Version 2026-10-07.1. Effective when published and, for contract terms, accepted. Current beta operation; real-money billing is not available.
Reading-copy editorial notice (16 October 2026): this website reading copy incorporates a factual company-status correction only. THREADLINE LDA was incorporated in Portugal on 9 October 2026 (NIPC / matrícula 519681169). The title and version shown above identify the historical accepted document; this is not a new accepted version, agreement or novation, and the original accepted documents and acceptance evidence remain archived unchanged.
Research context and saved working drafts — Supplement 2026-10-19.1 (extension 1.7.123)
Supplement ID 2026-10-19.1 — 19 October 2026. Applies to extension 1.7.123.
When you explicitly request research, Threadline uses the visible professional profile, including current-role responsibilities and relevant professional posts, with your seller profile.
Saved edits and accepted translations keep the original and recent working versions in Chrome extension local storage, isolated by your Threadline account. These include message/email text, language and prospect/signal/channel identifiers. They are not synchronized across browsers or devices and saving does not send or publish a message.
Drafts and prospect language choices expire seven days after last save and are removed on next access; storage is limited to 40 drafts, 100 prospect language choices and approximately 2 MB, so older copies may be removed sooner. Signing out or changing extension accounts clears this cache. Browser storage is not end-to-end encrypted. Copied, sent or explicitly shared content has its own lifecycle.
Account writing language applies across prospects for new drafts unless overridden for one prospect; the override does not cover their company. Existing drafts are not automatically translated.
The dated notice does not change accepted contract 2026-10-07.1 or its history, providers, permissions, prices, credit rules or payment activation.
Saveable full notice: https://app.threadlinehq.io/legal/working-drafts-update-2026-10-19.1.html
Extension sign in and account connections
Supplement ID 2026-10-12.1. Applies to extension 1.7.111; Store review and owner live checks are separate from backend/download deployment.
Extension 1.7.111 lets you sign up or log in directly with Google or your email and password. After required account setup and agreement steps, the extension connects automatically. You do not generate or paste a pairing code in this version. Your web dashboard uses the same Threadline account and can remain signed in separately.
Threadline authorizes one active extension login session per account. Signing in through another extension replaces the previous extension session and revokes its refresh session. Protected extension requests must match the currently authorized session. Multiple tabs in the same Chrome profile share that extension session. Teams members use their individual accounts and seats. You can sign out the active extension from Connection in the dashboard without signing out the dashboard. Account-level session revocation and deletion controls remain available. Work already started may finish; signing out does not erase information already displayed or copied.
To maintain this connection, the extension keeps its Auth access and refresh tokens and a random connection credential in local Chrome extension storage. Newly created connection credentials are not placed in Chrome sync storage. The existing internal storage key my_pairing_code now holds that opaque credential, not a code the user must enter. During unfinished setup, the pending Auth session and its activation credential are stored locally until connection completes or setup is signed out. A transient Chrome session-storage preference remembers whether you chose Sign up or Log in; it contains no credentials. The server stores a hash of the connection credential, the associated Auth session identifier, account identifier, connection status and timestamps. These are necessary authentication and account-access records; this change does not add hardware fingerprinting, location tracking or browser-history collection.
Active authorization is checked against the live Auth session. It ends when replaced, signed out, revoked, deleted with the account or no longer backed by a valid Auth session. Daily cleanup removes expired temporary handshakes and ended connection records while preserving a live connection. The old two-minute code lifetime does not expire an active extension login. Older extension versions retain a compatibility handshake during rollout and should be updated. A connection created before session binding may require a fresh sign-in; the account, company profile, plan, credits and saved research are preserved.
This control limits active login sessions. It does not identify a physical person or guarantee that deliberately copied authentication credentials cannot be shared. Keep your account credentials private and use the individual accounts or seats required by your plan.
Signing in, reconnecting or repeating setup neither consumes a Reveal nor grants another Free allowance. This release does not change prices, plan entitlements, credit/refund rules, AI providers or prompts, extension permissions, professional-data collection, marketing choices, customer rights or the separate real-payment activation gate. Accepted legal bundle 2026-10-07.1 and its acceptance history remain unchanged. This dated update supplements the previous authentication, storage and security descriptions; earlier notices remain historical where superseded.
