Privacy policy

Thinqit B.V., established at Vanadiumweg 25, 3812PX Amersfoort, The Netherlands (KVK 99883813), is the data controller for the personal data described in this policy in relation to the public thinQit service and direct customer accounts.

Where you use thinQit through a partner workspace (whitelabel) or through your employer, that party is the controller and thinQit is the processor — their privacy notice applies in addition to ours, and they decide retention and access.

• Account data: name, email, role, organisation, password hash and sign-in history.
• Workspace content: projects, documents, prompts, AI agent outputs, files, screenshots, and connected-tool metadata you bring into thinQit.
• Billing data: company name, billing address, VAT number, invoice history, plan, thinQ ledger. Card details live with Stripe — we never see them.
• Operational telemetry: API logs, error reports, audit trails, IP addresses, browser/OS, feature usage. Used for security and debugging.
• Support data: tickets, transcripts, attachments you share with us when asking for help.

We rely on the following GDPR legal bases:

• Contract performance (art. 6(1)(b)): operating your workspace, running AI agents, billing, support.
• Legitimate interest (art. 6(1)(f)): security, abuse prevention, product analytics on aggregated usage, fraud detection.
• Legal obligation (art. 6(1)(c)): tax, AML, statutory retention of invoices.
• Consent (art. 6(1)(a)): non-essential cookies and optional marketing emails. You can withdraw consent at any time.

Prompts and outputs you send to thinQit AI agents are processed to produce a response, log the run for auditability, and improve the agent for your workspace only.

We do not use customer prompts or outputs to train general-purpose AI models, ours or anyone else's. Where a sub-processor (e.g. OpenAI, Anthropic, Microsoft Azure) is involved, they operate on a strict zero-retention API contract — see §6.

Your reporting teammate, Vera, can read advertising and analytics data from platforms you connect: Google Ads, Google Analytics, Google Search Console, Meta Ads, Microsoft Advertising, TikTok Ads and Daisycon. You connect each platform yourself, with your own login, and you can disconnect it at any time. This section describes how we handle that data, including data received through Google APIs.

Your SEO teammate, Sophia, can read Google Analytics and Google Search Console data for the website she works on, when you connect your Google account in her settings. She uses it to choose article topics from the searches people really make, to measure clicks and impressions before and after each change she makes to your website, and to show how many visits reach your website from AI assistants. She shows these figures in her SEO and GEO tab and her reports.

What we access. From Google we request a separate permission for each product, and only when you connect that product. When you connect Google for Sophia we also request openid and email, so your workspace can show which Google account is connected:

• Google Ads: https://www.googleapis.com/auth/adwords. We use it to read the list of ad accounts your Google account can see and the performance reports of the accounts you pick: campaign, ad group and ad names, and daily aggregates such as spend, impressions, clicks, conversions and cost.
• Google Analytics: https://www.googleapis.com/auth/analytics.readonly. We use it to read the list of Analytics properties your Google account can see and aggregated reports for the property you pick: daily sessions, users, engaged sessions, conversions and revenue, broken down by landing page, page, traffic source, device, country and event name.
• Google Search Console: https://www.googleapis.com/auth/webmasters.readonly. We use it to read the list of sites your Google account can see and the search performance of the site you pick: daily clicks, impressions, click-through rate and average position, broken down by search query, page, country, device and search appearance.

We read aggregated statistics only. We do not access personal data about individual visitors or about the people who saw or clicked your ads, and we never write to, or change anything in, your Google accounts. The other platforms are read the same way, within the permissions they offer.

How we use it. Only to show you reports, dashboards and analyses in your own workspace, to answer the questions you ask Vera about your own results, and for the Sophia features described above: topic choice, before and after measurement of her changes, and AI assistant traffic for your own website. We do not use it for advertising of our own, we do not sell it, and we do not use it to train general-purpose AI models. To write an analysis you asked for, aggregated figures are processed by the AI sub-processors listed in §6 under zero-retention terms; they do not use the data to train their models.

Who we share it with. Nobody outside the sub-processors in §6, who process it on our instructions to run the service. Inside thinQit it is visible only to the members of your workspace. We do not transfer it to data brokers, advertisers or any other third party.

How we protect it. The access token each platform gives us is encrypted at rest with a dedicated key, separately from your other data. Reports are stored encrypted in the EU, protected by role-based access and audit logs, and reached only over TLS. No thinQit employee reads your advertising data, except with your explicit permission to help you with a support request, or where security or the law requires it.

Retention and deletion. We keep the token and the reports while the connection is active. Disconnecting a platform in Vera's or Sophia's Settings deletes the token and the reports we pulled with it straight away; encrypted backups age out within 30 days. You can also revoke thinQit's access in your Google Account under Data & privacy, Third-party apps and services. When you close your account, everything is deleted within 30 days. Step by step instructions are on our Data deletion page.

Limited Use. thinQit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small set of EU-friendly sub-processors:

• Microsoft Azure (EU regions) — primary infrastructure, databases, file storage.
• OpenAI — model inference under the zero-retention API agreement; data is not used for training.
• Anthropic — same arrangement as OpenAI.
• Stripe — payment processing; PCI-DSS compliant.
• Resend / Postmark — transactional email.

The current and complete list is available on request via privacy@thinqit.io. Material changes to sub-processors are announced 30 days before they take effect.

Personal data is stored in the EU by default. Some sub-processors may process data outside the EU. In that case we rely on the European Commission's Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

• Account & workspace data: kept while your account is active. After account closure, we delete or anonymise within 30 days unless a legal hold applies.
• Invoices & tax records: 7 years (Dutch law).
• Audit logs: 18 months by default. We keep them only as long as stated, then delete them.
• Support tickets: 24 months from last activity, so we can handle follow-ups and disputes. When you close your account, we delete them within 30 days unless we need them for an open dispute or legal claim.

HTTPS only with HSTS, AES-256-GCM encryption for stored credentials, passwords hashed with scrypt, role-based access, an audit log of significant actions, and a secret scan and dependency audit before every release. Full controls are documented in our Security overview.

You have the right to:

• access the personal data we hold about you (GDPR art. 15);
• rectify inaccurate data (art. 16);
• erase data we are not legally required to keep (art. 17);
• restrict or object to certain processing (art. 18 / 21);
• portability — receive your data in a structured format (art. 20);
• withdraw consent for any consent-based processing at any time;
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Email privacy@thinqit.io from the address tied to your account. We respond within 30 days.

Step by step instructions for deleting your account, and for removing the data we hold for a connected advertising platform such as Meta Ads or Google Ads, live on our Data deletion page.

We use a minimal set of essential cookies for sign-in and session security, plus optional analytics cookies you can decline. Full inventory and controls live in our Cookie statement.

We update this notice when our processing or sub-processors change materially. We'll surface the new version in the product and email account admins at least 30 days before it takes effect.