Last updated: October 19, 2026
ThinkingStreams is built and operated by Thinking Streams Inc., a Delaware corporation ("Thinking Streams", "we", "us"). ThinkingStreams is currently in Public Preview.
This policy explains what we do with personal data. It covers two different things, because we play two different roles depending on which one you are.
Controller or processor — which applies to you
If you're a visitor to this website, or a lead who filled in a form — we are the controller. We decide what data is collected and why, and this policy is about that.
If you're a user of the ThinkingStreams platform, working with data your company has put into it — we are a processor, acting on your company's instructions. Your company (our customer) is the controller of that data, and its own privacy policy is what governs your relationship with it. ThinkingStreams syncs two-way with your CRM — Microsoft Dynamics 365 is currently the CRM integration we support — and your CRM stays the system of record; we don't become the controller of your CRM data by processing it.
Where something below applies only to one of these roles, it says so.
What we collect on this website (as controller)
Form submissions. When you fill in a form on this site — to book a demo, request pricing, or ask a question — we collect what you type into that form, typically a name, work email, and company details.
Cookies and web tracking. This site uses Google Tag Manager, which loads Google Analytics 4 and the LinkedIn Insight Tag. None of it is loaded at all until you accept in the cookie banner — not loaded-and-asked-to-behave, but not requested. If you decline, no analytics or advertising code reaches your browser. The ThinkingStreams web forms embedded on this site set their own cookies, described below. See the next section for exactly what's stored.
Cookies and consent
Set by us, on this domain only. These are readable only by us, are never shared with other companies, and can't be used to follow you across other websites.
| Cookie | What it holds | Lifetime |
|---|---|---|
_tstr_c | Whether you granted or denied consent. Set as soon as you answer the banner, so we don't ask again. | 13 months |
_tstr_vk | A random visitor ID, set by the ThinkingStreams forms embedded on this site. Meaningless on its own. | 13 months |
_tstr_ih | A scrambled, one-way version of your email address — only set once you've identified yourself, e.g. by submitting a form. It can't be reversed back into an email address. | 13 months |
Set by others, and only if you accept. Accepting loads Google Tag Manager, which in turn loads the two tags below. These are third-party cookies, and unlike ours they can be used to recognise you on other websites. Decline and none of them are requested.
| Source | Cookies | What it's for |
|---|---|---|
| Google Analytics 4 | _ga, _ga_<id> | How many people visit, which pages they read, and where they arrived from. |
| LinkedIn Insight Tag | li_sugr, lidc, bcookie, bscookie, UserMatchHistory, AnalyticsSyncHistory, __cf_bm | Measuring our LinkedIn advertising, and showing ads to people who have visited this site. __cf_bm is LinkedIn's own bot-protection cookie. |
Google and LinkedIn decide for themselves what they do with the data those cookies carry; that is governed by their own policies, not by this one. You can read Google's and LinkedIn's.
If you decline, the only thing stored is _tstr_c, recording that you said no — without it
we would have to ask on every page. Nothing else is set and nothing is loaded.
If your browser sends a do-not-track signal, we respect it automatically. You won't see the banner, nothing is loaded, and no cookie is set at all.
When you submit a form on this site, only your email address and phone number are captured from it — everything else you type is discarded in your browser. Password fields are never captured, and fields that ask for someone else's contact details (for example, "invite a colleague") are skipped too.
What happens inside the platform (as processor)
Once your company is a ThinkingStreams customer, the platform processes the data your company puts into it — contacts, campaign content, journeys, and the CRM records that sync two-way with your CRM (currently, Microsoft Dynamics 365 is the CRM integration available) — strictly on your company's instructions, for the purpose of running your company's marketing. We don't use this data for our own purposes, and we don't sell it.
Customers who need a Data Processing Agreement covering this platform data can request one using the contact details at the bottom of this page.
Sub-processors
To run ThinkingStreams, we use the following sub-processors. This is the complete list — nobody else touches platform data:
| Sub-processor | Purpose |
|---|---|
| Microsoft Azure | Hosting and infrastructure |
| Twilio | Email and SMS delivery |
| bundle.social | Social publishing |
| Anthropic | AI |
| OpenAI | AI |
Our own personnel and contractors may access platform data where that is necessary to operate, debug and support the product, including from outside the United States. Access is limited to those who need it for that work, and they are bound by confidentiality obligations.
AI and training
ThinkingStreams uses AI models from Anthropic and OpenAI to help generate content — drafts, campaign copy, and similar.
How Anthropic and OpenAI handle data submitted to them through ThinkingStreams is governed by their own terms, not by us — we don't control it. You can read their policies directly: Anthropic's privacy policy and OpenAI's privacy policy. This policy doesn't state a specific retention period for either provider, since that's set by them, not us.
International transfers
Thinking Streams Inc. is a US company, and the Microsoft Azure data centres we use to host the platform are in the United States. Customer data is stored there.
For a customer in the EU or EEA, the transfer that matters is EU/EEA → United States. That needs an appropriate safeguard under Chapter V of the GDPR — the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. ThinkingStreams is in Public Preview and we are not yet in a position to state which of these applies to your data.
Where our personnel access data from outside the United States, we rely on appropriate safeguards for those transfers.
If you are subject to the GDPR and intend to put EU/EEA personal data into the platform, please contact us first so we can put the appropriate safeguard in place before you do.
Where our sub-processors are located outside the United States, we rely on the data-transfer safeguards each of them offers under their own terms.
How long we keep data
| Data | Retention |
|---|---|
| Customer content (inside the platform) | Life of the account, plus 30–90 days |
| Backups | 30–35 days, rolling |
| Application and audit logs | 90 days |
| Web-tracking cookies | 13 months |
| Marketing leads (website form submissions) | 24 months from your last engagement with us |
| Billing records | 7 years, to meet tax and accounting record-keeping requirements |
A legal hold overrides any of the periods above — if we're required to preserve data for a legal or regulatory reason, deletion is paused until that hold is lifted. When data is deleted, that deletion is propagated to our sub-processors too.
Your rights
Whoever you are, you can ask us what personal data we hold about you, ask us to correct it if it is wrong, and ask us to delete it. We will honour those requests unless the law requires us to keep the data.
Under GDPR, where it applies to you as an EU or EEA data subject, you additionally have the right to restrict or object to processing, the right to data portability, and the right to lodge a complaint with your local supervisory authority.
Under US state privacy laws, where one applies to you, you may also have the right to know what we collect and why, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
To exercise any of these rights, contact us using the details at the bottom of this page. If your data is held by us as a processor — because it's inside a customer's ThinkingStreams account — we'll direct your request to that customer, since they control it.
Children
ThinkingStreams is a business-to-business product. It isn't directed at, and isn't intended for use by, anyone under 16. We don't knowingly collect personal data from children.
Changes to this policy
We'll update this page as the product and our practices change, and update the "Last updated" date above when we do. For material changes, we'll look for a more prominent way to let you know.
Contact us
Questions about this policy, a request to exercise your rights, or a request for a Data Processing Agreement can be sent to privacy@thinkingstreams.com.
We aim to respond to any request about personal data within 30 days.