For account or privacy assistance, contact [email protected].
Saveable copy: https://app.threadlinehq.io/legal/extension-signin-update-2026-10-12.1.html
Release and privacy status for extension 1.7.110
Supplement ID 2026-10-08.3. Status confirmed on 8 October 2026; privacy controls unchanged from 2026-10-08.2.
Extension 1.7.110 retains the privacy controls described in supplement 2026-10-08.2. The update clarifies the existing insufficient-signal Reveal message when a credit has been refunded. It does not change data collection, permissions, research decisions, credit or refund rules, browser storage, or the user journey.
On 8 October 2026, Threadline's founder confirmed that Google had reviewed, accepted and published extension 1.7.110, and that the installed-extension checks for Reveal, refunded credit balances and refresh had passed. These release confirmations supersede earlier pending Store and live-check status notes. Google review is separate from LinkedIn authorisation and is not a blanket legal or security certification.
The founder also confirmed completion of the outstanding supplier agreement, retention and transfer evidence and implementation of the restricted human-access procedure. Necessary operational records and provider-specific retention still exist. Access to specific extension-derived data remains subject to the applicable documented Limited Use exception; the closure does not create broader human access or a promise of zero retention.
This is a dated documentation and release-status update. It leaves accepted contract bundle 2026-10-07.1, prior acceptance evidence, customer rights, the existing processing purposes and published storage rules unchanged. Earlier notices below remain as history where their status statements have been superseded. The pre-existing provider-transfer and real-payment activation gate remains; no payment activation is announced by this update.
For privacy requests, including requests from prospects without an account, contact [email protected].
Save this dated update: HTML copy · Text copy.
Earlier dated notices and accepted text
Privacy update — extension 1.7.109 and aggregate founder reporting
Supplement ID 2026-10-08.2. Current control description for extension 1.7.109. Earlier accepted versions and the earlier same-day checkpoint are historical.
This update describes extension 1.7.109 and the matching backend and founder-reporting controls deployed on 8 October 2026. It supersedes the earlier 2026-10-08.1 checkpoint for these controls. Earlier notices and accepted contract versions are preserved as historical records; this update does not change contractual rights or create a new acceptance record.
In extension 1.7.109, opening a supported LinkedIn profile or the Threadline research panel reads the current professional profile locally for the existing interface. It does not send that currently viewed prospect's URL, name, company, profile identifier or profile-reference hash to Threadline merely because the page or panel opened. Account authentication, vendor settings, language, credit checks and an account-level download of previously saved Reveal results can still contact Threadline. The extension matches the current profile against those saved results locally; the lookup does not identify which profile is currently being viewed.
When you explicitly request Reveal, the professional profile information and company context required for the existing research and drafting feature are transmitted and processed normally. Previously requested in-flight Reveals can resume. Saved results, sources, generated content, explicit feedback, account access and credit/refund rules remain available under their existing controls. The change does not mean that Threadline collects no data.
Routine founder Analytics now provides aggregate usage and account administration separately. It does not expose named individual usage counts, activity times, per-person costs, prospect browsing history, individual-activity views or individual-usage exports. Small usage groups are suppressed, and account/company labels cannot be used to filter usage into individual reports. Account identity and ordinary account administration remain identifiable. Necessary raw product records and restricted operational access remain; aggregation and suppression are not an unconditional guarantee of anonymity. Human access to extension-derived data must be confined to a documented applicable Limited Use exception, such as the user's explicit consent to read specific data, necessary security work or a legal obligation.
Older extension installations can still send the earlier passive profile payload until updated. The deployed database guard continues to discard new passive profile-view inserts from those clients. Distribution of the verified 1.7.109 download does not establish Chrome Web Store review, publication or automatic installation; check the installed version. Earlier passive records were not deleted and retain the existing 180-day activity cleanup. Product/workspace records, private reporting facts, provider logs and backups have their separate retention rules. This update does not claim zero provider logging, immediate backup deletion, EU-only processing or completion of outstanding supplier/transfer evidence.
