Privacy notice
1. Who we are
The controller of your personal information is The Thrivee LLC, a Wyoming limited liability company, which runs this site and our app. Mailing address: 1007 N Orange St. 4th Floor, 2991, Wilmington, DE 19801, USA. Email: [email protected].
We do not sell personal information for money. No sensitive personal information is collected or used to infer anything about you.
2. What we collect, by source
Categories we collect: identifiers and contact details, commercial information, what you tell us in forms, and internet activity on our own site.
- From you
- What you type into our forms. For a growth audit: name, work email, brand, store address, revenue range, platform, goal and message. For the Website Security Patch: where your store runs, work email, website, number of sites and your answers (and, once you pay, the name you gave Stripe); on our store growth page (where the patch's order form sends a store the patch isn't for, with the website, email and answer you gave there): your name, platform, what costs you most, your monthly revenue and ad spend ranges, where most of your sales come from and, for a hacked store, what's happening; for an order, the record that you accepted the terms by pressing Pay and, after payment, your answers about the servers and the authorisation you give (time, shortened IP address and browser each time).
- From our website
- The pages you view, the site that linked to them and the campaign tags of the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content). When you press "Check my site", our server loads your home page once (no scan) to guess the platform; we don't store the page.
- From the ad you clicked
- The ad click identifier in the link, with the landing page, your country and browser type.
- From Stripe
- Whether you paid, the billing address and any tax id you gave at checkout.
- From your servers
- During the patch we see what is on the servers you name. We act as your processor for it (terms clause 13) and keep no copy.
3. Purposes and lawful bases
| Purpose | Lawful basis (UK/EU) |
|---|---|
| Doing the work you order, invoicing, replying to you | Contract |
| Keeping the site secure, counting visits, improving our pages | Legitimate interests |
| Measuring our ads with Google, Meta and TikTok (their pixels and our server's reports) | Consent |
| News and notes by email ("Yes, keep me posted") | Consent |
| Keeping order and dispute records | Legal obligation and legitimate interests |
4. Who receives it
| Recipient | Why | What they get |
|---|---|---|
| Stripe | Card payments and refunds | Your name, email, billing address, tax id, the order amount |
| Cloudflare | Delivers the site and blocks attacks | Your IP address, browser and the pages you request |
| Our hosting provider | Runs our server and database | Everything we hold, stored on our server |
| Our email delivery provider | Sends our email over SMTP | Your name, email address and the message |
| Meta Platforms Ireland Ltd and Meta Platforms, Inc. (Conversions API) | Measures our ads, from our server | That you viewed our landing or order page, started an order, pressed Pay or paid, with: hashed email (once you typed it in the order form), phone and customer number, ad click id, Meta browser id, your IP address and browser type, the page (without its address details), order value; that our team qualified your enquiry |
| TikTok (Events API) | Measures our ads, server-side only | That you viewed a landing, started an order, pressed Pay or paid, with: hashed email, phone and customer number, ad click id, your IP address and browser type, the page (without its address details), order value |
| Google (Google Ads offline conversion upload, Google Analytics Measurement Protocol) | Measures our ads (the upload) and our sales (Google Analytics) | Upload: only that our team qualified your enquiry, with the ad click id, hashed email, time and value; Google Analytics: the Google Analytics browser id, order number, value and currency of a payment, and that our team qualified your enquiry |
| Telegram | Tells the member of our team who looks after your order or enquiry, and our owner, about its steps (paid, access given, not paid yet, a store growth enquiry, a refund or dispute) | The order or enquiry reference, its amount and a link to our own system only |
| Klaviyo | Sends the follow-up emails about your order (a saved order, a payment link, a missed call, after the report) or about the store details you sent on our store growth page (from a Website Security Patch page: a host that manages your store, a hosted platform, or already hacked), and, only if you said "Yes, keep me posted", our news | Your name, email, company, website, country and phone if you gave one; the steps of your order (started, paid, call booked, access given, report sent, refunded) with their links, or the store details you sent (where your store runs, your platform, your website, what costs you most, your monthly revenue and ad spend ranges, where most of your sales come from); the campaign tags of the link that brought you, and the ad click id only where we may share it. Never your hosting access |
| Our engineers and contractors | Do the work you order | What the work needs; bound by confidentiality |
