Privacy Policy

Thriveific ("Thriveific", "we", "us") helps service businesses send estimates, proposals and invoices to their clients and get paid. Businesses use our web app at thriveific.com and our iOS and Android apps. Their clients receive estimates, contracts and invoices by email and open them in a browser. This policy explains what we collect from each of those groups, why, who we share it with and what choices you have.

If you have a question about this policy or your information, email us at support@thriveific.com.

Who This Policy Covers

• Business accounts: owners and team members who sign up for Thriveific and work in a business's workspace.
• Clients: people a business works with, who receive estimates, documents and invoices from the business and open them through private links to accept, sign and pay.
• Website visitors: anyone who visits our marketing site or contacts us.

If you're a client of a business that uses Thriveific, the business decides what information it keeps about you and why. For that information, the business is in charge of it (the "controller") and Thriveific handles it on the business's behalf (a "processor" or "service provider"). Questions or requests about it, such as asking for a copy or for it to be deleted, should go to the business first. If you contact us, we'll pass your request on to the business or help it respond. For our own account administration, billing, security and website, Thriveific is the controller.

What We Collect

From business accounts

• Account details: your name, email address and password. Your password is stored by Google Firebase Authentication, never in our own database. If you use a third-party sign-in option, such as Google, we receive the details that provider shares, such as your name, email address and profile photo.
• Business details: your workspace's name, address, phone, email, logo, branding, time zone and the settings you choose.
• Your records: clients, estimates, proposals, contracts and other documents, invoices, payments, templates, notes and files you upload or create.
• Team details: the people you invite (their email address and role), who invited them and when they joined.
• Assistant chats: the questions you ask the assistant, its answers, and the names of files you attach, saved so you can return to a chat.
• Billing details: your workspace's plan, its status and the email address on the subscription. Card details are entered directly with our payment processor, Stripe. We never see or store your full card number.
• Stripe Connect details: if you connect a Stripe account to take client payments, its Stripe account id and status. Stripe collects the identity and bank details it needs to verify your business; we don't receive your bank account or ID documents.
• API keys: each key's name, a short hint, who created it and when. The key itself is stored only as a one-way hash.
• Support messages: what you send us by email.

From clients

A business adds information about its clients to Thriveific, such as:

• name, email address, phone number, business name and billing address;
• the estimates, contracts and invoices sent to you, and their status;
• your payment history with that business (the amount, date and status, not your card number).

When you use a link a business sends you, we also collect:

• Views: that you opened an estimate, and when, so the business can see it was read.
• Accepting an estimate: the name you type, your email address on the estimate, the date and time, the acceptance statement you agreed to, which version of the estimate you accepted, and your IP address and browser details. This is kept as a record of the agreement.
• Signing a document: the name you type, the signature you draw, the signing statement you agreed to, your email address, and when the document was sent, viewed and signed. These details are added to the completed PDF, which may be emailed to you and the business.
• Payments: when you pay, you enter your card or bank details directly with Stripe, on its own checkout page. Stripe tells us whether the payment succeeded and the amount, so the invoice shows as paid. If a business shares a general payment page, the name, email, phone and message you enter there go to Stripe with the payment and to the business.

From everyone

• Google Analytics: our public marketing pages (Home, Features, Pricing, About, Contact, this Privacy Policy and the Terms of Service) use Google Analytics to count page views and understand how people find us. It sets cookies and receives your IP address, browser and device details and the page you viewed. We don't add it to the signed-in app, sign-in pages, the mobile apps, or the estimate, invoice, payment and signing pages a business sends you. Google signals and ads personalization are turned off for our property. It doesn't run for visitors whose device is set to a European time zone, so we don't use it in the European Economic Area, the UK or Switzerland. See How Google uses information from sites that use its services, or opt out with the Google Analytics opt-out browser add-on.
• Technical data: like any website, our hosting provider receives your IP address and browser details with each request in order to deliver the page and keep the Service secure, and keeps them in server logs under its own retention settings.

How We Use It

We use this information to:

• run Thriveific: create and secure your account, save your records, build PDFs, and show clients the estimates, documents and invoices sent to them;
• send emails the Service needs: estimates, invoices, payment reminders and signed documents that a business sends to its clients, plus password resets, email verification, team invitations and important notices about your account or these policies;
• let businesses take payments from their clients, and process your workspace's own subscription, trial, renewals and cancellations;
• answer the questions you ask the assistant, using your workspace's data;
• answer your questions and support requests;
• prevent abuse and fraud, and keep Thriveific secure;
• understand how our marketing site is used so we can improve it;
• comply with the law.

We do not sell personal information, we don't share it for targeted advertising, and we don't show ads in Thriveific. We don't send marketing emails to a business's clients, and we don't use one business's records for another business.

If you are in the European Economic Area or the UK, our legal bases are: performing our contract with you (running your account, workspace and subscription); our legitimate interests (security and support); and legal obligations (such as tax records). For client information a business adds, the business chooses its own legal basis.

The Assistant

When you ask the assistant a question, your message, the contents of any photos or PDFs you attach, and the workspace data it needs to answer (for example, a client's name and their invoices) are sent through the Vercel AI Gateway to an AI model provider, currently OpenAI. OpenAI doesn't use data sent through its API to train its models by default, but AI providers may keep it for a limited time to run their service and monitor for abuse, under their terms. The assistant only reads the workspace you're working in, and only what your role allows. Please don't put sensitive information, such as card numbers or ID numbers, into a chat.

