At thinQit, your privacy is a priority. This policy explains what personal data we collect, why we collect it, how we use it, and your rights over it. We are committed to transparency and compliance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).
Every section starts with a short “In short” box in simple words. These boxes help you understand the section, but they are not the legal text. The full text below each box is what counts.
1 About This Policy
This page explains what personal data we collect from you and what we do with it. It applies whenever you use thinQit.
This Privacy Policy applies to all personal data processed by thinQit B.V. (“thinQit,” “we,” “us,” or “our”) in connection with your use of the thinQit platform, website, APIs, and related services (collectively, the “Services”).
This policy is incorporated by reference into our Terms of Service. By using our Services, you acknowledge that you have read and understood this Privacy Policy.
If you are using our Services on behalf of a company, you represent that you have authority to bind that company to this policy and that your company has ensured all users under your account have been made aware of their data protection rights.
2 Who We Are
thinQit B.V., a Dutch company, is responsible for your data. Questions? E-mail our privacy team or our Data Protection Officer.
thinQit B.V. is the data controller responsible for your personal data collected through the thinQit platform. We are incorporated under the laws of the Netherlands.
For privacy-related enquiries, contact our Data Protection Officer at:
- Email: dpo@thinqit.com
- General privacy enquiries: privacy@thinqit.com
- Company: thinQit B.V.
Where thinQit processes personal data on behalf of our business customers (Tenants), we act as a data processor under the GDPR, and the Tenant is the data controller. In those cases, our processing is governed by a separate Data Processing Agreement.
3 Information We Collect
We collect what you give us (like your name, e-mail, files, and AI prompts), what your use of the platform creates (like logs), and a little data from partners (like our payment provider).
3.1 Information You Provide to Us
- Account information: Name, email address, company name, password (hashed), and billing information when you register or purchase a Subscription.
- Profile data: Job title, team size, or other information you choose to provide.
- Communications: Messages, feedback, and support requests you send to us.
- User Content: Files, text, data, and other content you upload or submit to the Platform.
- AI interactions: Prompts, instructions, and inputs you provide to AI Teammates and the resulting outputs (Teammate Output).
3.2 Information Collected Automatically
- Usage data: Pages visited, features used, actions taken, session duration, and click patterns within the Platform.
- Device and technical data: IP address, browser type, operating system, device identifiers, screen resolution, and language preferences.
- Log data: Server logs including request timestamps, error logs, and access records.
- Cookies and tracking technologies: As described in Section 9.
- Performance data: Response times, error rates, and other operational metrics used to maintain and improve the Platform.
3.3 Information from Third Parties
- Payment processors: We receive transaction confirmation and billing status from our payment processor (Stripe). We do not store full card numbers.
- Single Sign-On (SSO): If you sign in via a third-party identity provider, we receive your name, email, and authentication token.
- Integrations: If you connect third-party services to the Platform, we may receive data from those services as part of delivering the integration.
4 How We Use Your Information
We use your data to run the platform, keep it safe, bill you, and help you. We do not sell your data, and we do not use it for ads on other websites.
| Purpose | Data Used |
|---|---|
| Providing and operating the Services | Account data, User Content, usage data |
| Authentication and account security | Email, password hash, IP address, device data |
| Billing and payment processing | Name, email, billing details |
| Customer support and communications | Email, support messages, account data |
| Improving and developing the Platform | Anonymised usage data, aggregated AI interaction data |
| AI model training and improvement | Anonymised, aggregated Teammate Output (not identifiable) |
| Security monitoring and fraud prevention | IP address, log data, usage patterns |
| Compliance with legal obligations | Account data, transaction records as required |
| Sending product updates and notices | Email address (you can opt out of marketing) |
| Analysing Platform performance | Technical data, log data |
We do not sell your personal data to third parties, and we do not use your personal data for targeted advertising on other platforms.
5 Legal Basis for Processing (GDPR)
The law (GDPR) says we need a good reason to use your data. Our reasons: to do what our contract with you says, to keep the platform safe, to follow the law, or because you said yes.
