Last updated: August 17, 2026
Thoughtfuly is built and operated by Thinking Streams Inc., a Delaware corporation ("Thinking Streams", "we", "us"). Thoughtfuly is currently in Public Preview.
This policy explains what we do with personal data. It covers two different things, because we play two different roles depending on which one you are.
Controller or processor — which applies to you
If you're a visitor to this website, or a lead who filled in a form — we are the controller. We decide what data is collected and why, and this policy is about that.
If you're a user of the Thoughtfuly platform, working with data your company has put into it — we are a processor, acting on your company's instructions. Your company (our customer) is the controller of that data, and its own privacy policy is what governs your relationship with it. Thoughtfuly syncs two-way with your CRM — Microsoft Dynamics 365 is currently the CRM integration we support — and your CRM stays the system of record; we don't become the controller of your CRM data by processing it.
Where something below applies only to one of these roles, it says so.
What we collect on this website (as controller)
Form submissions. When you fill in a form on this site — to book a demo, request pricing, or ask a question — we collect what you type into that form, typically a name, work email, and company details.
Cookies and web tracking. This site runs Thoughtfuly's own web-tracking script, together with Google Tag Manager. Both are gated behind the consent choice you make in the tracking script's built-in consent banner — nothing beyond what's strictly necessary runs until you consent, and third-party tags in Tag Manager stay off until you do. See the next section for exactly what's stored.
Cookies and consent
Thoughtfuly's own tracking sets three first-party cookies, on this domain only. They're readable only by this site, are never shared with other companies, and can't be used to follow you across other websites.
| Cookie | What it holds | Lifetime |
|---|---|---|
_tfy_vk | A random visitor ID. Meaningless on its own. | 13 months |
_tfy_ih | A scrambled, one-way version of your email address — only set once you've identified yourself, e.g. by submitting a form. It can't be reversed back into an email address. | 13 months |
_tfy_c | Whether you granted or denied consent. | 13 months |
If your browser sends a do-not-track signal, we respect it automatically — nothing is set. If you decline consent in the banner, no cookies are set and nothing is tracked.
When you submit a form on this site, only your email address and phone number are captured from it — everything else you type is discarded in your browser. Password fields are never captured, and fields that ask for someone else's contact details (for example, "invite a colleague") are skipped too.
What happens inside the platform (as processor)
Once your company is a Thoughtfuly customer, the platform processes the data your company puts into it — contacts, campaign content, journeys, and the CRM records that sync two-way with your CRM (currently, Microsoft Dynamics 365 is the CRM integration available) — strictly on your company's instructions, for the purpose of running your company's marketing. We don't use this data for our own purposes, and we don't sell it.
Customers who need a Data Processing Agreement covering this platform data can request one using the contact details at the bottom of this page.
Sub-processors
To run Thoughtfuly, we use the following sub-processors. This is the complete list — nobody else touches platform data:
| Sub-processor | Purpose |
|---|---|
| Microsoft Azure | Hosting and infrastructure |
| Twilio | Email and SMS delivery |
| bundle.social | Social publishing |
| Anthropic | AI |
| OpenAI | AI |
Our own personnel and contractors may access platform data where that is necessary to operate, debug and support the product, including from outside the United States. Access is limited to those who need it for that work, and they are bound by confidentiality obligations.
AI and training
Thoughtfuly uses AI models from Anthropic and OpenAI to help generate content — drafts, campaign copy, and similar. We do not train our own models on your data.
How Anthropic and OpenAI handle data submitted to them through Thoughtfuly is governed by their own terms, not by us — we don't control it. You can read their policies directly: Anthropic's privacy policy and OpenAI's privacy policy. This policy doesn't state a specific retention period for either provider, since that's set by them, not us.
International transfers
Thinking Streams Inc. is a US company, and the Microsoft Azure data centres we use to host the platform are in the United States. Customer data is stored there.
For a customer in the EU or EEA, the transfer that matters is EU/EEA → United States. That needs an appropriate safeguard under Chapter V of the GDPR — the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Thoughtfuly is in Public Preview and we are not yet in a position to state which of these applies to your data.
Where our personnel access data from outside the United States, we rely on appropriate safeguards for those transfers.
If you are subject to the GDPR and intend to put EU/EEA personal data into the platform, please contact us first so we can put the appropriate safeguard in place before you do.
Where our sub-processors are located outside the United States, we rely on the data-transfer safeguards each of them offers under their own terms.
How long we keep data
| Data | Retention |
|---|---|
| Customer content (inside the platform) | Life of the account, plus 30–90 days |
| Backups | 30–35 days, rolling |
| Application and audit logs | 90 days |
| Web-tracking cookies | 13 months |
| Marketing leads (website form submissions) | 24 months from your last engagement with us |
| Billing records | 7 years, to meet tax and accounting record-keeping requirements |
A legal hold overrides any of the periods above — if we're required to preserve data for a legal or regulatory reason, deletion is paused until that hold is lifted. When data is deleted, that deletion is propagated to our sub-processors too.
Your rights
Whoever you are, you can ask us what personal data we hold about you, ask us to correct it if it is wrong, and ask us to delete it. We will honour those requests unless the law requires us to keep the data.
Under GDPR, where it applies to you as an EU or EEA data subject, you additionally have the right to restrict or object to processing, the right to data portability, and the right to lodge a complaint with your local supervisory authority.
Under US state privacy laws, where one applies to you, you may also have the right to know what we collect and why, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
To exercise any of these rights, contact us using the details at the bottom of this page. If your data is held by us as a processor — because it's inside a customer's Thoughtfuly account — we'll direct your request to that customer, since they control it.
Children
Thoughtfuly is a business-to-business product. It isn't directed at, and isn't intended for use by, anyone under 16. We don't knowingly collect personal data from children.
Changes to this policy
We'll update this page as the product and our practices change, and update the "Last updated" date above when we do. For material changes, we'll look for a more prominent way to let you know.
Contact us
Questions about this policy, a request to exercise your rights, or a request for a Data Processing Agreement can be sent to privacy@thoughtfuly.ai.
We aim to respond to any request about personal data within 30 days.