Privacy Policy
Effective date: November 16, 2026
1. Who we are
Goldthread is a platform for brand marketers and the marketing service providers they work with, including agencies, consultants and AI-first companies ("providers"). We offer two products.
Brand Workspace is a one-stop shop for brand marketers. In one connected workflow, a marketer can:
- plan a campaign or project, and have the plan flow straight into the next step
- find and choose the right agencies, consultants or other resources, and negotiate the contract directly
- understand what a fair price is, including whether a current agency is good value, across rate-card, project, output and outcome-based pricing
- check finished content before it ships, with an independent review against advertising, health and privacy rules such as FTC, FDA and HIPAA requirements
- see what the work produced, by tracking outcomes and effectiveness
Search is part of Brand Workspace. Some of these features are introduced over time, and this policy applies to each one when it is available.
Provider Workspace is where providers build and manage their profiles, and respond to brands.
This policy covers both products, the website goldthread.ai, and the emails we send.
Goldthread, Inc. ("Goldthread", "we", "us") is responsible for your information.
Address: 109 Culebra Terrace, San Francisco, CA 94109, United States
Contact: privacy@goldthread.ai
Goldthread is a business service for people acting on behalf of a company. It is not meant for children, and we do not knowingly collect information from anyone under 18.
2. Our role
For most of the information in this policy, Goldthread decides why and how it is used. In privacy law, that makes us the "controller". When a brand uploads briefs, documents or other confidential material, we use that material to provide the service to that brand, as the Brand Terms describe. If a customer needs a data processing agreement, we provide one on request.
3. Information we collect
3.1 From brands (Brand Workspace)
| What | Examples |
|---|---|
| Account details | Name, work email, phone number, company, job role, and sign-in codes |
| Briefs | What you type in chat and the documents you upload. Briefs can contain confidential business information. |
| Search activity | Your criteria and priorities, your chat with our assistant, the providers you shortlist or pass on and why, your notes, and searches you share with colleagues |
| Requests to providers | Messages, questions and RFI or RFP content you send to providers through Goldthread, and their replies |
| Roster | The providers you already work with, plus anything you add about them, such as contract notes, rate cards, renewal dates, and a contact person's name and email |
| Plans | Campaign and project plans you create, including goals, budgets, timelines and deliverables |
| Contracts and negotiations | Draft contracts, terms, scopes and prices you negotiate with providers through Goldthread |
| Pricing you share | What you pay or are quoted by current and prospective providers, so we can tell you whether it is fair |
| Content for review | Ads, copy, claims, images and other assets you submit for a compliance check, and the results |
| Outcomes and results | Whether you hired a provider, how the work went, and the results you record, such as spend, delivery and performance measures |
| Connected tools | Information from other tools you choose to connect to Goldthread, limited to what you authorize |
3.2 From providers (Provider Workspace)
| What | Examples |
|---|---|
| Account and team | Your name, work email and role. Your organization's members and their permissions (admin, member, viewer). |
| Profile | Questionnaire answers: services, industries, locations, team size, client list, case studies, awards, pricing model, typical project size, and key people (name, title and profile link) |
| Confidential client settings | Which clients you mark as confidential |
| Uploaded documents | Decks, PDFs, spreadsheets and RFP responses. We keep the original file and a compressed copy. |
| Replies and negotiations | Messages, quotes, timing and answers you send in reply to brand requests, and the scopes, terms and prices you negotiate with brands |
| Sign-up source | The campaign codes in the link you used to sign up (for example, which email or button brought you). For this purpose, we do not store the full link, your IP address or other browser details. |
3.3 From public sources
To help brands find providers before those providers join, we build basic agency profiles from public websites. Our crawler, GoldthreadBot, follows each site's robots.txt instructions. From public pages we collect:
- company information, services, clients and case studies
- the names, roles, short bios and LinkedIn links of people a website lists
- contact email addresses and phone numbers, but only where the website shows them
We may also use input from industry experts and other trusted sources. If information about you came from a public website, section 9.3 explains how to have it corrected or removed.
3.4 Collected automatically
| What | Details |
|---|---|
| Product usage | Actions in our products, such as opening a search or publishing a profile. We record these ourselves and do not use outside analytics tools in the products. |
| Technical data | Security logs, including the IP address used for sign-in and account actions, and error reports |
| Browser storage | Our products keep your sign-in session and display preferences in your browser's storage. |
| Website | goldthread.ai uses HubSpot to understand visits and manage contact requests. See section 10. |
| Whether our emails were delivered |
3.5 Health and other sensitive information
Goldthread is not designed to hold patients' health information, and we do not act as a HIPAA business associate. Our compliance check reviews marketing content against rules such as HIPAA. It is not a place to store patient records. Do not upload protected health information, payment card data, government ID numbers or other sensitive personal information. If we find such information, we may delete it.
