Privacy Policy

1. Who we are

Thread is a marketing analytics platform for agencies, operated by Thread Analytics Pty Ltd, based in Sydney, Australia. For the purposes of data protection law, Thread is the controller of the personal information described in this policy, except where we act as a processor on behalf of our customers (see section 3).

If you have any questions about this policy or your personal information, contact us at support@thread.cx.

2. Information we collect

2.1 Information you provide

• Account information such as your name, work email, agency name and password (stored only as a secure hash).
• Billing information needed to manage a paid subscription. Card details are handled by our payment processor and are not stored on our servers.
• Communications you send us, for example through our contact form, support requests or email.

2.2 Information from connected advertising platforms

When you connect an advertising account, you authorise Thread to read data from that platform on your behalf using secure OAuth. We retrieve advertising performance data such as campaigns, spend, impressions, clicks, conversions and related metrics from Google Ads, Google Search Console, Meta Ads, LinkedIn Ads and TikTok Ads. We store the access tokens needed to keep this data in sync, in encrypted form. This access is read-only.

2.3 Information collected automatically

• Usage data about how you interact with the platform, such as features used, pages viewed and actions taken.
• Device and log data such as IP address, browser type, device information and timestamps.
• Cookies and similar technologies used to keep you signed in, remember preferences and understand product usage. See our Cookie Policy for details.

3. ThreadID and customer websites

ThreadID is a first-party analytics pixel that our customers can install on their own websites to measure conversions and build audiences without third-party cookies. When ThreadID runs on a customer's site, it may collect information such as page views, clicks, form submissions, device and browser details and IP address.

For data collected through ThreadID on a customer's website, that customer is the controller and Thread acts as a processor, handling the data on the customer's instructions. If you are a visitor to a site using ThreadID and want to exercise your rights, please contact the operator of that website. We will support our customers in responding to such requests.

4. How we use information

We use personal information to:

• Provide, operate and maintain the Thread platform, including syncing your advertising data and generating dashboards and reports.
• Authenticate users, secure accounts and prevent fraud or abuse.
• Process payments and manage subscriptions.
• Provide customer support and respond to your enquiries.
• Improve and develop our products, including AI-powered insights generated from your connected data.
• Send service communications and, where permitted, relevant product updates. You can opt out of marketing messages at any time.
• Comply with legal obligations and enforce our terms.

We use the data we access from your Google account only to provide the features you connect it for, namely to display your own advertising and search performance inside your dashboards and reports. We do not sell this data and we do not use it for advertising.

5. Legal bases for processing

Where the EU or UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the service you sign up for); our legitimate interests (to secure, support and improve the platform, balanced against your rights); your consent (for certain cookies and marketing, which you can withdraw); and compliance with legal obligations. Where Australian privacy law applies, we handle personal information in accordance with the Australian Privacy Principles.

6. How we share information

We do not sell your personal information. We share it only as needed to run the service:

• Service providers (sub-processors) who host our infrastructure, store data, process payments and deliver email on our behalf, under contracts that require them to protect your data.
• Connected advertising platforms that you authorise, in order to retrieve your data.
• Your own team and clients as you configure within the platform, including white-label dashboards and reports you choose to share.
• Legal and safety disclosures where required by law, or to protect the rights, safety and security of Thread, our users or the public.
• Business transfers in connection with a merger, acquisition or sale of assets, subject to this policy.

7. Meta Platform data

Where you connect a Meta (Facebook or Instagram) account, our use of Meta data is governed by Meta's Platform Terms. Our access is read-only. You can revoke Thread's access at any time through your Facebook settings under "Apps and Websites". Following revocation or a deletion request, we will delete your Meta-related data within 30 days.

8. Data retention

We keep personal information for as long as your account is active and as needed to provide the service. After your account is closed, we delete or anonymise personal information within a reasonable period, except where we are required to retain it to meet legal, accounting or security obligations. Connected-platform metrics are retained according to your plan's data-history limits.

9. Security

We use technical and organisational measures to protect personal information, including encryption of OAuth tokens, encrypted connections, access controls and monitoring. No method of transmission or storage is completely secure, but we work to protect your information and to address any incident promptly.

10. International transfers

Thread is based in Australia and may process and store information in Australia and in other countries where our service providers operate. Where we transfer personal information across borders, we take steps to ensure it is protected in line with this policy and applicable law, including using appropriate safeguards such as standard contractual clauses where required.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the European Economic Area and the UK have rights under the GDPR; residents of California have rights under the CCPA/CPRA, including the right to know, delete and opt out of "sale" or "sharing" (note that we do not sell personal information). To exercise any right, email support@thread.cx. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority, or in Australia with the Office of the Australian Information Commissioner.

12. Children

Thread is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email or within the service. Continued use of Thread after a change takes effect means you accept the updated policy.

14. Contact us

For privacy questions or requests, contact support@thread.cx or write to us at Thread Analytics Pty Ltd, Sydney, Australia. This policy works alongside our Terms of Service, Terms of Use and Cookie Policy.