Where the GDPR applies, we rely on the following legal bases to process your personal data:
- Contract (Art. 6(1)(b)): Processing necessary to provide the Services you have subscribed to, including account management, billing, and delivery of Platform features.
- Legitimate interests (Art. 6(1)(f)): Processing for security monitoring, fraud prevention, improving the Platform, internal analytics, and communicating relevant product updates, where these interests are not overridden by your rights.
- Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, including tax obligations, record-keeping requirements, and responses to lawful requests from authorities.
- Consent (Art. 6(1)(a)): Where we rely on consent (e.g., for optional marketing communications or certain cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
Where we process special categories of personal data (such as health data), we rely on explicit consent or another applicable legal basis under Art. 9 GDPR.
6 Information Sharing & Disclosure
We never sell your data. We share it with companies that help us run thinQit (like Microsoft, Stripe, and AI providers), and when the law makes us. If our company is ever sold or merged, your data can move to the new owner — we will tell you first.
We do not sell your personal data. We may share your information only in the following circumstances:
6.1 Service Providers
We share data with trusted third-party vendors who process data on our behalf to help deliver the Services. These include cloud infrastructure providers (Microsoft Azure), payment processors (Stripe), email delivery services, analytics providers, and AI model API providers. All such providers are bound by data processing agreements and are prohibited from using your data for their own purposes.
6.2 AI Model Providers
To power AI Teammates, your prompts and inputs may be transmitted to third-party AI model APIs (such as OpenAI or Anthropic). These providers process your data under their own privacy policies and data processing agreements. We take reasonable steps to minimise data transmitted to AI providers and to ensure appropriate contractual protections are in place.
6.3 Legal Requirements
We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or where we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of thinQit, our users, or the public.
6.4 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the successor entity. We will notify you via email or prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.
6.5 With Your Consent
We may share information with third parties when you have given explicit consent to do so.
7 International Data Transfers
Your data mostly stays in Europe. When it goes outside Europe, for example to AI providers in the United States, we use EU-approved contracts to protect it.
thinQit is based in the Netherlands and primarily processes data within the European Economic Area (EEA). However, some of our service providers — including AI model providers — are based outside the EEA, in particular in the United States.
When we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- Adequacy decisions by the European Commission where applicable;
- Binding corporate rules or other approved transfer mechanisms.
You may request a copy of the transfer safeguards we rely on by contacting dpo@thinqit.com.
8 Data Retention
We keep data only as long as we need it. The table below shows how long. When you delete your account, we delete or anonymise your personal data within 90 days, unless the law says we must keep it longer.
We retain your personal data for as long as necessary to provide the Services and to comply with our legal obligations. Our general retention periods are:
| Data Category | Retention Period |
|---|---|
| Account information | Duration of account + 3 years after closure |
| Billing and transaction records | 7 years (legal/tax requirement) |
| Usage and log data | 12 months rolling |
| AI interaction logs (identifiable) | 6 months unless extended by user settings |
| Support communications | 3 years from last interaction |
| Security audit logs | 2 years |
| Anonymised/aggregated analytics | Indefinitely (not personal data) |
Upon account deletion, we will delete or anonymise your personal data within 90 days, except where retention is required by law or where data is already anonymised.
9 Cookies & Tracking Technologies
We use cookies to log you in, keep the platform safe, remember your settings, and see how the platform is used. We do not use ad-tracking cookies.
We use cookies and similar technologies to operate the Platform, remember your preferences, and understand how the Services are used.
Types of Cookies We Use
- Strictly necessary cookies: Essential for authentication, session management, security, and core Platform functionality. These cannot be disabled.
- Functional cookies: Remember your preferences and settings (e.g., language, theme) to improve your experience.
- Analytics cookies: Help us understand how users interact with the Platform. Data is aggregated and anonymised where possible.
- Security cookies: Used to detect fraud, abuse, and unauthorised access attempts.
We do not use advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings. Note that disabling non-essential cookies may affect Platform functionality.
We use secure, HttpOnly, SameSite cookies for session management and authentication. Report access cookies for secure report viewing are scoped to specific paths and expire within 8 hours.
