Version 2026-10-05.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
Reading-copy editorial notice (16 October 2026): this website reading copy incorporates a factual company-status correction only. THREADLINE LDA was incorporated in Portugal on 9 October 2026 (NIPC / matrícula 519681169). The title and version shown above identify the historical accepted document; this is not a new accepted version, agreement or novation, and the original accepted documents and acceptance evidence remain archived unchanged.
1 Parties scope and roles
This DPA forms part of the applicable service agreement between the customer identified in the order or validly accepted service contract (Customer) and the confirmed Threadline legal operator (Threadline). Operator: Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: [email protected]. THREADLINE LDA was incorporated on 9 October 2026 (NIPC / matrícula 519681169); the effective transfer of the provider role to it has not yet been confirmed, so it is not the present contracting party.
This DPA is part of the Terms accepted by the Customer, identified by the account or agreed order. The current Threadline operators are identified above. It applies to the extent Threadline processes Customer Personal Data on the Customer’s documented instructions. The Customer must identify its responsible organisation and privacy contact accurately; a later corporate operator is not substituted without an appropriate transfer. Data Protection Law includes the GDPR, applicable Portuguese data-protection law and other applicable mandatory law.
Customer is controller, or processor for its own controller, of Customer Personal Data that Threadline processes on documented instructions. Threadline is processor or subprocessor for that data. This DPA does not cover Threadline’s separate controller processing for its own account administration, billing, security, service-usage analysis, registration/setup alerts or legal obligations, described in the Privacy Notice. A role label does not override the actual facts.
2 Instructions and permitted processing
Threadline processes Customer Personal Data only on documented instructions, including the agreement, configured features, authorised user actions and written instructions, including for transfers, unless Union or Member State law requires otherwise. It informs Customer of such a requirement before processing unless the law prohibits that information.
Threadline immediately informs Customer if, in its opinion, an instruction infringes applicable data-protection law, and may suspend the affected processing while the parties resolve it. Customer is responsible for lawful instructions, data sources, bases, notices, minimisation, accuracy, retention and outreach-channel rules.
Threadline does not sell Customer Personal Data, use it for personalised advertising or train a general-purpose AI model on it. It does not acquire a right to reuse customer prospect content for its own unrelated intelligence database through this DPA. Sensitive data and criminal-offence data are not authorised inputs without a separately agreed lawful arrangement.
3 Personnel and security
Threadline ensures persons authorised to process the data are committed to confidentiality or under an appropriate statutory obligation. It implements appropriate technical and organisational measures under Article 32, taking account of the processing and risk. Annex II describes the scope of those measures without claiming unverified certifications or controls.
Threadline may improve measures without materially reducing the contracted protection. Customer must configure its own access, secure devices, minimise inputs and control sharing and exports. These customer duties do not reduce Threadline’s obligations.
4 Subprocessors
Customer gives general written authorisation for the processing-chain providers identified in Annex III, only within their described scope. Before adding or replacing a subprocessor, Threadline gives at least 30 days’ notice and a meaningful opportunity to object on reasonable data-protection grounds. If law or an urgent security event requires faster action, Threadline promptly explains the circumstances, limits exposure and provides an opportunity to object and a practical alternative or termination of the affected processing where necessary.
Threadline imposes the same applicable data-protection obligations on each subprocessor by contract and remains fully liable to Customer for the performance of the subprocessor’s obligations as required by Article 28(4). A general list of every commercial supplier is not a substitute for an accurate subprocessor schedule.
5 Assistance and individual rights
Taking account of the processing, Threadline assists Customer through appropriate technical and organisational measures in responding to data-subject requests. It forwards requests concerning Customer Personal Data without undue delay and does not respond substantively on Customer’s behalf unless authorised or legally required.
Threadline assists with security, breach notifications, DPIAs and prior consultation under Articles 32–36, taking into account the information available. Assistance includes locating relevant active records, generated derivatives, sharing links, provider copies and deletion restrictions. Self-service export is not treated as a complete response where additional records are held.
6 Personal data breaches
Threadline notifies Customer without undue delay after becoming aware of a breach affecting Customer Personal Data. It supplies, as available, the nature of the breach, affected categories and approximate numbers, likely consequences, measures taken or proposed and a contact. Information can be supplied in phases without undue further delay.
Customer controls its own regulator and individual notifications unless law provides otherwise. Threadline preserves relevant evidence and cooperates with containment and remediation. No acknowledgement or response SLA is represented as already operating unless separately agreed and supported.
7 Return deletion and retention
At the end of processing services, Threadline deletes or returns Customer Personal Data at Customer’s choice, and deletes existing copies unless Union or Member State law requires retention. Customer can request return before deletion through available export facilities or [email protected]. Threadline completes active-system return/deletion within 30 days of a validated instruction unless a shorter period is legally required or agreed.
Necessary retained legal records are limited to their purpose and protected from other use. Backups remain restricted and expire under the verified provider schedule, which must be supplied in the completed schedule; no unverified fixed backup period is promised. If a backup is restored, relevant deletion and suppression instructions must be reapplied before ordinary use resumes.
Account-owner deletion can remove the owned workspace. Customer must arrange transfer or return before deletion where required. Records in a different customer’s workspace require the appropriate controller’s instructions and lawful retention assessment. Copies independently exported by Customer are outside Threadline’s direct control.
