1. Who we are
Thrust Base is operated by Thrust Marketing LTDA, a company registered in Brazil under CNPJ 37.975.161/0001-00, with offices at Platinum Office, SIG Quadra 8, Lote 385, Sala 04, Brasília-DF, CEP 70610-480, Brazil ("Thrust"). Thrust Base is a product built inside Thrust Marketing: there is no separate company for it, and no entity in any other country.
The product is sold internationally and priced in US dollars, but the company behind it is Brazilian. This policy explains which personal data goes through Thrust Base, what it is used for, who it is shared with, how long it is kept and how to exercise your rights.
2. Two kinds of data, two roles
Thrust Base handles two very different sets of personal data, and telling them apart is what makes the rest of this text make sense.
For the account data of the people who use the system, Thrust is the CONTROLLER: it decides the purposes and answers for them.
For the buyer data a customer company enters or imports, the customer company is the CONTROLLER and Thrust is the PROCESSOR: the company decides what to upload and why, and Thrust processes that data on its behalf and instructions, only to provide the contracted service and never for a purpose of its own. Thrust did not collect that data from the individuals, has no relationship with them, and uses it for nothing beyond making the product work for the company that uploaded it.
In the Terms of Service, the customer company states that it has a legal basis to process the personal data it enters or imports. When a buyer contacts Thrust, the request is forwarded to the customer company, which is the one that decides about that data.
This characterisation is the position Thrust takes today and awaits confirmation in the final legal review.
- Data of the people who use the system: the people at the customer company, and at Thrust, who sign in.
- Buyer data: the people who bought from the customer company and show up in its entries and in the spreadsheets it imports.
3. What data we handle
Payment details (card number, expiry date, security code) do NOT go through Thrust Base and never reach our servers: they are typed directly into the payment provider, which is who stores them.
Spreadsheets, CSV files and pasted text are read IN THE BROWSER of the person importing: the file itself does not travel to the server, which receives only the already normalised records and a code for the file. Photos, screenshots and PDFs are the exception, and section 5 explains it.
| Data | Whose | How it gets in | What it is for |
|---|---|---|---|
| Name and email | person using the system | sign-up, invitation or Google sign-in | creating and keeping the account, identifying who made each change, sending service notices |
| Password | person using the system | sign-up or reset | authentication. It lives only with the sign-in provider, hashed. Thrust never sees your password |
| Role in the company (owner, admin, member) | person using the system | set by whoever invites them | deciding what each person can do in the account |
| Preferred language | person using the system | chosen on screen | showing the product and the emails in that person's language |
| Company name and city | customer company | sign-up and onboarding | identifying the account and organising the analyses |
| Answers to the initial questionnaire | customer company | onboarding | building the company's funnel stages and indicators |
| Buyer name, phone and city | buyer of the customer company | manual entry or an import done by the company | grouping repeat buyers, building the buyer card and the company's commercial analyses |
| Date, amount and source of each sale | buyer of the customer company | manual entry or import | the company's results, repeat-purchase rates and indicators |
| Change history (before and after) | buyers and people using the system | every write in the system | audit: knowing what changed, when and by whom |
| Support requests: subject, messages, category, language, role, plan at the time and the screen the request came from | person using the system | when talking to support inside the product | answering the request with context, without making the person repeat who they are |
| Record of emails sent: recipient, type, language, delivery state and the provider's identifier | person using the system | every time the product decides to send an email | not sending the same message twice, retrying when it fails, and stopping emails to an address that bounced or complained |
| IP address | whoever accesses | request header | two different purposes. (1) rate-limiting sign-ups, password resets and support requests: for that it goes into a temporary counter, hashed, for at most 24 hours. (2) forming the application access record the law requires us to keep for 6 months, under confidentiality (section 8) |
| Billing data (once billing is active): customer and subscription identifiers, plan, billing period, payment status and dates | customer company | when a plan is purchased | tracking what the company bought and the access that goes with it |
DataName and email
Whoseperson using the system
How it gets insign-up, invitation or Google sign-in
What it is forcreating and keeping the account, identifying who made each change, sending service notices
DataPassword
Whoseperson using the system
How it gets insign-up or reset
What it is forauthentication. It lives only with the sign-in provider, hashed. Thrust never sees your password
DataRole in the company (owner, admin, member)
Whoseperson using the system
How it gets inset by whoever invites them
What it is fordeciding what each person can do in the account
DataPreferred language
Whoseperson using the system
How it gets inchosen on screen