Threadline limits extension-data use to its disclosed research and drafting purpose and the related operation and security of that service. It does not sell extension data, use it for advertising or use it to determine creditworthiness. Final Chrome Web Store package/declaration reconciliation remains a separate verification step; this notice is not Chrome approval or a blanket legal-compliance certification.
For access, correction, deletion, restriction or objection requests, including requests from prospects without a Threadline account, contact [email protected]. Existing rights and contact routes continue to apply.
Save this dated update: https://app.threadlinehq.io/legal/privacy-update-2026-10-08.2.html. Download text: https://app.threadlinehq.io/legal/privacy-update-2026-10-08.2.txt.
Historical checkpoint and earlier accepted notice — preserved text
Privacy update — 8 October 2026
Supplement ID 2026-10-08.1. The existing version shown above and saved by the earlier-copy buttons is retained as the historical contract/notice version. This supplementary notice describes the current privacy change.
This dated update supplements the earlier notices reproduced below. It describes the backend privacy change deployed on 8 October 2026; it does not replace previously accepted contract versions or change your contractual rights.
When the Threadline research panel opens on a supported profile, the extension can still send the current prospect's profile URL, name and company to Threadline before you request a Reveal. From the backend update on 8 October 2026, Threadline discards these passive profile-view events before inserting them into its activity database. Transmission therefore still occurs; the update does not mean that collection starts only after Reveal.
Requested Reveal processing, saved prospects and outputs, explicit feedback, authentication and credit accounting are unchanged. Future passive panel openings no longer supply new activity records for dashboard company ranking, refresh decisions or fallback history. Existing saved prospect records remain available to the dashboard.
Earlier activity records were not deleted by this update and remain subject to the existing 180-day activity cleanup. Saved Reveal/workspace records have their separate retention rules. Provider request logs and backup copies have separate lifecycles; absence from the activity database is not a promise of zero provider logging or immediate backup deletion.
Private founder Analytics still includes identifiable account-linked usage, including activity times, feature counts and costs. Its fact dataset does not copy full prospect URLs, prompts or message content. Restricting access to founders does not make these records anonymous. The outstanding Chrome disclosure/choice and Limited Use human-access questions are not resolved by this storage change or by publishing this notice.
For access, correction, deletion, restriction or objection requests, including requests from prospects without an account, contact [email protected]. The existing rights and contact routes continue to apply.
Save this dated privacy update · Download the text copy
Earlier notice — preserved text
1 Who we are and what this notice covers
Threadline is currently operated jointly by Diogo Baptista and Pedro Castro. Correspondence address: Rua Aristides Sousa Mendes n8 6o andar, 1600-413, Lisboa, Portugal. Contact: [email protected]. THREADLINE LDA was incorporated on 9 October 2026 (NIPC / matrícula 519681169); the effective transfer of the provider role to it has not yet been confirmed, so it is not the present contracting party.
This notice covers the Threadline website, web application, Chrome extension, accounts, company settings, workspaces, research, AI-assisted drafts, shared briefs, internal Analytics and service notifications. It also explains the handling of professional information about people who do not have an account. THREADLINE LDA is incorporated (NIPC / matrícula 519681169); notice of any transfer of operation to it will be published when that transfer is completed.
Threadline is controller for its account administration, billing, security, support and its own service-usage analysis and internal registration notifications. Where we process customer prospect and workspace content only on the customer’s documented instructions, the customer is controller and Threadline is processor under the Data Processing Agreement. Actual purposes determine these roles. A customer’s contract with us is not a lawful basis for all processing about third-party prospects.
2 Information and sources
Account information includes name, email, account identifier, verification and setup status, company, language, workspace membership, plan and subscription details. Stripe handles payment-card information; Threadline receives payment and subscription identifiers and status.
Company or vendor settings can include your website, offering, pitch, value propositions, pain points, differentiators, proof points, customer examples, custom writing instructions, signature and booking links. These can include confidential business information you supply. They are not necessarily public information.