8 Transfers
Threadline identifies the destination, recipient, purpose and applicable transfer mechanism before any restricted transfer. An applicable adequacy decision can support covered transfers; otherwise appropriate safeguards such as the correct modules of Commission Decision (EU) 2021/914, completed annexes and necessary supplementary measures must be in place. A generic reference to SCCs does not by itself complete the transfer assessment or contractual annexes.
The observed primary Supabase region is London, United Kingdom. The UK is not an EU location; the applicable adequacy decision is subject to its terms and continuing validity. Provider support, AI processing and onward subprocessors can involve other countries. Threadline does not promise EU-only processing. UK-restricted transfers require the appropriate UK mechanism where applicable.
9 Compliance information and audits
Threadline makes available all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by Customer or its mandated auditor. Current independent reports and written responses can be used first where sufficient.
Audits use proportionate scope, confidentiality, reasonable notice and safeguards for other customers and service security. Ordinarily 30 days’ notice is requested, but urgency, material incidents and competent-authority requirements may require less. Routine frequency or costs must not prevent a legally necessary audit. Mandatory regulator powers are unaffected.
10 Priority liability and duration
This DPA prevails over inconsistent service terms concerning processor obligations. Applicable SCCs prevail where required. It remains effective while Threadline processes Customer Personal Data. Liability provisions do not limit non-excludable obligations or data-subject rights under the GDPR.
Annex I Processing description
Subject matter and purpose: provide customer-requested professional research, AI-assisted drafting, prospect/workspace records, company settings, comments, approvals, shared briefs, support and related security functions.
Nature: collection from customer-selected or supplied sources, extraction, organisation, storage, transmission to authorised providers, generation, retrieval, display, collaboration, sharing, export, restriction and deletion.
Duration and frequency: for the service term and applicable return/deletion period; continuous storage and event-driven processing, including configured public-company monitoring.
Data subjects: authorised customer users, professional prospects selected by Customer, customer personnel, contacts and brief recipients.
Data categories: professional names, roles, employers, locations, profile/company URLs, biographies and work history; supplied business context and custom prompts; sources, inferences, generated outputs, notes, drafts, comments, approvals, sharing metadata and relevant service records. Special-category, criminal-offence and children’s data are not intended inputs; incidental sensitive material requires minimisation and correction.
Customer instructions: agreement, order, feature configuration and lawful authorised user/support instructions. Customer identifies the responsible controller and contacts in the order and supplies any additional industry or country restrictions before processing.
Annex II Technical and organisational measures
Observed product controls include Supabase authentication, role and row-level access controls, server-side entitlement checks, HTTPS, private avatar storage with signed access, short-lived pairing/device authorisations, validation, rate/spend controls, operational logs and scheduled cleanup. Browser storage can contain session tokens and is not end-to-end encrypted. Public briefs are link-accessible and must be treated accordingly.
Required organisational measures include confidentiality, least privilege, access review and offboarding, incident handling, supplier oversight, appropriate training, deletion/rights assistance and tested recovery. Evidence of these operating procedures, exact backup coverage, restore tests and staff MFA remains to be completed in the readiness register. This annex does not claim an independent penetration test, ISO certification or SOC report held by Threadline.
Annex III Processing-chain providers and scope
Supabase Pte. Ltd.: authentication, database, storage and backend functions for user, company, prospect and workspace content. The primary project is in London, UK; support and onward providers can operate elsewhere. The current provider DPA includes SCC provisions for relevant transfers: https://supabase.com/legal/customer-resources/data-processing-addendum. Its provider list is https://supabase.com/legal/customer-resources/subprocessor-list.
OpenAI Ireland Ltd. for an EEA customer under the applicable API agreement: relevant prompts, company/prospect context and generated outputs for requested generation and research. International processing can occur through affiliates and listed providers. Standard API abuse-monitoring retention can be up to 30 days; no Zero Data Retention or EU-only processing arrangement is represented. Provider DPA: https://openai.com/policies/data-processing-addendum/; providers: https://platform.openai.com/subprocessors.
Cloudflare, Inc. provides relevant network and security delivery. Its geographical scope is international and its role depends on the configured traffic path: https://www.cloudflare.com/cloudflare-customer-dpa/.
Resend (Plus Five Five, Inc.) provides delivery for service emails, including workspace invitations where used. Only necessary recipient and message content is supplied. Its DPA includes transfer clauses: https://resend.com/legal/dpa. Threadline's own account/founder/billing alerts are separate controller activities.
GitHub Pages distributes static app files and receives network requests. Lovable hosts the marketing website. Netlify hosts private founder Analytics. Titan hosts business mail and Lark holds internal documents. These are not authorised as general repositories for customer prospect datasets through this DPA. Where an instructed support or sharing flow puts Customer Personal Data in a provider's processing chain, Threadline must identify the applicable provider, scope and safeguards and obtain the required authorisation before extending that flow.
Threadline maintains the account-specific supplier and transfer evidence internally. Public provider terms do not prove that a particular account's contractual identity, configuration, backup coverage or transfer assessment has been verified. Customers may request the applicable evidence and backup/deletion information at [email protected]. Open evidence items do not reduce Threadline's obligations in this DPA or create a claim that all supplier checks are complete.