What it is forshowing the product and the emails in that person's language
DataCompany name and city
Whosecustomer company
How it gets insign-up and onboarding
What it is foridentifying the account and organising the analyses
DataAnswers to the initial questionnaire
Whosecustomer company
How it gets inonboarding
What it is forbuilding the company's funnel stages and indicators
DataBuyer name, phone and city
Whosebuyer of the customer company
How it gets inmanual entry or an import done by the company
What it is forgrouping repeat buyers, building the buyer card and the company's commercial analyses
DataDate, amount and source of each sale
Whosebuyer of the customer company
How it gets inmanual entry or import
What it is forthe company's results, repeat-purchase rates and indicators
DataChange history (before and after)
Whosebuyers and people using the system
How it gets inevery write in the system
What it is foraudit: knowing what changed, when and by whom
DataSupport requests: subject, messages, category, language, role, plan at the time and the screen the request came from
Whoseperson using the system
How it gets inwhen talking to support inside the product
What it is foranswering the request with context, without making the person repeat who they are
DataRecord of emails sent: recipient, type, language, delivery state and the provider's identifier
Whoseperson using the system
How it gets inevery time the product decides to send an email
What it is fornot sending the same message twice, retrying when it fails, and stopping emails to an address that bounced or complained
DataIP address
Whosewhoever accesses
How it gets inrequest header
What it is fortwo different purposes. (1) rate-limiting sign-ups, password resets and support requests: for that it goes into a temporary counter, hashed, for at most 24 hours. (2) forming the application access record the law requires us to keep for 6 months, under confidentiality (section 8)
DataBilling data (once billing is active): customer and subscription identifiers, plan, billing period, payment status and dates
Whosecustomer company
How it gets inwhen a plan is purchased
What it is fortracking what the company bought and the access that goes with it
4. Why we process it
The bases below were chosen from the real purpose of each activity, and they are among the points under final legal review.
| Processing | Basis | Why |
|---|---|---|
| Account, sign-in and roles | performance of a contract | without an account there is no way to provide the service that was bought |
| Buyer data uploaded by the company | processing on behalf of the customer company | the purpose and the legal basis are chosen by the company, which decides what it uploads; Thrust only processes |
| Support requests | performance of a contract | answering the request is part of the service |
| Service emails (account, billing, support) | performance of a contract | they are notices about the relationship itself, not marketing |
| Change audit | legitimate interest and security | knowing who changed what protects the customer company itself |
| Error monitoring | legitimate interest | keeping the service running; personal data is stripped before it is sent |
| Rate limiting by IP | legitimate interest | stopping abuse and bots on sign-up, password reset and support |
| Billing and financial records | performance of a contract and legal obligation | charging for what was bought and keeping what the law requires us to keep |
| Advertising measurement on the marketing page | consent | it only happens if you accept, and a decline is stored just the same. It tells us which ad brings customers; none of it happens inside the product |
ProcessingAccount, sign-in and roles
Basisperformance of a contract
Whywithout an account there is no way to provide the service that was bought
ProcessingBuyer data uploaded by the company
Basisprocessing on behalf of the customer company
Whythe purpose and the legal basis are chosen by the company, which decides what it uploads; Thrust only processes
ProcessingSupport requests
Basisperformance of a contract
Whyanswering the request is part of the service
ProcessingService emails (account, billing, support)
Basisperformance of a contract
Whythey are notices about the relationship itself, not marketing
ProcessingChange audit
Basislegitimate interest and security
Whyknowing who changed what protects the customer company itself
ProcessingError monitoring
Basislegitimate interest
Whykeeping the service running; personal data is stripped before it is sent
ProcessingRate limiting by IP
Basislegitimate interest
Whystopping abuse and bots on sign-up, password reset and support
ProcessingBilling and financial records
Basisperformance of a contract and legal obligation
Whycharging for what was bought and keeping what the law requires us to keep
ProcessingAdvertising measurement on the marketing page
Basisconsent
Whyit only happens if you accept, and a decline is stored just the same. It tells us which ad brings customers; none of it happens inside the product
5. Artificial intelligence: exactly where
Thrust Base uses Anthropic's artificial intelligence in five places, and nowhere else. The list is deliberately exhaustive: saying only that we "may use AI" would hide precisely what matters.
- AI is used to transcribe and to draft supporting text. It decides nothing on its own: it stores no data, and whatever it returns is validated before it becomes information on screen.
- When no key is configured, the first two places keep working through deterministic rules, with no AI, and the screen says so.
- Files sent for image reading are not stored by Thrust: they are read and discarded within the same request. What stays is the result the person confirmed.
