Privacy Policy

This Privacy Policy explains how ANARCHY LAB S.R.L. ("we", "us", "our") collects, uses and protects personal data in connection with the Threadli website, applications and related services (the "Services").

Threadli is a self-hosted communication platform for organizations. Customer organizations install and operate the software on infrastructure of their choice. We do not host or store customer messages, files, tasks or call content.

1. Scope

This Privacy Policy applies to personal data processed directly by us in connection with our website, software licensing, technical operations and support.

Each customer organization manages its own Threadli installation, including user accounts, workspace content, access permissions and data retention.

The customer organization is generally the data controller for personal data processed within its workspace. We do not routinely access workspace content. If we process personal data on behalf of a customer through separately agreed services, the applicable data protection arrangements will apply.

2. Personal data we collect

We may collect the following categories of personal data:

• Contact and business data: name, email address, company details and communications with us.
• Technical data: IP address, device and operating system information, browser type, application version, technical identifiers, access logs and diagnostic information, where necessary for licensing, updates, security or support.
• Notification data: device push tokens, where notifications are enabled and supported through services such as Apple Push Notification
• Support data: information voluntarily provided when requesting assistance.

We do not collect or store messages, chat history, files, tasks or audio and video call content from customer-hosted workspaces.

We do not require special categories of personal data, such as health information or political opinions, for the ordinary operation of our services.

3. How we use personal data

We process personal data for the following purposes and legal bases under the GDPR:

• Providing services and managing licences: performance of a contract (Article 6(1)(b), where applicable) or legitimate interests (Article 6(1)(f)).
• Security, updates and technical operations: legitimate interests in maintaining secure and reliable services (Article 6(1)(f)).
• Customer support and communications: contractual necessity or legitimate interests (Article 6(1)(b) or (f), as applicable).
• Legal compliance: legal obligations or legitimate interests (Article 6(1)(c) or (f), as applicable).

Where processing is based on consent, you may withdraw it at any time.

We do not sell personal data, use it for targeted advertising or make solely automated decisions producing legal or similarly significant effects.

4. Cookies

Our website does not use advertising or analytics cookies or third-party tracking tools.

We use only cookies or similar technologies that are strictly necessary for website functionality and security. These do not require consent under applicable cookie rules.

5. Sharing personal data

We may share limited personal data with:

• Technical, hosting and email service providers;
• Apple and Google, where necessary for application distribution or push notifications;
• Professional advisers, such as accountants and lawyers;
• Public authorities, where legally required;
• Successor entities in connection with a business transfer, subject to applicable law.

Service providers processing personal data on our behalf are subject to appropriate data protection obligations.

We do not share customer-hosted workspace content because we do not collect or store it.

6. International transfers

Customer workspace data is stored on infrastructure selected and controlled by the relevant organization.

Personal data processed directly by us may be transferred outside the European Economic Area where necessary.

Where required by the GDPR, we use appropriate safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses.

7. Data retention

We retain personal data only for as long as necessary:

• Business and licensing data: for the duration of the business relationship and any legally required retention period.
• Support correspondence: up to 2 years after the last communication.
• Accounting records: for the period required by applicable Romanian law.
• Technical logs: up to 30 days, unless longer retention is necessary for security investigations or legal obligations.

Customer organizations determine the retention and deletion of data stored within their self-hosted workspaces.

8. Security

We implement appropriate technical and organizational measures to protect personal data processed by us, including encryption in transit, access controls and security maintenance.

Customer organizations are responsible for hosting, configuring and securing their own Threadli installations, including access management and backups.

We remain responsible for the security of our own systems and for obligations applicable to us as a software provider.

9. Your rights

Under the GDPR, where applicable, you have the right to:

• Access and correct your personal data;
• Request deletion or restriction of processing;
• Object to processing based on legitimate interests;
• Request data portability;
• Withdraw consent where applicable.

To exercise your rights regarding data processed directly by us, contact privacy@threadli.io.

We will respond within one month, subject to extensions permitted by law.

For requests concerning accounts, messages, files or other data within your organization's self-hosted workspace, please contact your organization's administrator.

10. Account deletion

User accounts and workspace content within self-hosted Threadli installations are managed by the relevant organization.

To request deletion of your workspace account or content, contact your organization's administrator.

For personal data processed directly by us, you may request deletion at privacy@threadli.io, subject to applicable legal requirements.

11. Children

Threadli is intended for organizational and professional use and is not directed at children under 16.

We do not knowingly collect personal data directly from children under 16 through our website or licensing services.

12. Third-party services

Our website and applications may link to or integrate with third-party services governed by their own privacy policies.

We are not responsible for third parties' independent processing activities.

13. Changes to this Policy

We may update this Privacy Policy to reflect changes in our Services or applicable laws.

The current version will be available on our website with its effective date. We will provide notice of material changes where required by law.

14. Contact

ANARCHY LAB S.R.L.

Registered office: Bucureşti, Sector 3, Bulevardul Unirii, No. 61, Bl. F3, Staircase 4, Floor 2, Apt. 208, Romania

Registration number: J2026000670007

Email: privacy@threadli.io