1. Who we are
Throughline is a growth and AI-visibility company for B2B software and B2B services companies, at trythroughline.ai, based in Stockholm, Sweden. When this page sayswe or us, it means Throughline. We are the controller for the data in §2.1 and §2.2, and our client's processor for the data in §2.3.
2. What we collect
We collect only what we need, in three groups.
2.1 Visitors to this website
- Analytics and a session replay (see §10). Form fields are masked and never recorded.
- Standard request logs from our hosting (Vercel).
2.2 People who write to us
- When you use a form on this site (a conversation request, a Visibility Report request or a build enquiry): your name, your email address, what you wrote, which form you used, and your IP address and browser type, which we use only to stop spam and abuse.
- Emails you send to us, and notes from calls you book with us.
2.3 Client data, under an engagement
- When a business engages us, the data it shares or gives us read access to (for example bookings, email campaign results, CRM exports, product analytics, search data), only the fields the work needs.
- What we produce from it for that client: reports, findings and drafts.
- A log of who accessed which tool and when.
For this group, the client decides what is shared and why. We process it on the client's instructions under a data processing agreement.
3. What we never collect
- We do not buy, rent or use consumer, homeowner or property data.
- We do not build or sell lists of people, or score individuals as sales prospects.
- We do not ask for, or want, special-category data (health, religion, politics and the like).
4. Where it lives
Persistent data lives in our Supabase project in the ap-southeast-1 region (Singapore), with credentials in Supabase Vault. Some processing passes through the vendors in §7, several of them in the United States. Transfers outside the EU rely on the safeguards in each vendor's data processing terms, such as the EU Standard Contractual Clauses.
5. How we protect it
- Encryption in transit. TLS 1.2+ everywhere, including every call to a client's tools.
- Encryption at rest. Supabase encrypts Postgres and Storage at rest by default.
- Credentials in Vault. Access tokens and API keys are stored in Supabase Vault (pgsodium / libsodium, AES-256-GCM). The website cannot decrypt them.
- Client isolation. Every table is gated by Row-Level Security keyed on the client. One client's data is never visible to another.
- Read-only access. We ask for read-only access to a client's tools wherever the tool allows it.
- Auditable access. Every read of a stored credential writes a row to an access log.
6. How we use it
- Website data: to understand which parts of the site work and to fix what confuses people. Legal basis: our legitimate interest in running the site.
- What you send us: to reply to you, prepare what you asked for and, if you become a client, to run the engagement. Legal basis: steps you asked for before a contract, and our legitimate interest in answering enquiries.
- Client data: only for that client's work, as the client instructs. We send model calls to Anthropic or OpenAI to draft and summarise, with no-train and no-retain settings where the provider offers them.
- Checking AI answers: the questions we put to AI assistants (ChatGPT, Claude, Gemini, Perplexity) to see what they say about a company contain the questions only, never personal data or client records.
What we never do:
- We do not sell your data.
- We do not share your data with third parties outside the sub-processors below.
- We do not use your data to train models. Not ours, not anyone else's.
- We do not combine one client's data with another's, or use it to build benchmarks or other products.
7. Sub-processors
- Supabase (database, storage, Vault). Region: ap-southeast-1 (Singapore). Holds essentially all stored data.
- Vercel (US). Website hosting and request logs.
- Railway. Runs the worker that reads a client's tools and prepares reports. It does not keep data between runs.
- Google (US). Google Workspace for our email, including the notification we receive when you send a form.
- Calendly (US). When you book a call with us: your name, email and any answers you give on the booking form.
- Anthropic (US). Claude API, for drafting and summarising.
- OpenAI (US). For drafting and for text embeddings.
- Amplitude (US). Website analytics and session replay (see §10). Never receives form contents.
If we change this list materially, we update this page and tell active clients before the change takes effect.
8. Retention & deletion
- Form submissions and emails: kept until you ask us to delete them.
- Client data: kept for the engagement. When it ends we delete it within 30 days, unless the client asks for an export first or the law requires us to keep something longer.
- Stored credentials: deleted when access is withdrawn or the engagement ends.
- Access log: kept for at least 12 months, then truncated.
- To ask for deletion, email hello@trythroughline.ai. We confirm in writing.
9. Your rights
You can ask for access to, a copy of, correction of or deletion of your personal data, object to or restrict how we use it, and withdraw any consent you gave. Write to hello@trythroughline.ai; we reply within 30 days. If your data came to us from one of our clients (§2.3), we pass your request to that client and help them answer it.
You can also complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), or to the authority where you live.
10. Analytics & session replay
We use Amplitude for website analytics and a session replay (a recording of on-page interaction) to understand which parts of the site work: pageviews, clicks, and scroll depth. Analytics and the replay cover every visit. We also log named events for what you do on the page (which section you reached, which link, card or button you pressed, which card you paused on, how far down a page you read and how long it stayed open, whether a form went through), with the size class of the screen (phone, tablet or desktop), whether it was a touch screen, and how fast the page loaded. These carry fixed labels only, never anything you typed. This is so we can fix what confuses people, not to profile them.
What it does not capture:
- Every form is masked. The fields on every form on this site carry a DOM-level mask, so what you type is never recorded in the replay and never sent to Amplitude as an event property. Your submission goes only to our own database and a notification email to us (§2.2).
To opt out, email hello@trythroughline.ai and we will exclude your sessions, or use a browser or extension that blocks analytics. We are evaluating Global Privacy Control / Do-Not-Track signalling and will honour it here once implemented; until then the email opt-out is authoritative.
11. Cookies
This website has no sign-in and sets no login cookies. Amplitude (see §10) sets first-party storage and a cookie to count a session for analytics and replay. We run no advertising and no cross-site tracking.
12. Changes
If we change this policy in a way that affects how we handle your data, we change the effective date and tell active clients before the change takes effect. Minor edits (typos, clarifications, formatting) are not announced.
13. Contact
Throughline, Stockholm, Sweden. Privacy questions, deletion requests, data exports and security disclosures: hello@trythroughline.ai. For security-specific issues, see also our security page.