Professional prospect information can include a name, job title, employer, location, profile or company URL, biography, work history and professional activity displayed on a profile a user views. Sources include the selected LinkedIn or Sales Navigator page, user submissions, company websites, public-web research and news. Information visible to an authorised signed-in user is not necessarily available to the general public.
The service also handles saved prospects, notes, tasks, drafts, comments, reviews, approvals, generated summaries, inferences, sources, workspace activity and public-brief content and access metadata. AI-generated inferences about an identifiable person are personal data, even when uncertain.
Technical records can include IP/network metadata handled by service providers, browser or extension version, device/session information, request identifiers, actions, timestamps, errors, durations and AI usage/cost records. Some product activity records include a prospect’s profile URL, name or company. Hashed identifiers are not necessarily anonymous.
We do not intend the service for children or for processing special-category or criminal-offence data. Avoid submitting sensitive personal details, credentials or irrelevant private material. Public availability does not remove data-protection obligations.
3 When the extension and research collect information
The extension displays its interface on supported LinkedIn pages. Opening the Threadline panel can send a profile-view activity event containing the current prospect’s URL, name and company before a Reveal is requested. A Reveal then processes selected visible professional information and company context to provide the requested research and drafts. This notice does not claim collection starts only when Reveal is clicked.
The extension does not open other LinkedIn profiles in the background or automatically send LinkedIn invitations, messages, comments or likes. Separately, the web app can refresh public-web announcements for companies you choose to monitor. Threadline is independent from LinkedIn; this description is not a statement of LinkedIn approval.
Browser and extension storage hold authentication/session tokens, pairing state, preferences, caches and queued technical events. See the Cookie and Local Storage Policy and Chrome Extension Privacy Disclosure.
4 Purposes and lawful bases
We use account and service information to provide the service you request and administer your contract (GDPR Article 6(1)(b)). For business accounts whose users are not themselves the contracting party, relevant account administration can rely on legitimate interests in delivering the organisation’s service (Article 6(1)(f)).
We rely on legitimate interests for proportionate service security, troubleshooting, abuse prevention, support, service-usage analysis and internal registration/setup alerts: operating the service, identifying failures, assisting onboarding and understanding adoption. These interests must be necessary, balanced against people’s rights and subject to minimisation, limited access and an effective objection process. Unnecessary terminal-equipment tracking requires consent where applicable; describing a purpose as analytics does not make it strictly necessary.
Billing and accounting use contract and applicable legal obligations (Article 6(1)(c)); proportionate legal-claim records can rely on legitimate interests. Marketing emails and new marketing opt-ins are currently disabled. Any future optional electronic marketing or optional tracking requires a lawful basis and consent where the applicable law requires it; registration does not supply that consent. You can withdraw any historical consent without affecting prior lawful processing.
For prospect or workspace processing under customer instructions, the customer determines and documents the lawful basis. Where Threadline determines a separate purpose itself, it must establish its own lawful basis and transparency. We do not claim a blanket legitimate-interest permission for all public data or outreach.
Required account fields enable registration and service delivery; if you do not provide them, we may be unable to provide the relevant service. Optional information is identified in the relevant flow.
5 Internal Analytics and registration notifications
Threadline’s private Analytics displays account email, supplied company, registration/setup information, account status and service-usage metrics such as feature counts, activity times, performance, errors and AI costs. It is restricted to authorised founders. The analytics dataset does not copy full prospect URLs, message content or AI prompts, although separate product records can contain them. It is not anonymous simply because some views show totals.
Both founders receive an internal email when an account is created and another when the account has supplied its company and completed setup. These alerts contain limited account details such as first name, email, relevant times, verification status and company where available, plus a link to private Analytics. Resend delivers them to the founders’ Threadline business inboxes. The alerts are for internal administration and onboarding; they are not marketing emails sent to the new user.
Email inbox copies, delivery-provider logs and the application’s notification records have separate lifecycles. Account deletion does not automatically erase every copy in a mailbox or backup. Rights requests include these records where relevant.
6 AI processing
Selected profile information, company research, vendor settings, custom instructions and relevant workspace context are sent to OpenAI to generate summaries and drafts. This may include non-public material you enter. Do not submit information you lack authority to disclose for that processing.