- Thrust does not use customer data to train its own models, because it trains no models at all. What the AI provider does with the content sent to it is governed by that provider's terms, and confirming that point contractually is on this policy's pending list.
| Where | What is sent | When |
|---|---|---|
| Funnel suggestion during initial setup | the questionnaire answers and the free text the person writes about the business | once, during onboarding, if a key is configured |
| Interpreting an indicator the person writes | the name and description of the indicator, as typed by the person | when creating a custom indicator |
| Executive summary of a period | the company name, aggregated figures for the period and CITY names. Buyer names and phone numbers are NOT sent: analyses that name a buyer are removed before sending, and an automated test proves it | when the person asks for the summary |
| Column question during import | the column header and up to FIVE sample values from it, with emails, phone numbers and national ID numbers replaced by asterisks. A sample value may contain a buyer's name, because a name cannot be reliably stripped | only when the system cannot decide on its own what the column is |
| Reading photos, screenshots and PDFs | the WHOLE FILE, as an image or a PDF, so it can be transcribed into a table | only when the person chooses to import from an image or a PDF (a Pro plan feature) |
WhereFunnel suggestion during initial setup
What is sentthe questionnaire answers and the free text the person writes about the business
Whenonce, during onboarding, if a key is configured
WhereInterpreting an indicator the person writes
What is sentthe name and description of the indicator, as typed by the person
Whenwhen creating a custom indicator
WhereExecutive summary of a period
What is sentthe company name, aggregated figures for the period and CITY names. Buyer names and phone numbers are NOT sent: analyses that name a buyer are removed before sending, and an automated test proves it
Whenwhen the person asks for the summary
WhereColumn question during import
What is sentthe column header and up to FIVE sample values from it, with emails, phone numbers and national ID numbers replaced by asterisks. A sample value may contain a buyer's name, because a name cannot be reliably stripped
Whenonly when the system cannot decide on its own what the column is
WhereReading photos, screenshots and PDFs
What is sentthe WHOLE FILE, as an image or a PDF, so it can be transcribed into a table
Whenonly when the person chooses to import from an image or a PDF (a Pro plan feature)
6. Who we share it with
Thrust does not sell personal data. Sharing is limited to the providers below. Each one was confirmed in the production configuration; none is listed merely because a package is installed.
The last two are ADVERTISING MEASUREMENT providers and exist only on the marketing page, never inside the product. They are activated only if you accept on your first visit (section 12). Nothing your company enters into the product — a sale, a buyer, a customer — ever reaches them.
| Provider | What it does | What can reach it |
|---|---|---|
| Supabase | database and sign-in provider | all the data in section 3, including buyer data |
| Vercel | hosting, execution and access logs | technical request data: route, response code, duration and the company's internal identifier. Buyer names, phone numbers and emails do not go into the access log |
| Anthropic | artificial intelligence | exactly what section 5 lists, and nothing beyond it |
| Resend | sending the service emails | the name and email address of the person using the system, and the content of the message sent. Buyer data does not go |
| Sentry | error monitoring | the error type and message, already with emails, phone numbers, ID numbers, passwords, tokens and cookies replaced by asterisks, plus route, release and the company's internal identifier |
| Stripe | payments and subscriptions | the customer company's name, email and payment details, provided directly by it. Commercially live since October 2026: payment happens inside Stripe's environment, and card details never pass through our servers |
| Meta (Facebook) | advertising measurement, only on the marketing page and only with your consent | that you viewed the page and that you clicked to subscribe, with your browser's identifier (the _fbp and _fbc cookies) and, on a confirmed purchase, your email in hashed form, which Meta uses to recognise you without receiving the address in the clear |
| Microsoft (Clarity) | understanding how the marketing page is used, only with your consent | how the page was used: clicks, scrolling and pointer path. It receives nothing from the product and no buyer data |
ProviderSupabase
What it doesdatabase and sign-in provider
What can reach itall the data in section 3, including buyer data
ProviderVercel
What it doeshosting, execution and access logs
What can reach ittechnical request data: route, response code, duration and the company's internal identifier. Buyer names, phone numbers and emails do not go into the access log
ProviderAnthropic
What it doesartificial intelligence
What can reach itexactly what section 5 lists, and nothing beyond it
ProviderResend
What it doessending the service emails
What can reach itthe name and email address of the person using the system, and the content of the message sent. Buyer data does not go
ProviderSentry
What it doeserror monitoring
What can reach itthe error type and message, already with emails, phone numbers, ID numbers, passwords, tokens and cookies replaced by asterisks, plus route, release and the company's internal identifier
ProviderStripe
What it doespayments and subscriptions
What can reach itthe customer company's name, email and payment details, provided directly by it. Commercially live since October 2026: payment happens inside Stripe's environment, and card details never pass through our servers
ProviderMeta (Facebook)
What it doesadvertising measurement, only on the marketing page and only with your consent
What can reach itthat you viewed the page and that you clicked to subscribe, with your browser's identifier (the _fbp and _fbc cookies) and, on a confirmed purchase, your email in hashed form, which Meta uses to recognise you without receiving the address in the clear
ProviderMicrosoft (Clarity)
What it doesunderstanding how the marketing page is used, only with your consent
What can reach ithow the page was used: clicks, scrolling and pointer path. It receives nothing from the product and no buyer data
7. International transfers
The providers above are foreign companies and may process data outside Brazil. The application itself runs in São Paulo (Vercel's gru1 region), as declared in the project configuration.
