Privacy Policy

Who we are

Think Apps AI Ltd runs Think Projects. For your account — your name, email address, sign-in records and billing details — we are the data controller. For what goes on inside a workspace — the messages, tasks, files and comments — the organisation that owns the workspace is the controller and we are its processor, acting on its instructions. The practical difference is who to ask: a request about your account comes to us, and a request about the content of a workspace goes to whoever runs that organisation. If you are not sure who that is, email us and we will point you to them.

What we collect

Your name, email address and password (stored as a one-way hash); the organisations you belong to; the messages, files and tasks you and your colleagues create; and technical records such as sign-in times and IP addresses used to keep accounts secure.

Most of that you give us yourself, but not all of it. Two other routes exist and you should know about both. An administrator who invites you types your name and email address before you have any relationship with us. And when an organisation imports a project from another tool — Teamwork, Trello, Asana, ClickUp, monday or a spreadsheet — the export can contain the names and email addresses of everyone who worked on it, and we create people from them so the history still makes sense. If you appear in Think Projects that way and would rather not, email us and we will deal with it.

Signing in with Google

If you choose to sign in with Google, Google sends us your name, your email address and confirmation that the address is verified, and we store those with your account so we can recognise you next time. That is all we ask Google for: we get no access to your Gmail, Drive, contacts or anything else in your Google account, and we do not send Google any of your Think Projects data. We never sell what Google gives us and never pass it to anyone for their own purposes; it is held and used exactly like an email address you typed in yourself, which means the suppliers listed below — our host, and our email provider when we send you something — handle it on our behalf. You can disconnect Google from your account at any time under My settings → Sign-in methods (set a password first so you can still sign in), and you can also revoke our access from your Google account's security settings. Signing in with Google is optional; an email address and password work just as well.

Reply by email

Notification emails may carry a reply address. When you answer one, your reply is received by Cloudflare on our behalf and passed to the service, which posts it on the thread or task it was about under your name. Only a reply sent from the email address the notification went to is accepted; the email itself is not kept once it has been posted.

Trial tips by email

If you opt in when you sign up, we use your name and email address to send a short series of emails to help you get started with Think Projects during your trial. Our lawful basis is your consent. You can withdraw it at any time using the unsubscribe link in any of these emails or in Settings → Notifications. We do not use tracking pixels in these emails, and we never share your email address with anyone for their own marketing.

Why we use it

To run the service you signed up for, to keep it secure, to send emails the service needs to send (invitations, password resets, notifications you have turned on, billing), and to answer support requests. We do not sell personal data and we do not show advertising.

Legal basis (UK and EU law), by what we are actually doing:

• Our contract with you — running the service, keeping your account, sending the emails the service cannot work without (confirmations, invitations, password resets, billing, and the warning before a workspace closes), and taking payment.
• Our legitimate interests — keeping the service secure and free of abuse, and understanding how it is used so we can improve it. Two-factor authentication sits here too when an organisation requires it of its members, since that is the organisation's decision rather than a free choice by each person.
• Your consent — the trial tips, and nothing else. It is a single unticked box at sign-up, you can withdraw it in one click, and withdrawing it changes nothing else about your account.
• Legal obligation — keeping invoices and tax records for as long as the law requires.

Support access is not on that list, and deliberately: it is switched on by an organisation's owner or administrator as an instruction to us, not as consent given by every person whose name appears in the workspace. Notification emails are part of the service you asked for; which ones you receive is a setting, not a lawful basis.

Where it lives and how it is protected

Data is stored on servers in the European Union (Hetzner, Finland). Files and backups are held on Cloudflare R2 in its EU jurisdiction, encrypted at rest — a jurisdiction, rather than a region setting, means Cloudflare undertakes that those objects stay in the European Union rather than merely starting there. Each organisation's content is kept in its own separate database. Everything travels over HTTPS. You can add two-factor authentication to your account, and an organisation can require it for everyone.

How long we keep it

For as long as your organisation exists. When an organisation is deleted its data is removed within 30 days; when a plan lapses, or a trial ends without one, it is kept for 90 days and then deleted, with an email to the owner beforehand. Backups roll off within 30 days after that. Sign-in records are kept for 12 months. Invoices and payment records are held by Stripe and kept as long as tax law requires; we hold only the identifiers that link your organisation to them.

One thing is worth stating plainly, because people expect the opposite. When someone is removed from an organisation — or deletes their own account — their membership, notifications and follows go, and their name comes off what they wrote. The messages, replies, comments and tasks themselves stay in the workspace, without an author. They are the organisation's record of its own work, and removing them would tear holes in conversations other people are still relying on. If you need the content itself taken out, not just your name, ask the organisation that owns the workspace: they can delete any of it, and we will act on their instruction.

Who else sees it

Nobody here can open your organisation's projects, messages, tasks or files through Think Projects unless you switch on support access under Admin → Organisation. That access is read-only, lasts only as long as you allow, and every time we look in it is listed there and emailed to your organisation's owner. Without it we see only account, plan and usage details. What that control cannot do is stand between your data and the handful of people who administer the servers it runs on: they can reach the databases and files directly, because keeping a service alive requires it. They do so to run it, not to read it, and we would rather say that than imply a wall that is not there. If you use GIF search, the search words are sent to KLIPY, our GIF provider.

Beyond that, only the suppliers needed to run the service, under contract: Hetzner (hosting, Finland), Cloudflare (network, security, and file and backup storage in its EU jurisdiction), Resend (sending email, from Amazon's Ireland region), Stripe (payments — they handle card details, we never see them) and KLIPY (GIF search). We tell you here if that list changes.

Where your content goes

Your workspace — its database, its files and its backups — is stored in the European Union, as described above. Two things travel beyond it, and both are worth naming rather than glossing.

Email. A notification email tells you what happened, which means it carries the title and roughly the first few hundred characters of the message or task it is about. That is your content, in an email, and it passes through Resend, who send our mail. Resend sends from Amazon's Ireland region, so in practice this stays in the EU; Resend is a United States company, and where any handling does happen outside the UK or EEA it is covered by standard contractual clauses and the UK addendum. If you would rather your content never left in an email, turn notification emails down to the bare minimum in My settings → Notifications — the essential ones cannot be switched off, but they carry no workspace content.

Payments. Stripe processes billing details in the United States, under standard contractual clauses and the UK/EU–US data bridge. Nothing from inside your workspace is ever sent to Stripe.

Your rights

You can ask to see what we hold about you, correct it, export it, or have it deleted. You can also object to processing we base on our legitimate interests, ask us to restrict processing while a question is being sorted out, and withdraw consent to the trial tips at any time without affecting anything you agreed to before. An organisation's owner can export or delete a whole organisation from its settings, including while it is read-only.

Where the request is about the contents of a workspace rather than your account, the organisation that owns it decides, and we act on their instruction — but you do not have to work out which is which. Email [email protected] and we will either deal with it or tell you who can. If you are unhappy with how we handle it you can complain to the Information Commissioner's Office, or to your own country's data protection authority.

Cookies

Think Projects sets one cookie, to keep you signed in, and uses your browser's local storage to remember your theme and settings. Our network provider, Cloudflare, may set its own cookies on our domains to tell real visitors from automated traffic. There are no advertising cookies, no analytics cookies and no tracking scripts of any kind, which is why you are not being asked to dismiss a banner.

Contact

Think Apps AI Ltd, registered in England and Wales, company number 16590741, registered office 12 Hibel Road, Macclesfield SK10 2AB. Email [email protected] for anything about your data; we answer within a few working days.