OpenAI states API data is not used for model training by default. Threadline does not use customer content to train a general-purpose model. A request setting such as store:false does not eliminate all provider retention. Standard abuse-monitoring records can be retained for up to 30 days, subject to the provider’s exceptions and applicable law. Threadline does not promise Zero Data Retention or EU-only OpenAI processing.
Output can be wrong, biased or outdated. A person must review it. Threadline does not use the described service to make solely automated decisions with legal or similarly significant effects. It must not be used for high-impact decisions about employment, credit, insurance, housing or similar matters.
7 Recipients and international processing
Supabase supplies authentication, database, storage and backend functions. The observed primary project region is London, United Kingdom. The UK is outside the EU; an applicable EU adequacy decision currently covers relevant transfers. Support and onward processing can involve other locations.
OpenAI provides AI processing and web-search-assisted research. Stripe provides payments and fraud/compliance processing; it can act as an independent controller for some activities. Resend delivers service emails and internal registration/setup alerts. Lovable and its hosting infrastructure deliver the marketing website. Cloudflare provides network/security services. GitHub Pages distributes the static web application and extension downloads. Netlify hosts the private Analytics application. The domain’s inbound email is routed through Titan; Lark is used for internal documentation. Business mailboxes and any configured mail clients can hold alert copies. Each receives the data relevant to its role, rather than unrestricted access to all product content. Fonts are served with the website files and do not require a browser request to Google Fonts.
Authorised workspace members and anyone receiving a public brief link can receive information you choose to share. Advisers, authorities and parties involved in a corporate transaction may receive necessary information subject to law and confidentiality safeguards.
For transfers requiring safeguards, we use the applicable adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where necessary. Contact us for information about relevant safeguards. This is not an EU-only hosting or processing promise. Supplier entities, purposes, locations, agreements and configuration evidence are maintained in the supplier register; unresolved evidence is recorded in the readiness register.
8 Retention and deletion
Retention depends on the record and purpose. There is no single automatic deletion period for all Threadline data. Current cleanup runs daily, so an expiry is followed by the next successful cleanup run.
- Expired pairing and device-authorisation records are removed by scheduled cleanup.
- Reveal job records normally expire after 7 days; company-enrichment cache records after 5 days. Saved outputs or workspace copies have their own lifecycle.
- Public briefs normally expire after 30 days unless otherwise configured. Access ends at expiry or revocation; stored brief records are cleaned up 7 days after expiry or revocation.
- Interaction events are generally kept for 90 days; product activity and AI usage/cost records for 180 days.
- Observability records have record-specific expiry, commonly 30, 60 or 90 days. Some billing/webhook integrity records are retained for 400 days.
- Private Analytics event and audit history is retained for up to 400 days. Account/cohort information can remain while the account exists; it is not all governed by that 400-day event window.
- Internal founder registration/setup notification delivery records currently have no automatic age-based deletion rule. They are linked to account deletion. Founders’ inbox copies and email-provider logs are separate. Requests for earlier deletion or objection are assessed by purpose and applicable obligations.
- Accounts, company settings, saved prospects, drafts and workspace content remain while needed for the account or customer’s instructions, until deleted or the purpose ends. There is currently no general inactivity rule automatically deleting all durable content.
- Tax, payment, dispute, rights-request and narrowly necessary suppression records can be retained for legal obligations or claims. They must not be reused for unrelated purposes. Provider backups expire under their applicable schedules; we do not promise immediate deletion from every backup.
Account deletion removes active personal product data and owned workspaces through the service’s deletion process. Export or transfer workspace ownership first if colleagues still need that workspace. Records controlled by another customer can remain under that customer’s lawful instructions, with attribution removed where the product supports it. Copies exported or downloaded by customers are their responsibility.
9 Your rights and how to contact us
Email [email protected] for access, correction, erasure, restriction, portability where applicable, objection, withdrawal of consent or information about safeguards. You do not need a Threadline account. Give enough information to locate the relevant account, profile or record; we may request proportionate verification without routinely demanding an identity-document copy.
