Back to the pack
Privacy, in plain words

Your brief belongs
to your project.

You should know what happens to your business information before sharing it. This policy describes our service providers, retention and verified privacy-request process.

Draft policy · service controls not yet verified

The commitments behind the work.

Not training material.

Our policy is not to use your inputs, sources, prompts, reviewer notes, or delivered copy to train or fine-tune AI models. We must use provider terms and account settings that support this and keep training, feedback-sharing, and data-donation options off.

Using information during your own order is different from adding it to a shared knowledge base. Client-specific material should not enter another client’s context or a reusable training dataset.

Limited processing, not “no other companies.”

AI providers and other necessary services may process limited information to write, host, authenticate, take payment, or deliver messages. Only information needed for their role should be sent. These providers must be documented before the service opens.

We do not propose selling your project content, licensing it as data, sharing it with advertisers, or using it in public examples without separate permission. Limited safety monitoring or lawful retention by a provider is not the same as model training.

Human access with a purpose.

Your copy editor needs the brief to review the work. Production access should be restricted to the team members and approved providers handling your project, with customer accounts kept separate. “Private” does not mean no authorized reviewer can see the information.

A few important distinctions.

Does “no training” mean no AI provider receives the brief?

No. A cloud AI service needs to process the information sent in a request. The promise needs to concern permitted use, limited access, and retention, not a claim that the request never leaves Thriveful.

How long is my information kept?

Drafts receive retention review after 30 days and sources after 90 days. Delivered files remain available for two years. Minimal financial and audit records are retained for seven years. Verified deletion requests include review of provider and backup limits and legal or accounting holds.

Is my data guaranteed to be completely secure?

No service can promise that. Production needs verified account isolation, restricted staff access, encryption configuration, private file access, logging controls, and incident handling. We do not claim a third-party security certification or zero risk. Access to private project material is checked on each server request.

Can my work appear in a portfolio or advertisement?

Our policy requires separate permission for the specific material and use. Purchasing the service or accepting its terms is not automatic permission to publish a client brief, testimonial, screenshot, or result.

What should I leave out of the brief?

Do not send passwords, API keys, payment-card details, government IDs, private customer lists, medical records, or other unnecessary sensitive information. Share public business facts and only the material you are authorized to provide.

Can I ask a privacy question or request deletion?

Use account Help or the contact page. In a live service, the team must verify identity, explain what can be deleted, and confirm any billing, security, or legal retention exceptions. Your account records a privacy request for verified human review. This does not confirm that deletion is complete.

Ask a privacy question ↗
What this file actually does

AI prepares internal drafts. Customer file uploads are not supported.

Our live service processes forms, payment, private project material and AI-assisted internal drafts through the providers listed here. Optional analytics and advertising use separate Ketch consent. Fictional examples are demonstrations, not customer records.

Design choices, favorites, hidden styles, named presets, and design notes may be stored in your browser. They exclude typed customer briefs. Exporting a design creates a local file; opening an email draft sends nothing until you choose to send.

Illustration placeholders are embedded in this file, so loading them does not contact an image company.

Provider register.

Clerk, Stripe, OpenAI, Resend and private Supabase storage support the service. Optional analytics requires separate consent.

PurposeWhat must be recorded
AI processingLegal provider name, product, model and endpoint, non-training terms, opt-in settings, safety logging, retention.
Hosting & filesLegal provider name, region, access controls, encryption configuration, backup and deletion periods.
AccountsAuthentication provider, authorized roles, access and recovery controls.
Payment & messagesPayment processor and messaging provider, limited data received, receipt and invoice retention.

Processing and retention

We use Clerk for login, Stripe for payment, private Supabase storage, Resend for transactional messages, and OpenAI to prepare internal drafts with store:false. A human reviews and approves copy before delivery. Drafts receive retention review after 30 days and sources after 90 days. Delivered files remain available for two years. Minimal financial and audit records are retained for seven years. Verified deletion requests receive human review across our systems, providers, and backups, subject to accounting and legal holds.

Optional analytics uses Mixpanel and Google Analytics only after your Ketch consent. Private briefs, source text and delivered copy are excluded. Advertising cookies require separate consent.