriveStack Revenue Intelligence. ThriveStack Revenue Intelligence is a software-as-a-service offering that combines Customer Data from CRM, billing, marketing website and software product usage sources to analyze pipeline, conversion, retention and expansion.
2.3 Different data. The Services process different categories of personal data. Section 4 sets out the processing for ThriveStack citedby. Section 5 sets out the processing for ThriveStack Revenue Intelligence.
How do we process personal data of website visitors?
3.1 Purpose. We process personal data of visitors to our websites to deliver, secure and operate the websites and, subject to consent, to analyze website use and measure the performance of our marketing.
3.2 Personal data processed. Internet Protocol (“IP”) address, browser type and version, operating system, device identifiers, referring address, pages viewed, date and time of access, and cookie or similar identifiers.
3.3 Legal basis. The processing of connection data necessary to deliver and secure the websites is based on our legitimate interests under Article 6(1)(f) GDPR. The processing of personal data through cookies and similar technologies that are not strictly necessary is based on your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
3.4 Cookies and similar technologies. Essential cookies are used to operate and secure the websites and do not require consent. Analytics and advertising cookies, pixels and scripts are set only after you consent through the cookie banner. Emails we send may contain tracking pixels or unique links that record whether an email was opened or a link was selected.
3.5 Recipients. Hosting, analytics, advertising and tag management providers, each acting as a processor on our behalf (see Section 9).
3.6 Retention. Server and security logs are retained for a limited period necessary for security purposes. Analytics data is retained for the period configured in the relevant analytics tool and not longer than necessary for the purposes stated in Section 3.1.
What personal data do we process when you use ThriveStack citedby?
4.1 Purpose. We process personal data in connection with ThriveStack citedby to create and administer user accounts, authenticate users, provide monitoring, reports and recommendations, provide support, ensure security, and maintain and improve the Services.
4.2 Personal data processed.
- Account data: name, work email address, company name, role, and authentication credentials and identifiers;
- Brand domain: the brand domain you enter into the Services, for example acmecorp.com;
- AI engine output data: responses, citations, sources and rankings that ThriveStack collects by submitting queries to third-party AI engines in relation to your brand domain. This data does not ordinarily relate to users of the Services. It may incidentally include personal data of third parties named in an AI engine’s response;
- Connected data (optional): data that you elect to provide by connecting a tool such as Google Search Console or by supplying server logs; and
- Usage data: actions taken in the Services, feature use, error logs, IP address, and browser and device information.
4.3 Legal basis. Processing of account data and the provision of the Services is based on the performance of a contract under Article 6(1)(b) GDPR. Processing for security, usage analytics and improvement of the Services is based on our legitimate interests under Article 6(1)(f) GDPR. Where consent is required, processing is based on Article 6(1)(a) GDPR.
4.4 Recipients. Processors engaged under Section 9.
4.5 Retention. Account and workspace data is retained for the duration of the account. Following termination, ThriveStack shall delete or de-identify it within a reasonable period, ordinarily within ninety (90) days, except where applicable law requires longer retention.
What personal data do we process when you use ThriveStack Revenue Intelligence?
5.1 Roles of the parties. With respect to Customer Data, the Customer is the controller (or, where the Customer acts on behalf of its own customers, a processor) and ThriveStack is a processor within the meaning of Article 28 GDPR. ThriveStack shall process Customer Data only on the Customer’s documented instructions as set out in the agreement between the parties and any data processing agreement (“DPA”). With respect to account data of the Customer’s authorized users, ThriveStack acts as controller in accordance with Sections 4.1 to 4.5, which apply accordingly.
5.2 Categories of Customer Data.
- CRM data: contact, account, lead and opportunity records, including names, work contact details, company, role, deal stage, record owner and activity history, transferred from the Customer’s CRM;
- Billing data: subscription, plan, invoice, payment status and revenue data transferred from the Customer’s billing systems. Customers shall not transfer full payment card numbers;
- Marketing website visitor data: page views, referrers, campaign parameters, IP address, device and browser data, cookie identifiers and form submissions collected through a tracking script installed by the Customer on its website; and
- Product usage data: events and feature usage of the users of the Customer’s software, associated with user identifiers and account identifiers, each in globally unique identifier (“GUID”) format. Email addresses are optional and are processed only where the Customer elects to transmit them.
5.3 Data subjects. The Customer’s contacts, leads, prospects and customers, visitors to the Customer’s websites, and users of the Customer’s software.