10 Security
We protect your data with encryption and strict access rules. No system is 100% safe. If a serious data breach happens, we will tell you.
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction.
Our security measures include:
- Encryption of data in transit using TLS 1.2 or higher;
- Encryption of sensitive data at rest using AES-256;
- Bcrypt password hashing with appropriate cost factors;
- Role-based access controls and multi-tenant data isolation;
- Multi-factor authentication options for user accounts;
- Regular security assessments and vulnerability monitoring;
- Audit logging for significant actions and access events;
- Secure secrets management for API keys and credentials.
Despite our security measures, no system is completely secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.
If you discover a security vulnerability, please report it responsibly to privacy@thinqit.com.
11 Your Rights
You can ask to see, fix, download, or delete your data. E-mail us and we reply within 30 days. You can also complain to the privacy authority in your country.
Depending on your location, you may have certain rights regarding your personal data. Under the GDPR (for EEA/UK residents) and equivalent laws, these include:
- Right of access (Art. 15 GDPR): You can request a copy of the personal data we hold about you.
- Right to rectification (Art. 16 GDPR): You can ask us to correct inaccurate or incomplete data.
- Right to erasure (Art. 17 GDPR): You can request deletion of your personal data where there is no compelling reason for continued processing.
- Right to restriction (Art. 18 GDPR): You can request that we restrict processing of your data in certain circumstances.
- Right to data portability (Art. 20 GDPR): You can request your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21 GDPR): You can object to processing based on legitimate interests or for direct marketing purposes.
- Rights related to automated decision-making (Art. 22 GDPR): You have the right not to be subject to decisions based solely on automated processing that produce significant legal effects, unless you have consented or it is necessary for a contract.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
For California residents (CCPA/CPRA): You have the right to know what personal information we collect, disclose, and sell; to delete your personal information; to opt out of the sale or sharing of personal information (we do not sell personal data); and to non-discrimination for exercising these rights.
To exercise any of these rights, contact us at privacy@thinqit.com. We will respond within 30 days. We may need to verify your identity before processing your request.
You also have the right to lodge a complaint with your local data protection supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl.
12 Children's Privacy
thinQit is for work, not for children. We do not knowingly collect data from anyone under 18.
The thinQit Platform is intended for business and professional use only. It is not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18.
If you believe that we have inadvertently collected personal data from a child under 18, please contact us immediately at privacy@thinqit.com and we will take steps to delete such data promptly.
13 AI & Automated Processing
AI helps run the platform, but no important decision about you is made by a computer alone. We only use anonymous data, which cannot be traced back to you, to make our AI better.
The Platform uses AI and machine learning to power its features. When you interact with AI Teammates, your inputs are processed by AI systems which may involve automated decision-making or content generation.
We do not use AI to make decisions that produce significant legal effects about you as an individual without human oversight. AI-generated outputs are tools to assist your decision-making — they do not constitute binding decisions about you or third parties.
We use anonymised and aggregated interaction data to improve the quality of AI models. We take steps to ensure this data cannot be traced back to individual users before it is used for model improvement.
If you have concerns about how AI processes your data, contact our DPO at dpo@thinqit.com.
14 Third-Party Links & Services
Links to other websites have their own privacy rules. Please check them before you use those websites.
The Platform may contain links to third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through the Platform. thinQit is not responsible for the privacy practices of third-party services.
15 Changes to This Policy
If we change this policy in a big way, we will tell you at least 14 days before the change starts.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to the address on your account and/or by posting a prominent notice on the Platform at least 14 days before the changes take effect.
Your continued use of the Platform after the effective date of the updated policy constitutes your acceptance of the revised policy. The “Effective Date” at the top of this page indicates when the policy was last updated.
16 Contact & DPO
Questions about your data? E-mail privacy@thinqit.com or our Data Protection Officer at dpo@thinqit.com. We aim to reply within 30 days.
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
- General privacy enquiries: privacy@thinqit.com
- Data Protection Officer: dpo@thinqit.com
- Company: thinQit B.V.
We aim to respond to all privacy-related enquiries within 30 days. For complex requests, we may extend this period by an additional 60 days and will inform you accordingly.