| Google (Google Analytics) | Counts visits to our marketing and order pages; no remarketing or ad personalisation | The pages you view (without their address details), browser, device, approximate location and a random browser id; when you start an order, its value and currency; never your email or what you type in a form |
| Meta Platforms Ireland Ltd and Meta Platforms, Inc. (Meta Pixel) | Measures our ads in your browser | The pages you view, the ad click id, browser, device, IP address and a random browser id; when you start an order or pay, the order value and currency; never your email or what you type in a form |
| Google (Google Ads tag) | Measures which Google ads lead to orders; no remarketing or ad personalisation | The pages you view (without their address details), the ad click id, browser, IP address; when you start an order, its value and currency; on payment, the order number, value and currency; never your email or what you type in a form |
5. Ads and measurement
The cookie banner. If you visit from the EEA, the UK or Switzerland (or we can't tell where you are), a small banner asks first: Accept or Reject; the site works the same either way. Until you press Accept, nothing in this section is loaded or sent about you. We keep your answer in the consent cookie for 12 months, and a record of it (the time, your answer, the banner's words and version, your country, a shortened IP address and browser type) as proof. "Cookie settings" at the bottom of every page opens the banner again: pressing Reject there withdraws your consent, deletes the Meta and Google cookies we can reach (_fbp, _fbc, _ga, _gcl_…) and stops their scripts from loading. Elsewhere there is no banner. Wherever you are, none of this happens if your browser sends the Global Privacy Control signal or you opted out on /privacy/opt-out, whatever you answered.
What we report. To measure our ads, Meta, Google and TikTok are told about these steps: a view of our landing and order pages (and which landing), that you started an order (the order form's first step, with its value and currency), that you pressed Pay, that you paid, and, once our team has checked an enquiry, that it is a qualified lead (never when you just send a form). In your browser the Meta Pixel and the Google tag (Google Analytics and Google Ads) record them; our server sends the same steps to Meta (Conversions API) and TikTok (Events API, from our server only) with the same event id, so each is counted once, and Pay, payments and qualified leads to Google Analytics. Our server sends the ad click id, the ad networks' browser ids, your email (once you typed it in the order form) and phone in hashed (one-way scrambled) form, which is still personal data under UK/EU law, a customer number in the same form, your IP address, your browser type, the page (its path only), the time, and the order value and currency; nothing else. Click ids, browser ids and browser type are deleted from the order 90 days after capture. To withdraw, press Reject under "Cookie settings" or email [email protected]; we then stop any report not yet sent.
We count page views server-side, on our own server, without a cookie: the page, the site that linked to it, the campaign tags, and a daily visitor code made from a shortened IP address and your browser type that cannot be traced back to you and changes every day. On the Website Security Patch pages, our own small script (no cookie, no third party) also counts clicks on the order button and the order form's steps, the same way; it does not run if you opted out or your browser sends Global Privacy Control. Full IP addresses are not stored, except on an ad event waiting to be sent (blanked once sent or failed).
The Meta Pixel and the Google tag run on our marketing and order pages (the home page, contact, the Website Security Patch landings, the order page and the store growth page; never the call, payment, invoice or client pages), loaded by our own script after the page has finished loading, with the limits above. Google gets the page path, campaign tags and Google's ad click id, never the rest of the address; Google signals and ad personalisation are off. None of them is sent your email address or anything you type in a form; after a payment, the thanks page tells Meta and Google about the purchase with a plain image request, without the page's address details. There is no TikTok script on this site.
6. Emails from us
We send email from our own address ([email protected]) through our email provider's SMTP service. We don't connect to anyone's Gmail or Google account to send it, and we keep the messages we send with your order or enquiry. Follow-ups about an order you started (a saved order, a payment link, a missed call, after the report) are sent through Klaviyo, our email service provider. Marketing email goes only to people who said "Yes, keep me posted" (we record when). Every follow-up has an unsubscribe link: unsubscribing stops all of them, in Klaviyo too. Opting out on /privacy/opt-out unsubscribes you in Klaviyo; the follow-ups about your own order (a payment link, a saved order, a missed call) then come from us until you unsubscribe.
Our emails contain a tiny tracking pixel (a 1×1 image), and links to our site or to your own store pass through our own address (thethrivee.com/r/…). This tells us whether an email was opened and which link was clicked. Your email program may block the pixel; that is fine. When you open an offer or invoice link we sent you, we log the view, and for an offer how long the offer page was open.