We respond without undue delay and within one month. If the law permits an extension because of complexity or number of requests, we explain the reason within that first month. We explain any refusal and complaint options. Direct-marketing objections are honoured for that purpose; other legitimate-interest objections are assessed under Article 21.
Account exports include personal product records, private Analytics records, notification records, recorded Terms acceptance, marketing choices and consumer billing/withdrawal records. A full access response may still require separate mailbox, support, payment-provider or other provider records. Contact us for a complete access response. If a self-service deletion or export fails, the email channel remains available. Account closure, subscription cancellation and statutory erasure are distinct processes; an outstanding subscription does not remove your statutory rights.
Where we act only as a processor, we help the responsible customer handle the request. You may complain to the Portuguese CNPD at https://www.cnpd.pt/ or your competent local supervisory authority.
10 People whose information came from other sources
Professional data remains protected when publicly available. The responsible controller must give the required Article 14 information within a reasonable period, no later than one month, or at the first communication or disclosure if earlier, unless a specific exception is applicable and documented. A general website notice alone does not prove that obligation has been met. Our Prospect Data Notice explains the distinction between the customer’s processing and Threadline’s own purposes.
11 Security and changes
We use authentication, access controls, row-level database policies and HTTPS, with operational logging and scheduled cleanup. Public links can be forwarded, and browser storage is not end-to-end encrypted. No system is risk-free. See Security at Threadline for the supported control description.
We update this notice when practices change and communicate material changes through an appropriate channel. New consent is sought where legally required. Contact [email protected] for this notice or previous versions.
Consent and contract records
For a new account, we record the Terms version, server time, acceptance method, registration action and surface, the versioned notice text and its hash, and the linked privacy-text hash. A button action following the visible notice is recorded as button-notice acceptance, not as a checked box or blanket privacy consent. Signing in with an existing current or explicitly compatible agreement does not create another acceptance. Marketing is disabled for all accounts. Historical marketing choices are retained as history; any previously active preference is set to off without rewriting the original event. Contact [email protected] for questions or withdrawal of any historical choice. Contract and withdrawal records include the order reference, amount, currency, applicable taxes, contract copy, request time and refund outcome. Transactional purchase, cancellation and withdrawal messages are separate from marketing. Current test billing records are kept for up to 400 days after completion unless an unresolved request requires longer; account consent and marketing records are deleted with the account. Statutory accounting retention for future real sales will be specified before those sales begin.
Extension registration and acknowledgement
The Chrome-owned extension setup panel collects your email and password for registration or sign-in. Password confirmation is checked locally and is not sent as a second password field. Credentials are transmitted over HTTPS to the authentication service; the extension does not save passwords in its drafts. The server activates new extension accounts immediately and sends an acknowledgement through Resend. This service email requires no code or link click, is independent of optional marketing consent and is not evidence that you proved ownership of the mailbox. Existing web-registration confirmation behavior remains separate.
Company name, product/service category, website and editable company-profile suggestions use the same account profile as the web app. Unfinished company drafts and a temporary setup session are held in extension local storage so setup can resume. These are removed when setup connects the browser or when you explicitly leave setup using a different account; account-scoped drafts are not displayed to another signed-in account. Session expiry or revocation can require signing in again. Closing the panel alone does not erase the draft.
To prevent automated registrations, the signup service processes network signals and keyed hashes of network and email values in hourly rate-limit buckets. Bucket records are removed after 24 hours by hourly cleanup. These hashes are pseudonymous, not anonymous. Registration acknowledgement outbox records, including recipient, content and delivery status, expire after 30 days by hourly cleanup and are removed earlier with the account. Delivered inbox copies and Resend records follow their own lifecycle. These periods are separate from the existing founder-notification and consumer-billing records. Account exports include the retained acknowledgement record.
Optional Google sign-in
If you choose Continue with Google, Google supplies a verified identity assertion to Threadline's Supabase authentication backend. We request only OpenID identity, email and basic profile. Account records can include your Google identifier, email and verification claim, name and profile-image URL supplied in that assertion. We use these to create or authenticate your Threadline account, protect account linking and administer the service. Threadline never receives your Google password and does not request Gmail, contacts, Drive or calendar access. We do not use Google sign-in data for advertising, resale, credit scoring or model training.