5.4 Purpose. ThriveStack shall process Customer Data solely to provide the Services to the Customer, including to analyze the Customer’s funnel, attribution, conversion, retention and expansion, to generate reports, and to provide support, and as otherwise instructed by the Customer.
5.5 Responsibilities of the Customer. The Customer is responsible for (a) providing the notices required by law to the data subjects whose data it transmits to ThriveStack; (b) establishing a valid legal basis for the transmission and processing of Customer Data, including obtaining any consent required under applicable law before installing a tracking script or collecting product usage data; (c) limiting Customer Data to what is necessary, and using GUIDs rather than direct identifiers where practicable; and (d) refraining from transmitting special categories of personal data within the meaning of Article 9 GDPR.
5.6 Sub-processors. The Customer authorizes ThriveStack to engage the sub-processors described in Section 9 under written terms that impose data protection obligations no less protective than those in the DPA. ThriveStack remains responsible for their performance. A current list is available on request.
5.7 Data subject requests. If ThriveStack receives a request from a data subject relating to Customer Data, ThriveStack shall refer the data subject to the Customer and shall not respond substantively except as instructed by the Customer or required by law. ThriveStack shall provide the Customer with reasonable assistance in responding to such requests.
5.8 Return and deletion. On termination of the agreement, ThriveStack shall delete or return Customer Data as provided in the agreement, unless applicable law requires retention.
5.9 DPA. A DPA is available on request using the contact details in Section 16. Information about ThriveStack’s security and compliance practices is available in the Trust Center.
How do we process personal data when you communicate with us?
6.1 Purpose. To respond to inquiries, provide support, send newsletters and other marketing communications, schedule and hold meetings, and maintain records of our business relationships.
6.2 Personal data processed. Name, email address, company, job title, the content of your messages, meeting details, and email engagement data (such as opens and clicks).
6.3 Business contact enrichment. We may supplement the business contact data we hold about you, such as job title and company, with information from publicly available and commercial sources.
6.4 Legal basis. Newsletters and other marketing communications that require consent are based on Article 6(1)(a) GDPR. Responding to your inquiries and taking steps at your request before entering into a contract is based on Article 6(1)(b) GDPR. Business contact enrichment, business-to-business communications and the maintenance of our contact records are based on our legitimate interests under Article 6(1)(f) GDPR. You may object at any time in accordance with Section 13.
6.5 Recipients. Email delivery, scheduling, CRM, support and contact enrichment providers, each acting as a processor (see Section 9).
6.6 Retention. Subscription data is retained until you unsubscribe or withdraw consent. Records of inquiries and meetings are retained for as long as necessary to respond and follow up, and thereafter in accordance with Section 11.
How do we process payment and billing data?
7.1 Purpose. To charge fees, issue invoices, administer subscriptions and comply with accounting and tax obligations.
7.2 Personal data processed. Billing name and address, tax or VAT identification number, and invoice and transaction details. Payment card details are collected directly by our payment processor. ThriveStack receives a payment token, the card brand, the expiry date and the last four digits of the card. ThriveStack does not receive or store the full card number.
7.3 Legal basis. Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (compliance with a legal obligation).
7.4 Recipients. Our payment processor and, where applicable, our accounting and tax advisers.
7.5 Retention. Billing and accounting records are retained for the period required by applicable tax and accounting law.
How do we use artificial intelligence and aggregated data?
8.1 Use of AI engines and models. ThriveStack citedby submits queries to third-party AI engines in order to record their responses. The Services also use AI models to generate summaries, recommendations and content outlines. ThriveStack transmits to AI providers only the data necessary to produce the requested result.
8.2 Aggregated and de-identified data. ThriveStack may create aggregated and de-identified data from the use of the Services, such that the data does not identify, and cannot reasonably be used to identify, any individual or Customer. ThriveStack may use such data to maintain and improve the Services, to create benchmarks and to publish research. ThriveStack shall not attempt to re-identify such data.
8.3 No training on identifiable data. ThriveStack does not use identifiable Customer Data to train artificial intelligence models.
8.4 Automated decision-making. ThriveStack does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects or similarly significantly affect them within the meaning of Article 22 GDPR.
Who receives personal data?
9.1 Processors. ThriveStack engages service providers that process personal data on its behalf, in the following categories: cloud hosting and storage; authentication and databases; product analytics; error and performance monitoring; customer support; email delivery; scheduling; CRM and sales tools; payment processing; document signing; and AI model providers.
