Privacy policy

Thinqit B.V., established at Vanadiumweg 25, 3812PX Amersfoort, The Netherlands (KVK 99883813), is the data controller for the personal data described in this policy in relation to the public thinQit service and direct customer accounts.

Where you use thinQit through a partner workspace (whitelabel) or through your employer, that party is the controller and thinQit is the processor — their privacy notice applies in addition to ours, and they decide retention and access.

• Account data: name, email, role, organisation, password hash, MFA setup, sign-in history.
• Workspace content: projects, documents, prompts, AI agent outputs, files, screenshots, and connected-tool metadata you bring into thinQit.
• Billing data: company name, billing address, VAT number, invoice history, plan, credit ledger. Card details live with Stripe — we never see them.
• Operational telemetry: API logs, error reports, audit trails, IP addresses, browser/OS, feature usage. Used for security and debugging.
• Support data: tickets, transcripts, attachments you share with us when asking for help.

We rely on the following GDPR legal bases:

• Contract performance (art. 6(1)(b)): operating your workspace, running AI agents, billing, support.
• Legitimate interest (art. 6(1)(f)): security, abuse prevention, product analytics on aggregated usage, fraud detection.
• Legal obligation (art. 6(1)(c)): tax, AML, statutory retention of invoices.
• Consent (art. 6(1)(a)): non-essential cookies and optional marketing emails. You can withdraw consent at any time.

Prompts and outputs you send to thinQit AI agents are processed to produce a response, log the run for auditability, and improve the agent for your workspace only.

We do not use customer prompts or outputs to train general-purpose AI models, ours or anyone else's. Where a sub-processor (e.g. OpenAI, Anthropic, Microsoft Azure) is involved, they operate on a strict zero-retention API contract — see §5.

We use a small set of EU-friendly sub-processors:

• Microsoft Azure (EU regions) — primary infrastructure, databases, file storage.
• OpenAI — model inference under the zero-retention API agreement; data is not used for training.
• Anthropic — same arrangement as OpenAI.
• Stripe — payment processing; PCI-DSS compliant.
• Resend / Postmark — transactional email.

The current and complete list is available on request via privacy@thinqit.io. Material changes to sub-processors are announced 30 days before they take effect.

Personal data is stored in the EU by default. Some sub-processors may process data outside the EU. In that case we rely on the European Commission's Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

• Account & workspace data: kept while your account is active. After account closure, we delete or anonymise within 90 days unless a legal hold applies.
• Invoices & tax records: 7 years (Dutch law).
• Audit logs: 18 months by default, configurable up to 7 years on Enterprise plans.
• Support tickets: 24 months from last activity.

TLS 1.3 in transit, AES-256 at rest, automatic key rotation, MFA available on every account, role-based access, immutable audit logs, annual third-party penetration testing, public bug bounty. Full controls are documented in our Security overview.

You have the right to:

• access the personal data we hold about you (GDPR art. 15);
• rectify inaccurate data (art. 16);
• erase data we are not legally required to keep (art. 17);
• restrict or object to certain processing (art. 18 / 21);
• portability — receive your data in a structured format (art. 20);
• withdraw consent for any consent-based processing at any time;
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Email privacy@thinqit.io from the address tied to your account. We respond within 30 days.

We use a minimal set of essential cookies for sign-in and session security, plus optional analytics cookies you can decline. Full inventory and controls live in our Cookie statement.

We update this notice when our processing or sub-processors change materially. We'll surface the new version in the product and email account admins at least 30 days before it takes effect.