Google receives the sign-in request and related network/browser information under its own Privacy Policy at https://policies.google.com/privacy. Google processing can occur internationally; this is not an EU-only processing promise. Supabase handles the resulting Threadline identity and session. Your account email and name can also appear in the existing private founder account records and Resend service/registration notifications described above. Google sign-in does not grant marketing consent or additional Google permissions; marketing emails are currently disabled.
A sign-in attempt stores the displayed Terms version, button-notice version and action/surface (or an older installed client’s actual checked acknowledgements), marketing-off status, interface language, one-time security values, exact return address and a keyed network hash in a private server record. It expires after 10 minutes, is consumed on completion and is removed by hourly cleanup after expiry if abandoned. Only the sign-in attempt and its originating browser can complete the exchange. Google API tokens are used during the server exchange and are not returned to the extension/web application or saved as reusable Google API credentials. The normal Threadline session has its existing retention and revocation controls.
Google identity/account data remains for the account lifecycle and is removed from active Threadline authentication records on account deletion. New-account acknowledgement copies follow the existing 30-day outbox limit and earlier account deletion; recipient inbox and provider records are separate. You can remove Threadline's connection in your Google Account's third-party connections controls; this prevents future use of that Google connection but does not itself delete your Threadline account or immediately revoke an already issued Threadline session. Use Threadline sign-out/device controls and the deletion or privacy-request process for those actions.
Company case studies and use-case links — 26 October 2026
Supplement 2026-10-26.1
This notice describes the case-study library introduced with Threadline 1.7.146. It takes effect for this functionality when the corresponding app and backend are released. It does not change earlier accepted terms or record a new agreement.
When you generate your company profile, Threadline uses the company name, product or service category and website to find public customer stories and use-case pages on that website and through web search. You can also submit public page links. This work continues in the background and does not require uploading a document. The search and extraction use OpenAI; the saved library is held in Threadline’s Supabase backend. No additional provider or Chrome permission is introduced by this feature.
Threadline reads public pages and stores their source links, titles, customer and industry names, stated teams and responsibilities, a short description of the problem and use case, reported outcomes, a short supporting excerpt and source/check dates where available. Pages are processed to extract these facts; full source documents are not retained as library attachments. Public source material can contain professional names or quotations. Source facts and AI summaries may be incomplete or inaccurate. The source link remains available for review.
Your company library is associated with your account. In a managed Teams workspace, members use the workspace owner’s company library; the owner manages its links. The library is not a public directory. When you request a new message or regenerate one, Threadline may supply a limited set of previously read facts to the existing writing model. The model decides whether they are relevant. It does not search case-study pages during Reveal, and a missing or unavailable library does not prevent writing. Saving case studies or generating a draft does not send outreach.
You can remove links in the Library tab during setup or on the web app’s Library page. Removal excludes the related evidence from future library inputs and prevents a discovery job already in progress from adding that removed link back. It does not rewrite earlier saved messages or retract text you copied or sent. Changing the company identity replaces its active library. Account deletion removes the account’s library; providers’ logs and backups follow their separate retention schedules. Facts checked more than 90 days ago are excluded from writing, which is a freshness limit rather than automatic deletion. Regenerating a profile can refresh a library older than 30 days, and the Find links again control requests a refresh subject to service limits.
Existing rights, security controls, provider disclosures and contact routes continue to apply. Contact [email protected] for data-rights requests or concerns about a source.
Spoken call playbooks and personal call settings — supplement 2026-10-28.1
From extension 1.7.151, the cold-call playbook has Open, Ask then listen, Brush-off and Close. Rep dialogue is separate from hypothetical prospect answers and coaching. The existing AI writing request generates the message and its playbook together. Regenerating a message also updates its playbook. An explicit playbook refresh uses the full current LinkedIn draft, supplied profile and signal, seller evidence, and available account intelligence. It preserves that draft. Existing bounded provider/error recovery still applies. These are generated suggestions, not verified prospect statements or guaranteed outcomes.