9.2 Agreements. ThriveStack enters into written agreements with its processors that comply with Article 28 GDPR. Processors may process personal data only on ThriveStack’s instructions.
9.3 Connected Systems. When a Customer connects a Connected System, personal data is exchanged between that system and the Services as directed by the Customer. The Connected System provider is not our processor and its own terms and privacy policy apply to its processing.
9.4 Professional advisers. Lawyers, auditors, accountants and insurers bound by a duty of confidentiality.
9.5 Authorities. Courts, regulators and other public authorities where disclosure is required by applicable law or necessary to establish, exercise or defend legal claims.
9.6 Business transfers. In connection with a merger, acquisition, financing or sale of assets, personal data may be disclosed to the relevant counterparty and transferred to the successor, subject to this Privacy Policy.
9.7 No sale. ThriveStack does not sell personal data.
9.8 List of processors. A current list of processors is available on request using the contact details in Section 16.
Do we transfer personal data to third countries?
10.1 Processing in the United States. ThriveStack is established in the United States. Personal data is processed in the United States and in other countries in which ThriveStack or its processors operate.
10.2 Safeguards. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country that does not benefit from an adequacy decision, ThriveStack relies on appropriate safeguards under Article 46 GDPR, including the standard contractual clauses adopted by the European Commission under Article 46(2)(c) GDPR. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer may instead rely on the European Commission’s adequacy decision.
10.3 Copy of safeguards. You may request a copy of the safeguards using the contact details in Section 16.
How long do we retain personal data?
11.1 General principle. We retain personal data no longer than necessary for the purposes for which it is processed, in accordance with Article 5(1)(e) GDPR.
11.2 Retention periods.
- account and workspace data: for the duration of the account and thereafter as stated in Section 4.5;
- Customer Data: for the term of the agreement and thereafter as stated in Section 5.8;
- billing and accounting records: for the period required by applicable law;
- marketing and sales contact data: until you unsubscribe, withdraw consent or object, or until the data is no longer necessary; and
- logs and backups: for a limited period, after which they are deleted or overwritten in the ordinary course.
11.3 Legal requirements. Where applicable law requires or permits longer retention, including to establish, exercise or defend legal claims, we retain the relevant data for that period and restrict its use.
What security measures do we apply?
12.1 Measures. ThriveStack implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. These include encryption of data in transit and at rest, role-based access controls, secure credential management, logging and periodic review of security practices. Further information is available in our Trust Center.
12.2 Personal data breaches. ThriveStack shall notify the competent supervisory authority and affected persons of a personal data breach where and as required by Articles 33 and 34 GDPR. For Customer Data, ThriveStack shall notify the Customer without undue delay after becoming aware of the breach.
What rights do data subjects have under the GDPR?
13.1 Rights. Subject to the conditions of the GDPR, you have the right:
- to obtain confirmation of whether we process personal data about you and to access that data (Article 15);
- to obtain rectification of inaccurate personal data (Article 16);
- to obtain erasure of personal data (Article 17);
- to obtain restriction of processing (Article 18);
- to receive personal data in a structured, commonly used and machine-readable format and to transmit it to another controller (Article 20);
- to object to processing based on Article 6(1)(f) GDPR, and to processing for direct marketing at any time (Article 21); and
- to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3)).
13.2 Exercising rights. To exercise these rights, contact us using the details in Section 16. We shall respond without undue delay and in any event within one (1) month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two (2) months, in which case we shall inform you within the first month.
13.3 Verification and fees. We may request information necessary to confirm your identity. We do not charge a fee, except where a request is manifestly unfounded or excessive and the GDPR permits a reasonable fee or refusal.
13.4 Customer Data. If your personal data is processed as Customer Data, please direct your request to the relevant Customer, which is the controller of that data (see Section 5.7).
13.5 Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).
Do we process personal data of children?
14.1 The Services and websites are intended for businesses and persons aged sixteen (16) or older and are not directed to children. We do not knowingly collect personal data from children under sixteen (16). If we become aware that we have collected such data, we shall delete it.
How do we notify changes to this Privacy Policy?
15.1 We may amend this Privacy Policy from time to time. We shall notify material changes by email or by a prominent notice on our websites or in the Services before they take effect. The “Last updated” date at the top of this Privacy Policy indicates the date of the current version.
How can you contact us?
16.1 For questions about this Privacy Policy, to exercise your rights, or to request a DPA or a list of processors, contact ThriveStack Corporation, 2747 204th LN NE, Sammamish, WA, USA, or email support@thrivestack.ai.