Who We Share It With

We share information with the service providers that run Thriveific for us. Most act only on our instructions. Some, such as Stripe, also use information for their own purposes, such as fraud prevention and legal compliance, under their own privacy policies.

Some information is shared because you or a business choose to share it:

• Between a business and its clients: a business's estimates, documents and invoices go to the client they're for, and a client's views, acceptance, signature and payment status go back to the business.
• Within a workspace: team members can see the workspace's records as their role allows, and the names and email addresses of the rest of the team.
• Connected tools: if a workspace connects an outside app or AI agent with an API key, that tool can read and change the workspace's data as the key allows.

We may also disclose information if the law requires it, to protect the safety or rights of our users or others, or as part of a merger or sale of our business. If that happens, this policy will continue to apply to your information.

Cookies and Similar Technologies

• Sign-in cookie (thriveific_session): keeps you signed in to the dashboard. Required for the dashboard to work.
• Preferences: the sidebar_state cookie remembers whether the dashboard sidebar is open, and your browser's storage remembers your light or dark theme.
• Google Analytics cookies (_ga and _ga_<id>): on our marketing pages only, as described above.
• Stripe: Stripe sets its own cookies on its checkout and billing pages to prevent fraud.

The mobile apps store your sign-in on your device so you stay signed in. You can block or delete cookies in your browser settings. If you block the sign-in cookie, you won't be able to use the dashboard.

We don't sell personal information or share it for cross-context behavioral advertising, so there's nothing to opt out of. Our site doesn't currently change what it does in response to Global Privacy Control or Do Not Track signals.

The Mobile Apps

The Thriveific apps don't ask for access to your camera, photos, contacts, microphone or location, don't send push notifications, and don't track you across other companies' apps or websites.

How Long We Keep It

• Account and workspace data: for as long as your account or workspace exists.
• Assistant chats: until you delete the chat, you leave the workspace, or the workspace is deleted.
• When you delete a workspace: we cancel its subscription and permanently delete everything in it: its clients, estimates, invoices, documents, signatures, payment records, files, PDFs, team list, API keys and assistant chats. A connected Stripe account isn't deleted, because it belongs to the business; it's simply unlinked, and Stripe keeps its own records. Copies can remain in our providers' backups for a limited time before they're overwritten.
• When you leave a workspace or delete your account: we delete your saved assistant chats in that workspace. Deleting your account also deletes your login and removes you from every workspace. Records you created in a business's workspace belong to that business and stay with it.
• Estimate acceptances and signed documents: kept in the business's workspace for as long as it exists, as the record of the agreement. Copies already emailed stay with the people who received them.
• Billing records: invoices and payment records are kept by Stripe and by us as tax and accounting law requires, even after your account is gone.
• Support messages: for as long as we need them to help you and keep a record of the conversation.

Your Choices and Rights

• Edit your information: you can change your account, your workspace's details and your records in the app, as your role allows.
• Delete a workspace: the workspace's owner can delete it from the workspace's settings.
• Delete your account: open Account and press Delete account, or email support@thriveific.com from the email address on your account. If you own a workspace, delete it first, or ask us to help you hand it to a teammate.
• Cancel your subscription: the workspace owner can cancel in Settings → Billing, or by emailing us.

Depending on where you live (for example in California and other U.S. states, the European Economic Area or the UK), you may have the right to know what personal information we hold about you, get a copy of it, correct it, delete it, object to or restrict how we use it, and withdraw your consent. To use any of these rights, email support@thriveific.com. We'll check that the request comes from you in a way that suits the request, and respond within the time the law requires. If we need more time where the law allows it, we'll tell you why. You may also use an authorized agent. If we deny your request, you can appeal by replying to our answer, and if you're not satisfied with the outcome you can contact your state attorney general or data protection authority. We won't treat you differently for using your rights.

California residents: in the past 12 months we have collected the categories of information described in "What We Collect": identifiers (name, email, phone, IP address), customer records (billing address and business name), commercial information (estimates, invoices, payment and subscription records), internet activity (page views and estimate views), and the content you send us or the assistant. We collected it from you, from the business you work with, from your device and from the providers above, and used it for the purposes in "How We Use It". We don't sell personal information or share it for cross-context behavioral advertising, and we don't knowingly do so for anyone under 16. We don't use sensitive personal information to infer characteristics about you.

If you are in the European Economic Area or the UK and believe we've mishandled your information, you can complain to your local data protection authority.

International Transfers

Thriveific is run from the United States, and our providers process information in the United States and other countries. Where the law requires safeguards for information transferred from the European Economic Area, the UK or Switzerland, we use the ones that fit that transfer, such as Standard Contractual Clauses or an adequacy framework. Email us to ask which safeguards cover your information.

Security

Connections to Thriveific are encrypted, passwords are stored by Firebase Authentication, card and bank details are handled only by Stripe, each workspace's data is kept separate and visible only to its members as their role allows, and links sent to clients carry a private token. No system is perfectly secure, though. If a breach affects your personal information, we'll tell you and the authorities as the law requires.

Children

Thriveific is for businesses and the adults who work with them. Accounts are for people 18 or older. We don't knowingly collect personal information from children under 13. If you believe a child has given us personal information, email us and we'll delete it.

Changes to This Policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell business accounts by email or in the app before it takes effect.

Contact Us

Thriveific Beloit, WI 53511, United States support@thriveific.com