My opener is optional personal text saved to the signed-in Threadline account in Supabase and displayed verbatim. It is not generated, included in the playbook AI request, or included in a shared brief. The rep can replace it or save an empty value. It is available when the same account opens a brief on another device.
The optional sent declaration records that the rep says they sent a specific LinkedIn message, with a chosen date. Copying, generating or editing a draft does not mark it sent. The saved record contains account and prospect identifiers, a SHA-256 message fingerprint, sent date, revision and update time; this new table does not retain another copy of the message body. It is account-scoped and draft-specific. Clearing the declaration removes the date while retaining the fingerprint and revision to prevent stale writes. The declaration does not verify delivery and does not send, read or monitor LinkedIn messages.
Saved call settings and declaration records persist until replaced or account deletion; they are included in the existing account export and removed by the account purge/deletion flow. Previously generated drafts, shared copies, provider records and backups retain their existing lifecycle. Sent status can affect the opening and email brush-off only after the rep explicitly refreshes the playbook. Refresh is available on Starter and above under the existing regeneration entitlement.
This update adds no Chrome permission, provider, automatic outreach, live call recording or microphone access. Existing privacy and AI disclosures continue to apply. Accepted contract text and acceptance history remain unchanged. Contact [email protected] for privacy assistance.
Save this call playbook notice
Simplified call playbook — supplement 2026-10-28.2
From extension 1.7.153, the cold-call playbook displays only Open, Ask then listen, Brush-off and Close. My opener, the sent-message checkbox/date, save controls and separate playbook refresh controls are removed. The updated extension does not read or write those personal call settings. Opening the playbook or editing a draft does not trigger an extra AI request. Normal message generation and regeneration continue to generate the message and playbook together.
New playbook generation does not use saved sent declarations or claim that a message was already sent. Existing saved wording is retained until normal regeneration. Earlier opener and sent-declaration records are not deleted by this interface update; they retain the existing account-scoped protection, export and account deletion/purge lifecycle described in supplement 2026-10-28.1. Older installed versions may still expose their previous controls until updated.
This supplement supersedes the earlier description of available call settings in the updated extension. It introduces no new provider, data category, purpose, retention period, Chrome permission, outreach automation, pricing or contract acceptance. AI output remains suggested wording for the rep to review.
Save this simplified playbook notice
Manual Library use cases — Supplement 2026-10-29.1
From Threadline 1.7.156, the Library also accepts a title and plain text for a case study or use case that is not available online. A public link, uploaded document and team tags are not required. Threadline stores the supplied text in its Supabase backend. Saving or editing this text does not ask an AI model to extract or rewrite it. Ready means saved and available for generation; it does not mean independently verified. Manual entries are labelled Added by you.
The existing writing model may receive saved manual entries alongside public Library evidence when you request a new message or regenerate one. Their contents are seller-supplied information, not instructions. A general use case does not establish an actual customer relationship or achieved result. Only add information you are entitled to use, and anonymize anything you do not want included in generated outreach. Library text can contain business-confidential information or professional personal data if you choose to enter it. The Library is not a public directory, but details used in a draft may appear in text you copy, send or deliberately share. Saving an entry does not send outreach.
An account controls its own Library. In a managed Teams workspace, members can use the owner's Library and only the owner can add, edit or remove entries. Manual entries are stored separately from website discovery and are not overwritten by Find links again. Unlike retrieved public facts, they do not expire after the public evidence freshness interval; the owner maintains them until removal, replacement of the active company identity, product-data purge or account deletion. An account's own Library is included in its data export. Provider logs and backups retain their existing schedules.
Edits and removals affect future Library inputs. They do not rewrite saved drafts, cached signal packages or previously shared snapshots, and do not retract copied or sent text. To use changed Library information in an existing draft, request normal regeneration where available. The feature introduces no new AI provider, Chrome permission, outreach automation, price or acceptance event. It supplements the URL-only Library description in notice 2026-10-26.1; earlier accepted contract text and acceptance records remain unchanged. Contact [email protected] for data-rights requests.