thrivePrivacy Policy
Last updated: November 5, 2026
Thrive is a workspace for independent service businesses. This policy explains what we collect, why, and the choices you have. “We” means Lucas Didier, Rua do Giestal 18, 1300-276 Lisboa, Portugal, the controller of your account data. Contact us at hello@runonthrive.com.
Two kinds of data
Your account data. Who you are as a Thrive user. We’re the controller for this data.
Your workspace data. The clients, projects, documents, invoices, time entries, forms, emails and meetings you put into Thrive or connect to it. You decide what goes in and why. For this data you’re the controller and we’re your processor: we only use it to run Thrive for you.
What we collect
- Account: your name, email address and profile picture from Google when you sign in, plus the date you joined.
- Beta requests: the name, business, email and description you send us when you request access.
- Workspace content: everything you create in Thrive, including information about your clients.
- Connected accounts: if you connect your email or calendar, we read and send messages and events through Nylas on your behalf, and store the conversations and events you link to your work.
- Your clients’ responses: when a client opens a shared link, submits a form, accepts a proposal or signs a contract, we record what they submitted, their name, the time and the document version.
- Technical data: IP address, browser and error logs, used to keep the service secure and working. Logs are kept for up to 30 days.
We don’t sell your data, show ads, or use your workspace content to train AI models.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing your account and workspace | Contract |
| Sending notifications and summary emails you’ve turned on | Contract |
| Reviewing beta requests and inviting you | Steps before a contract, at your request |
| Security, abuse prevention, backups and fixing errors | Legitimate interests |
| Meeting legal obligations | Legal obligation |
Who helps us run Thrive
We use these service providers (subprocessors). Each one only gets what it needs to do its job.
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting, network, backups | Global |
| Supabase | Database, sign-in and file storage | EU (Frankfurt, Germany) |
| Sign-in with Google | Global | |
| Nylas | Email and calendar connections you choose to make | EU |
| Resend | Sending Thrive’s notification emails | EU (Ireland) |
When data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
How long we keep it
We keep your account and workspace data while your account is open. If you delete your account, we delete your workspace within 30 days, and it ages out of backups within a further 30 days. Beta requests we don’t act on are deleted after 12 months. We keep invoice records longer only if the law requires it.
Your rights
You can ask us to access, correct, export or delete your data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email hello@runonthrive.com and we’ll answer within 30 days. You can also complain to your local data protection authority.
If you’re one of our users’ clients, contact the business that shared Thrive with you first. They control that data, and we’ll help them respond.
Security
Data is encrypted in transit and at rest. Workspaces are isolated per account, provider tokens are encrypted, and access is limited to what’s needed to run the service. No system is perfectly secure; if a breach affects you, we’ll tell you without undue delay.
Google user data
Thrive uses Google only to sign you in. We receive your name, email address and profile picture, and use them only to identify your account. Thrive’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies
We use only the cookies needed to keep you signed in. We don’t use analytics or advertising cookies.
Changes
If we make important changes, we’ll email you before they take effect. The date at the top shows the latest version.