Each provider's storage region and the contractual instrument covering each transfer are being confirmed provider by provider, and this section will be completed with the result. Until then, the honest statement is this one: international transfers do happen, and the instruments are being confirmed.
8. How long we keep it
While the account exists and the subscription is in good standing, the data stays. What happens afterwards is implemented in the system, not a promise on paper:
- When a subscription genuinely ends, a 90-day window opens. Nothing is deleted during it, and subscribing again cancels the window with nothing lost.
- Once the 90 days are over, a daily task deletes the company and, with it, sales, daily entries, buyers, buyer aliases, possible duplicates, imports, import attempts, indicators, onboarding answers, change history, the cancellation questionnaire, support requests and their messages. The people's sign-ins and profiles are deleted in the same step.
- Two things deliberately survive, with no link to the company: the financial event trail, which holds no personal data (only the event identifier, type, date and a cryptographic digest of the body), and the record of the deletion itself, which exists so that deletion can be audited.
- Records we are legally required to keep are retained even after the account is deleted, and only those. There are two sets, each with its own basis and period:
- Tax and accounting documents of the commercial relationship (invoices, payment receipts, accounting entries): kept for 5 years, the period during which Brazilian tax authorities may still assess and collect a tax credit (National Tax Code, articles 173, 174 and 195). These documents concern the relationship between Thrust and the customer company, and contain no buyer data.
- Application access records: kept for 6 months, because Brazilian Law 12.965/2014, the Internet Civil Framework, requires an application provider to keep them for that period, under confidentiality, and to disclose them only under a court order (article 15). The record holds TWO pieces of information, and nothing beyond: the date and time of the access, and the address it came from. It does not store which screen was opened, who was signed in, which company, which browser, or any content. One row per access to the application, not per image, file or internal screen request.
- These records are genuinely confidential: there is no screen, menu, export or query that reaches them, and not even Thrust reads them through a browser. The only path is the server, and disclosure to a third party requires a court order. Once the 6 months are over, a daily routine deletes them automatically.
- The 6-month period is independent of the 90 days above: ending or deleting an account does not erase access records the law requires us to keep, and the access record holds nothing that links an access to a company.
- Outside those two sets, nothing is kept under a legal obligation. The periods and the basis above are the position Thrust takes today, and they await confirmation in the final legal review.
- Error monitoring records and hosting access logs follow the retention period of the plan contracted with each provider.
- IP attempt counters (the abuse brake, which is a different thing): at most 24 hours, and already hashed.
- Record of emails sent: kept as an operational trail, without the body of the message.
9. Deletion requested by the company
A customer company can ask for its data to be deleted at any time, from inside the product, under Settings and then the Privacy tab. The account owner is the person who can make that request.
The request is recorded, generates an email receipt, and is carried out by Thrust after confirming with the person. That is deliberate: deleting an entire account cannot be undone, and an accidental click must not wipe a company's records.
The same screen offers a full copy of the data beforehand, and that works on any plan, including for an account whose access is blocked over payment.
Deletion on request and deletion after the 90 days use the SAME routine in the system: there are not two different deletions, one more thorough than the other.
10. Security
- Each company sees only its own data: the company always comes from the session, never from a browser parameter, and the database enforces the same rule through access policies.
- Nothing is written by the browser: a signed-in user has read-only permission on the database, and every write goes through the server.
- Passwords live only with the sign-in provider, hashed. Thrust has no access to anyone's password and never asks for a password by email, by phone or through support.
- Support requests are visible to the person who opened them, not to colleagues at the same company.