4. How we use information
We use information to:
- Provide the service. Run accounts, build and show provider profiles, understand briefs and plans, rank and explain matches, deliver requests, replies and negotiations, give price guidance, run compliance checks, track results, and keep shared work in sync.
- Run AI features. See section 5.
- Communicate with you. Send sign-in codes, notifications, service messages and, where allowed, news about Goldthread. You can unsubscribe from marketing emails at any time.
- Improve Goldthread. Use product usage data, plus aggregated or de-identified data, to fix problems and improve matching and recommendations. A brand's confidential content helps improve the service for other customers only in aggregated or de-identified form.
- Create aggregated and de-identified insights. See section 7.
- Keep the platform safe. Prevent fraud, abuse and security incidents, and enforce our terms.
- Meet legal obligations.
Where UK or EU data protection law applies, our legal bases are:
- performing our contract with you or your company
- our legitimate interests in running, securing and improving a business marketplace
- your consent, for example for website cookies
- compliance with the law
5. How we use AI
Goldthread uses AI models from Anthropic (Claude) and OpenAI to:
- read briefs and uploaded documents
- run the Brand Workspace assistant
- turn provider documents into draft profile answers
- find and rank matching providers
- summarize request threads for the brand that sent them, where the brand uses Inbox
- help brands plan campaigns, draft and compare contract terms, and assess whether a price is fair
- check marketing content for possible compliance issues
To do this, these companies receive the relevant text. That can include briefs, plans, chat messages, provider profiles, uploaded documents, providers' replies, contract terms and content submitted for review. We also use Google Document AI to read text from scanned documents.
What we have set up with these AI providers:
- We use their business API services, not their consumer apps.
- Our accounts with them are set so they do not use our data to train their models.
- They may keep inputs and outputs for up to 30 days for safety and abuse monitoring, then delete them.
The Brand Workspace assistant is an AI. Its answers can be wrong or incomplete, so check anything important before you rely on it.
We may also use de-identified data to train and improve Goldthread's own models. Section 7 explains what "de-identified" means, and section 9.2 explains how to opt out.
6. Who can see your information
6.1 Inside Goldthread's products
| Information | Who can see it |
|---|---|
| A provider's profile sections marked "Shown to brands" | Signed-in brand users |
| A provider's sections marked "Private to Goldthread" | Goldthread only |
| Names of clients a provider marks confidential | Not shown on the provider's profile or in Search. Goldthread can see them. Other text the provider writes, such as case studies, is shown as written, so providers should not name a confidential client anywhere else. |
| Fields a provider leaves empty | May show information from the provider's public website, labelled "From public sources" |
| A provider's published pricing (pricing model and project size) | Verified brand users only. Not shown to other providers. |
| A brand's briefs, chats, shortlists, passes and notes | Users in the brand's organization who can see that search, and Goldthread staff who need access to run and support the service. Never providers. |
| A request a brand sends | The provider it is sent to, including the brand's name, and the brand users who can see the search it came from |
| A provider's reply and quote | Only the brand that received it. Never other providers. |
| A brand's roster | Users in that brand's organization, and Goldthread staff who need access to run and support the service |
| A brand's plans, pricing comparisons, compliance checks and results | Users in that brand's organization, and Goldthread staff who need access to run and support the service. Never providers or other customers. |
| A contract negotiation | The brand and the provider in that negotiation |
| Sign-up source codes | Goldthread staff only |
6.2 Service providers
We share information with the companies that help us run Goldthread, and only so they can do that work:
| Company | What it does | What it receives |
|---|---|---|
| Google Cloud | Hosting, database, file storage, document text recognition and error reports | All platform data. Error reports can include details of the request that failed. |
| Anthropic | AI models | Briefs, plans, chats, profiles, documents, replies, contract terms, content submitted for review, and public website text |
| OpenAI | AI models for search matching | Brief text and profile text |
| Resend | Sending email | Email addresses and email content |
| Sentry | Error monitoring for part of our web app | Technical error details, with personal data turned off |
| Slack | Internal alerts | Technical error summaries, with emails, phone numbers, sign-in codes and IP addresses removed |
| HubSpot | Website analytics and contact management | Website visit data and the contact details you submit |
We also use everyday business tools, such as Google Workspace, Linear, Granola and Pipedrive. These can hold contact details, correspondence and notes from our meetings with you.