7. Cookies
The contact page, the order page, the Website Security Patch landings (which have the order form) and the store growth page set a session cookie and a security (CSRF) cookie so the form can be sent securely.
| Cookie | What it does | Lasts | When |
|---|---|---|---|
laravel-session | Keeps a form working while you fill it in | 120 minutes | Strictly necessary |
XSRF-TOKEN | Security (CSRF) check on forms | 120 minutes | Strictly necessary |
consent | Remembers your answer to our cookie banner (accepted or rejected) | 12 months | When you press Accept or Reject (EEA, UK, Switzerland) |
pfd | Keeps your order form draft so you can come back to it | 30 days | When you press Continue on the order form |
trk | A random code after you click a link in our email, so we see which of our pages helped | 90 days | Only after an email click; we ask first where the law requires it |
optout | Remembers your "Do Not Sell or Share" choice | 2 years | Set when you opt out |
_ga | Google Analytics: a random id that tells repeat visits apart | 2 years | On our marketing and order pages; in the EEA, UK and Switzerland only after you press Accept; never if you opted out |
_ga_<id> | Google Analytics: the current visit | 2 years | With _ga |
_fbp | Meta Pixel: a random browser id | 90 days | On our marketing and order pages; in the EEA, UK and Switzerland only after you press Accept; never if you opted out |
_fbc | Meta Pixel: the Meta ad you clicked | 90 days | With _fbp, after a Meta ad click |
_gcl_au | Google Ads: a random browser id for conversion measurement | 90 days | On our marketing and order pages; in the EEA, UK and Switzerland only after you press Accept; never if you opted out |
_gcl_aw | Google Ads: the Google ad you clicked | 90 days | With _gcl_au, after a Google ad click |
Without cookies the site works the same: pages are counted without one, and you can delete any of these in your browser at any time.
8. Retention
| Data | Kept |
|---|---|
| Leads, contacts, orders, invoices, call bookings, enquiries and form messages | As long as we have a business relationship or a legitimate need, which may be indefinite; deleted on request unless the law requires us to keep it |
| Terms acceptance and authorisation records | With the order, as above (we need them to answer card disputes) |
| Ad click ids, the pixels' browser ids and browser type on an order | 90 days after capture (campaign tags are kept) |
| Page views, email opens and clicks, shortened IP addresses | 90 days |
| Blocked break-in attempts (IP address, page, a few characters sent) | 90 days |
| Website Security Patch one-time access links | Deleted when our access is removed, the report is sent or the order is refunded, after 7 days at the latest |
| Order form drafts (saved when you press Continue) | 30 days |
| Ad and notification events waiting to be sent | Contact details and IP address blanked once sent (the IP address also when sending fails); deleted 90 days after sending or failing |
| Your cookie and tracking choices (consent records) | 3 years after the record, as proof of consent, then deleted |
9. Your rights
California and other US states. When you order from an ad we may tell Google, Meta or TikTok about the order to measure our ads, and on our marketing pages Google Analytics counts your visit with its cookies; under US state laws that is "sharing" for advertising. Do Not Sell or Share My Personal Information opts you out with one click, straight away, and so does your browser's Global Privacy Control signal.
You can ask to know or get a copy of what we hold, to delete it or to correct it on our privacy request page or by writing to [email protected]. A person handles each request: we confirm we received it, verify it's you (usually by replying from the email address we have), and complete it within 45 days. An authorised agent may make a request for you with proof of authority. We won't treat you differently for using these rights.
10. UK and EEA visitors
Transfers: The Thrivee LLC, Stripe, Google, Meta and TikTok's US entity are in the US, and our engineers and contractors may be outside the UK and EEA; transfers rely on the EU Standard Contractual Clauses with the UK Addendum, incorporated in our terms. Your rights: access, correction, deletion, restriction, portability, objection and withdrawal of consent at any time (for cookies: Reject under "Cookie settings") via [email protected]. You can complain to the ICO or your local data-protection authority.
11. Canada and Australia
Canada: we handle personal information under PIPEDA, for the purposes above; you can access and correct it through [email protected]. Australia: we handle it in line with the Australian Privacy Principles (there is no cookie banner: you can opt out on /privacy/opt-out or with Global Privacy Control); our engineers and contractors may be outside Australia, and you can complain to the OAIC if you're not satisfied with our answer.
12. Security and children
A request that tries to break in (for example by sending code instead of text) is refused and its IP address is blocked for 24 hours. Our site and services are for businesses and not directed at anyone under 16.