- Error messages sent to monitoring go through a cleaning step that removes emails, phone numbers, ID numbers, passwords, tokens and cookies.
- Exports, changes and deletion requests are recorded in the company's history.
11. Your rights over your data
Anyone may request confirmation that their data is being processed, access to it, correction, portability, information about sharing, anonymisation, blocking and deletion, among the other rights set out in Brazil's General Data Protection Law (LGPD).
Channel for these requests: contato@thrustmarketing.com.br. Requests are answered within the period set by applicable law; under the LGPD, a request in simplified format is answered immediately and the complete statement within 15 days.
Inside the product, with no need to write to anyone, you can already: change your own name and language, change your own password, change the account email address with confirmation, download a full copy of the company's data as JSON and CSV, cancel the subscription and request deletion of the account.
If the request comes from a buyer whose data was uploaded by a customer company, Thrust forwards the request to that company, which is the one that decides about that data, and supports it technically in answering.
12. Cookies and browser storage
Two things behave differently here, so they are described separately: the MARKETING PAGE (where you learn about the product and pick a plan) and the PRODUCT (where you sign in and work).
INSIDE THE PRODUCT there is no third-party script at all: no Google Analytics, no Tag Manager, no Meta Pixel or equivalent, and no advertising cookie. The cookies listed below belong to the service itself and exist so it can work.
ON THE MARKETING PAGE there are two measurement tools, described in section 6: the Meta Pixel and Microsoft Clarity. They are NOT loaded before you choose: on your first visit you see a notice with the options to accept or decline, and no measurement happens while you have not decided. If you decline, neither is loaded and none of their cookies is created. Your choice is stored in your browser and can be changed at any time through the "Privacy preferences" link in the page footer.
| What | What it is for | How long |
|---|---|---|
| Sign-in provider cookies | keeping you signed in across screens | for as long as the session lasts |
| tb_consentimento (marketing page) | remembering whether you accepted or declined measurement, so you are not asked again on every visit. It is created for either answer, including a decline | up to six months |
| _fbp and _fbc (Meta) — ONLY if you accept | recognising the browser and linking the visit to the ad you clicked, so we can measure which ad brings customers | up to three months |
| Microsoft Clarity cookies — ONLY if you accept | understanding how people use the marketing page (where they click, where they stop) | set by Microsoft, up to a year |
| rc_idioma | remembering the language you chose, including before you sign in | up to a year, or until you sign out |
| rc_company | remembering which company Thrust is viewing while helping you | for as long as the session lasts |
| rc_sidebar | remembering whether the menu is expanded or collapsed | up to a year |
| rc_vista_registro | remembering which view you left the sales log in | up to a year |
| Tab storage (sessionStorage) | holding an onboarding draft and remembering that a notice was dismissed in this tab | cleared when the tab closes |
WhatSign-in provider cookies
What it is forkeeping you signed in across screens
How longfor as long as the session lasts
Whattb_consentimento (marketing page)
What it is forremembering whether you accepted or declined measurement, so you are not asked again on every visit. It is created for either answer, including a decline
How longup to six months
What_fbp and _fbc (Meta) — ONLY if you accept
What it is forrecognising the browser and linking the visit to the ad you clicked, so we can measure which ad brings customers
How longup to three months
WhatMicrosoft Clarity cookies — ONLY if you accept
What it is forunderstanding how people use the marketing page (where they click, where they stop)
How longset by Microsoft, up to a year
Whatrc_idioma
What it is forremembering the language you chose, including before you sign in
How longup to a year, or until you sign out
Whatrc_company
What it is forremembering which company Thrust is viewing while helping you
How longfor as long as the session lasts
Whatrc_sidebar
What it is forremembering whether the menu is expanded or collapsed
How longup to a year
Whatrc_vista_registro
What it is forremembering which view you left the sales log in
How longup to a year
WhatTab storage (sessionStorage)
What it is forholding an onboarding draft and remembering that a notice was dismissed in this tab
How longcleared when the tab closes
13. Children
Thrust Base is a work tool, meant for companies and the professionals they authorise. It is not directed at children, and Thrust does not knowingly collect their data.
14. Changes to this policy
When this text changes, the version and the date at the top change with it. Material changes are communicated to customer companies at the email address on file.
15. Contact
Contact for privacy and data protection matters: contato@thrustmarketing.com.br. Today this is the same general contact channel as Thrust Marketing's.
Formally appointing a data protection officer is under consideration and, once there is one, the name and contact details will be published in this section. Until then, the address above is the valid channel for any request about personal data, and it is monitored.