We will update this list when we add or change service providers.
6.3 Other sharing
We may share information:
- when the law requires it, or to protect the rights and safety of people or of Goldthread
- with a buyer or successor if Goldthread is sold or merged, under the same protections
- with your consent
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
7. Aggregated and de-identified information
We create information that does not identify any person, brand, provider or engagement. We may use it for any purpose, including benchmarks, market reports, research, product improvement and training our own models. We will not try to re-identify it.
- "Aggregated" means combined across many organizations.
- "De-identified" means names and other direct identifiers are removed, and we take reasonable steps so the information cannot be linked back to anyone.
When we publish pricing benchmarks or market reports, we follow these rules:
- No figure is published unless at least five different providers contributed to it, or seven for price figures where there is enough data.
- No single provider makes up 25% or more of a figure.
- Pricing data is at least three months old when it is used.
- We publish ranges, such as the middle half of prices. We never publish a single provider's price, a named provider's quote, or the lowest or highest price.
Signals that combine brands' experiences, such as "brands like you have had success with this provider", appear only when at least five brand organizations support them.
8. How long we keep information
We keep information for as long as we need it to provide the service and for the purposes in this policy:
| Information | How long |
|---|---|
| Account, profile and organization data | While the account is open |
| Brand searches, shortlists, passes and notes | While the search exists |
| Chats and collaboration activity on a search | While the search exists. Deleted after 13 months without activity. |
| Requests, replies, contracts and negotiations | While the brand's account is open |
| Plans, pricing comparisons, compliance checks and results | While the brand's account is open |
| Provider-uploaded documents | While the provider's account is open, or until the provider asks us to delete them |
| Profiles built from public websites | While the provider is listed, or until the provider asks us to correct or remove them |
| Security, fraud-prevention and usage logs | As long as needed for security, fraud prevention and legal purposes |
| After an account closes | Brands can ask for an export of their content for 60 days. We then delete or de-identify personal information within 30 days, except what we must keep for legal, tax, security or dispute reasons. Backup copies are deleted on our regular backup schedule. |
| Aggregated and de-identified information | Indefinitely |
9. Your choices and rights
9.1 Your rights
You can ask us to:
- give you a copy of your information
- correct it
- delete it
- restrict or object to how we use it
Email privacy@goldthread.ai. We will confirm your identity and respond within 45 days. We will not treat you differently for using these rights. Depending on where you live, you may also have the right to complain to your data protection authority.
9.2 Opt-outs for organizations
An organization's admin can email privacy@goldthread.ai to exclude the organization's data from:
- training Goldthread's own AI models
- contributing to benchmarks and market reports
An opt-out applies to future use within 30 days. It does not change reports already published or information already combined into aggregates. Customers with a signed agreement may agree further exclusions with us.
9.3 People and agencies listed from public websites
If your agency, your name or your contact details appear on Goldthread because they were on a public website, you can:
- claim the agency's profile and update it
- ask us to correct or remove your personal details
- ask us to remove an unclaimed agency profile
Email privacy@goldthread.ai.
9.4 Providers: hiding your profile
A provider admin can hide (unpublish) the organization's profile so brands no longer see it. To do this, use the setting in Provider Workspace or email privacy@goldthread.ai. Information already sent to brands in replies, and aggregated or de-identified information, stays.
9.5 Marketing emails
Use the unsubscribe link in any marketing email.
10. Cookies and similar technologies
- Our products use browser storage only for what the product needs to work, such as keeping you signed in and remembering display settings. They do not use advertising or third-party analytics cookies.
- goldthread.ai uses HubSpot cookies to understand visits and manage contact requests. Visitors from the UK and EU see a banner and must opt in before these cookies are set. You can also block or delete cookies in your browser settings.
11. Where information is stored
Goldthread stores data in the United States, in Google Cloud's Oregon region. Our service providers process data mainly in the United States. If you use Goldthread from outside the United States, your information is transferred there. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
12. Security
We protect information with:
- encryption in transit
- role-based access in our products, and audit logs of account actions
- virus scanning of uploaded files on our own servers
- removal of email addresses and other identifiers from error alerts
No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.
13. Changes to this policy
When we make material changes, we will post the new version with a new effective date. We will tell account holders by email or in the product before the change takes effect.
14. Contact
privacy@goldthread.ai
Goldthread, Inc., 109 Culebra Terrace, San Francisco, CA 94109, United States